Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Opera\sivsnui.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Opera\srvolpsm.exe	N/A
N/A	N/A	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe	N/A

Checks BIOS information in registry

Description	Indicator	Process	Target
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe	N/A

Identifies Wine through registry keys

evasion

Description	Indicator	Process	Target
Key opened	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Wine	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\65041a83c88ba90e489de8ac275688815c51b93ae568c627b74fc160d2db6bab.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\65041a83c88ba90e489de8ac275688815c51b93ae568c627b74fc160d2db6bab.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\65041a83c88ba90e489de8ac275688815c51b93ae568c627b74fc160d2db6bab.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Opera\sivsnui.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
N/A	N/A	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe	N/A
N/A	N/A	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run	C:\Users\Admin\AppData\Local\Temp\65041a83c88ba90e489de8ac275688815c51b93ae568c627b74fc160d2db6bab.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\OperaSyncService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Opera\\sivsnui.exe"	C:\Users\Admin\AppData\Local\Temp\65041a83c88ba90e489de8ac275688815c51b93ae568c627b74fc160d2db6bab.exe	N/A

Legitimate hosting services abused for malware hosting/C2

Suspicious use of NtSetInformationThreadHideFromDebugger

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe	N/A

Drops file in Program Files directory

Description	Indicator	Process	Target
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\vpnpro.ITA.lng	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\vpnpro.PTB.lng	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\liblzo2-2.dll	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN64\bin\libeay32.dll	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows\driver\OemWin2k.inf	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows64\bin\deltapall.bat	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows64\driver\OemWin2k.inf	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\vpnpro.ROM.lng	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\openssl.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\test.ovpn	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows\driver\tap0901.cat	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows64\driver\System64Folder\DriverStore\FileRepository\oemwin2k.inf_amd64_5a1fec2fbbccefcc\oemwin2k.PNF	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows64\driver\System64Folder\DriverStore\FileRepository\oemwin2k.inf_amd64_5a1fec2fbbccefcc\tap0901.sys	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\stop_all.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\unins000.dat	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows64\bin\addtap.bat	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\countries.tsv	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\innoupd.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\openvpn-gui.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\openvpn.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\ssleay32.dll	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\superb.ovpn	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN64\bin\openssl.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows\bin\deltapall.bat	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\openvpnserv.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\vpn850936802.ovpn	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN64\bin\openvpn-gui.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows\bin\addtap.bat	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows\bin\tapinstall.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows\driver\OemVista.inf	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows\driver\tap0901.sys	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\memmgrset.dll	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\vpnpro.RUS.lng	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\libpkcs11-helper-1.dll	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN64\bin\openvpnserv.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows64\bin\devcon.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows64\driver\tap0901.cat	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows64\driver\System64Folder\DriverStore\FileRepository\oemwin2k.inf_amd64_5a1fec2fbbccefcc\tap0901.cat	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\unins000.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\vpnpro.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\vpnpro.ntv.lng	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\japonia.ovpn	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN64\bin\libpkcs11-helper-1.dll	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows\bin\devcon.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows64\driver\tap0901.sys	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\vpnpro.FIN.lng	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\libeay32.dll	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN64\bin\liblzo2-2.dll	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN64\bin\openvpn.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN64\bin\ssleay32.dll	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows64\driver\System64Folder\DriverStore\FileRepository\oemwin2k.inf_amd64_5a1fec2fbbccefcc\oemwin2k.inf	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\INF\oem59.PNF	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A

Enumerates physical storage devices

Checks processor information in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe	N/A

Modifies system certificate store

evasion spyware trojan

Description	Indicator	Process	Target
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe	N/A
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 956 wrote to memory of 2236	N/A	C:\Users\Admin\AppData\Local\Temp\65041a83c88ba90e489de8ac275688815c51b93ae568c627b74fc160d2db6bab.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe
PID 956 wrote to memory of 2236	N/A	C:\Users\Admin\AppData\Local\Temp\65041a83c88ba90e489de8ac275688815c51b93ae568c627b74fc160d2db6bab.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe
PID 956 wrote to memory of 2236	N/A	C:\Users\Admin\AppData\Local\Temp\65041a83c88ba90e489de8ac275688815c51b93ae568c627b74fc160d2db6bab.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe
PID 956 wrote to memory of 2236	N/A	C:\Users\Admin\AppData\Local\Temp\65041a83c88ba90e489de8ac275688815c51b93ae568c627b74fc160d2db6bab.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe
PID 956 wrote to memory of 2236	N/A	C:\Users\Admin\AppData\Local\Temp\65041a83c88ba90e489de8ac275688815c51b93ae568c627b74fc160d2db6bab.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe
PID 956 wrote to memory of 2236	N/A	C:\Users\Admin\AppData\Local\Temp\65041a83c88ba90e489de8ac275688815c51b93ae568c627b74fc160d2db6bab.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe
PID 956 wrote to memory of 2236	N/A	C:\Users\Admin\AppData\Local\Temp\65041a83c88ba90e489de8ac275688815c51b93ae568c627b74fc160d2db6bab.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe
PID 956 wrote to memory of 2252	N/A	C:\Users\Admin\AppData\Local\Temp\65041a83c88ba90e489de8ac275688815c51b93ae568c627b74fc160d2db6bab.exe	C:\Users\Admin\AppData\Local\Temp\Opera\sivsnui.exe
PID 956 wrote to memory of 2252	N/A	C:\Users\Admin\AppData\Local\Temp\65041a83c88ba90e489de8ac275688815c51b93ae568c627b74fc160d2db6bab.exe	C:\Users\Admin\AppData\Local\Temp\Opera\sivsnui.exe
PID 956 wrote to memory of 2252	N/A	C:\Users\Admin\AppData\Local\Temp\65041a83c88ba90e489de8ac275688815c51b93ae568c627b74fc160d2db6bab.exe	C:\Users\Admin\AppData\Local\Temp\Opera\sivsnui.exe
PID 956 wrote to memory of 2252	N/A	C:\Users\Admin\AppData\Local\Temp\65041a83c88ba90e489de8ac275688815c51b93ae568c627b74fc160d2db6bab.exe	C:\Users\Admin\AppData\Local\Temp\Opera\sivsnui.exe
PID 2252 wrote to memory of 2280	N/A	C:\Users\Admin\AppData\Local\Temp\Opera\sivsnui.exe	C:\Users\Admin\AppData\Local\Temp\Opera\srvolpsm.exe
PID 2252 wrote to memory of 2280	N/A	C:\Users\Admin\AppData\Local\Temp\Opera\sivsnui.exe	C:\Users\Admin\AppData\Local\Temp\Opera\srvolpsm.exe
PID 2252 wrote to memory of 2280	N/A	C:\Users\Admin\AppData\Local\Temp\Opera\sivsnui.exe	C:\Users\Admin\AppData\Local\Temp\Opera\srvolpsm.exe
PID 2252 wrote to memory of 2280	N/A	C:\Users\Admin\AppData\Local\Temp\Opera\sivsnui.exe	C:\Users\Admin\AppData\Local\Temp\Opera\srvolpsm.exe
PID 2236 wrote to memory of 2416	N/A	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe
PID 2236 wrote to memory of 2416	N/A	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe
PID 2236 wrote to memory of 2416	N/A	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe
PID 2236 wrote to memory of 2416	N/A	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe
PID 2236 wrote to memory of 2416	N/A	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe
PID 2236 wrote to memory of 2416	N/A	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe
PID 2236 wrote to memory of 2416	N/A	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe

Processes

C:\Users\Admin\AppData\Local\Temp\65041a83c88ba90e489de8ac275688815c51b93ae568c627b74fc160d2db6bab.exe

"C:\Users\Admin\AppData\Local\Temp\65041a83c88ba90e489de8ac275688815c51b93ae568c627b74fc160d2db6bab.exe"

C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe

"C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe"

C:\Users\Admin\AppData\Local\Temp\Opera\sivsnui.exe

"C:\Users\Admin\AppData\Local\Temp\Opera\sivsnui.exe"

C:\Users\Admin\AppData\Local\Temp\Opera\srvolpsm.exe

"C:\Users\Admin\AppData\Local\Temp\Opera\srvolpsm.exe"

C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe

"C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	mailtransfersagents.com	udp
US	8.8.8.8:53	iplogger.org	udp
DE	148.251.234.83:443	iplogger.org	tcp
DE	148.251.234.83:443	iplogger.org	tcp
US	8.8.8.8:53	bitbucket.org	udp
US	104.192.141.1:443	bitbucket.org	tcp
DE	148.251.234.83:443	iplogger.org	tcp
DE	148.251.234.83:443	iplogger.org	tcp
DE	148.251.234.83:443	iplogger.org	tcp
DE	148.251.234.83:443	iplogger.org	tcp

Files

\Users\Admin\AppData\Local\Temp\intervpnmix2.exe

MD5	a4f59f6aabf8ff8453ff6993d88e807a
SHA1	745f0f43bc760c1f7e6cbf599bc3a4348a448de2
SHA256	0c0c7dd2fd712e94489d98e9e2bd8d72af39c9e8d5c505abe2972e88733a80bc
SHA512	f92c29e6e89dbbb8a04f823c365ea512b5c643cf847a363ddc2288bd5d92ae8f633277f21f6747f626d58ef05c0657464e32fdfb05f16433c399c9c20eb0b688

C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe

MD5	a4f59f6aabf8ff8453ff6993d88e807a
SHA1	745f0f43bc760c1f7e6cbf599bc3a4348a448de2
SHA256	0c0c7dd2fd712e94489d98e9e2bd8d72af39c9e8d5c505abe2972e88733a80bc
SHA512	f92c29e6e89dbbb8a04f823c365ea512b5c643cf847a363ddc2288bd5d92ae8f633277f21f6747f626d58ef05c0657464e32fdfb05f16433c399c9c20eb0b688

\Users\Admin\AppData\Local\Temp\Opera\sivsnui.exe

MD5	52a895199380705c514dd0a23ba52414
SHA1	daa7130a286d82b1bd054261514397954ca62e78
SHA256	a1ce1b78cc1a9d6092b086f2d0796cde519033ec0935d9cecdea86b6cda87882
SHA512	212980beeae31963e7922a2436931737aa2e609de384e78f37fae0569782b52c6c261bf54265dbc9d3703ffa14410943a409c0ef294b40c19e1a87e8e0a14b58

memory/2236-57-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe

MD5	a4f59f6aabf8ff8453ff6993d88e807a
SHA1	745f0f43bc760c1f7e6cbf599bc3a4348a448de2
SHA256	0c0c7dd2fd712e94489d98e9e2bd8d72af39c9e8d5c505abe2972e88733a80bc
SHA512	f92c29e6e89dbbb8a04f823c365ea512b5c643cf847a363ddc2288bd5d92ae8f633277f21f6747f626d58ef05c0657464e32fdfb05f16433c399c9c20eb0b688

\Users\Admin\AppData\Local\Temp\Opera\sivsnui.exe

MD5	52a895199380705c514dd0a23ba52414
SHA1	daa7130a286d82b1bd054261514397954ca62e78
SHA256	a1ce1b78cc1a9d6092b086f2d0796cde519033ec0935d9cecdea86b6cda87882
SHA512	212980beeae31963e7922a2436931737aa2e609de384e78f37fae0569782b52c6c261bf54265dbc9d3703ffa14410943a409c0ef294b40c19e1a87e8e0a14b58

C:\Users\Admin\AppData\Local\Temp\Opera\sivsnui.exe

MD5	52a895199380705c514dd0a23ba52414
SHA1	daa7130a286d82b1bd054261514397954ca62e78
SHA256	a1ce1b78cc1a9d6092b086f2d0796cde519033ec0935d9cecdea86b6cda87882
SHA512	212980beeae31963e7922a2436931737aa2e609de384e78f37fae0569782b52c6c261bf54265dbc9d3703ffa14410943a409c0ef294b40c19e1a87e8e0a14b58

\Users\Admin\AppData\Local\Temp\Opera\srvolpsm.exe

MD5	10a222ed3c202e3d5ac83438a1b35054
SHA1	a96dc73215be43577b6184f4d20e45123d5801cf
SHA256	849aecfb2f29dd383cd69cf0c5731f94157ca25305f6b0e6d52a3be27d4331c2
SHA512	63ad6432c23250d5d2ddef8809e3f465d09bfc8c02cf7ad012e5c0209d6234b2a7ac99f6a4136b4b00a86da93e86cba1c31c6f77687f308fd71936e8975f646c

C:\Users\Admin\AppData\Local\Temp\Opera\srvolpsm.exe

MD5	10a222ed3c202e3d5ac83438a1b35054
SHA1	a96dc73215be43577b6184f4d20e45123d5801cf
SHA256	849aecfb2f29dd383cd69cf0c5731f94157ca25305f6b0e6d52a3be27d4331c2
SHA512	63ad6432c23250d5d2ddef8809e3f465d09bfc8c02cf7ad012e5c0209d6234b2a7ac99f6a4136b4b00a86da93e86cba1c31c6f77687f308fd71936e8975f646c

C:\Users\Admin\AppData\Local\Temp\Opera\srvolpsm.exe

MD5	10a222ed3c202e3d5ac83438a1b35054
SHA1	a96dc73215be43577b6184f4d20e45123d5801cf
SHA256	849aecfb2f29dd383cd69cf0c5731f94157ca25305f6b0e6d52a3be27d4331c2
SHA512	63ad6432c23250d5d2ddef8809e3f465d09bfc8c02cf7ad012e5c0209d6234b2a7ac99f6a4136b4b00a86da93e86cba1c31c6f77687f308fd71936e8975f646c

\Users\Admin\AppData\Local\Temp\intervpnmix2.exe

MD5	a4f59f6aabf8ff8453ff6993d88e807a
SHA1	745f0f43bc760c1f7e6cbf599bc3a4348a448de2
SHA256	0c0c7dd2fd712e94489d98e9e2bd8d72af39c9e8d5c505abe2972e88733a80bc
SHA512	f92c29e6e89dbbb8a04f823c365ea512b5c643cf847a363ddc2288bd5d92ae8f633277f21f6747f626d58ef05c0657464e32fdfb05f16433c399c9c20eb0b688

\Users\Admin\AppData\Local\Temp\intervpnmix2.exe

MD5	a4f59f6aabf8ff8453ff6993d88e807a
SHA1	745f0f43bc760c1f7e6cbf599bc3a4348a448de2
SHA256	0c0c7dd2fd712e94489d98e9e2bd8d72af39c9e8d5c505abe2972e88733a80bc
SHA512	f92c29e6e89dbbb8a04f823c365ea512b5c643cf847a363ddc2288bd5d92ae8f633277f21f6747f626d58ef05c0657464e32fdfb05f16433c399c9c20eb0b688

\Users\Admin\AppData\Local\Temp\intervpnmix2.exe

MD5	a4f59f6aabf8ff8453ff6993d88e807a
SHA1	745f0f43bc760c1f7e6cbf599bc3a4348a448de2
SHA256	0c0c7dd2fd712e94489d98e9e2bd8d72af39c9e8d5c505abe2972e88733a80bc
SHA512	f92c29e6e89dbbb8a04f823c365ea512b5c643cf847a363ddc2288bd5d92ae8f633277f21f6747f626d58ef05c0657464e32fdfb05f16433c399c9c20eb0b688

\Users\Admin\AppData\Local\Temp\nst5294.tmp\UAC.dll

MD5	adb29e6b186daa765dc750128649b63d
SHA1	160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA256	2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
SHA512	b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe

MD5	1e3c7d4a228c5461d6b1bb0bf211e93c
SHA1	73b9ca33b15a63383a61d4c48c0e6b3446cd79be
SHA256	de7ff68cb42f166f5e50da8ba4fd762af765af68db9d03cae6be6d0847281af6
SHA512	2be191581688dd73e585388c6eda5f29eb32ee464f7e666b01f4eb9779b8429ab6ba8d2f8a3fa79cdda317f0b1dbcea5a5f73e627f692d998f475498fd6b2494

C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe

MD5	1e3c7d4a228c5461d6b1bb0bf211e93c
SHA1	73b9ca33b15a63383a61d4c48c0e6b3446cd79be
SHA256	de7ff68cb42f166f5e50da8ba4fd762af765af68db9d03cae6be6d0847281af6
SHA512	2be191581688dd73e585388c6eda5f29eb32ee464f7e666b01f4eb9779b8429ab6ba8d2f8a3fa79cdda317f0b1dbcea5a5f73e627f692d998f475498fd6b2494

\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe

MD5	1e3c7d4a228c5461d6b1bb0bf211e93c
SHA1	73b9ca33b15a63383a61d4c48c0e6b3446cd79be
SHA256	de7ff68cb42f166f5e50da8ba4fd762af765af68db9d03cae6be6d0847281af6
SHA512	2be191581688dd73e585388c6eda5f29eb32ee464f7e666b01f4eb9779b8429ab6ba8d2f8a3fa79cdda317f0b1dbcea5a5f73e627f692d998f475498fd6b2494

\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe

MD5	1e3c7d4a228c5461d6b1bb0bf211e93c
SHA1	73b9ca33b15a63383a61d4c48c0e6b3446cd79be
SHA256	de7ff68cb42f166f5e50da8ba4fd762af765af68db9d03cae6be6d0847281af6
SHA512	2be191581688dd73e585388c6eda5f29eb32ee464f7e666b01f4eb9779b8429ab6ba8d2f8a3fa79cdda317f0b1dbcea5a5f73e627f692d998f475498fd6b2494

C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe

MD5	1e3c7d4a228c5461d6b1bb0bf211e93c
SHA1	73b9ca33b15a63383a61d4c48c0e6b3446cd79be
SHA256	de7ff68cb42f166f5e50da8ba4fd762af765af68db9d03cae6be6d0847281af6
SHA512	2be191581688dd73e585388c6eda5f29eb32ee464f7e666b01f4eb9779b8429ab6ba8d2f8a3fa79cdda317f0b1dbcea5a5f73e627f692d998f475498fd6b2494

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051501578_0.sft

MD5	f4c6d2a10f9e2a45fb5823bce6f738f1
SHA1	4130788305c45de06ffea31416e36f4ec162ba70
SHA256	28bbe3fa81d04d0a241758251403fc5a0c2b62106b663781d5925c09fb9e9a64
SHA512	8b873f9efb0a0aab6daf0e5b0846be539bbf598e373fc17263b188129ac6869ac65b31ab18310b2941c306c6ddb2f2b39700a529a6028f62d36e00c2db63cc42

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051501578_1.sft

MD5	d2671717b3af23ffd18f841e1429c251
SHA1	3781ba63470a74da797e4b4b33628c5d44e93a75
SHA256	8bce184dcc4842b43977003c97d04fdaf2b4168567df4538306e3cf7974b53f8
SHA512	77bcdca4ccd47eab8ab02385541c22a89adad24e25ec9e18d8529a97ed50a1168c4aff1aa28d332ea394ead4a08b3ba00729788c6f6fe47657283abedff2d200

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051501578_2.sft

MD5	37bda9158f984c7f05cec3670c1782e6
SHA1	00956565459ee2bf4b6aefe43037c5e889c0dd65
SHA256	984bdc05f7d4969e1448f0802d89ca08648a9e1d954568735b9f2d69dee3d5b4
SHA512	48d0d98f37d719cd8c935a1ad94fc54f5b0213d33739f5df7d65f2b5b2c343061d1b287ce8dc7f2f39d87ca54d6c20da2658b0e397718496fe21d65b7729e953

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051501578_3.sft

MD5	326fcb499690d11396be077d749dce49
SHA1	f20e172d6f008fbd34176e66d5eaf3b064426fbf
SHA256	8c16883c76b85e8d7d2998cf12d7bc60a44e28b2059dd2e74f459d1fab392cbc
SHA512	d27eafa343062a992d1278c2caff78f2fbfbd90dd08d8d3952bb874f205abe72f05658ef529000e5c9f0be965eee487efc91682b3a6876e79ed69841761382c7

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051501578_4.sft

MD5	ebf07cc3e1482317b808aeb9000075d0
SHA1	40a4db5c9c84b1746fbee70135e3464a4c28f16f
SHA256	46bf4160cb3dfc05e61d0e1f283d934db71a62038b57461e7d62269d6afa9262
SHA512	f24879059100bbe934ec2e9bb247b8dec0e0e49c808eea5e9b7fec2deddb6d059115d4a2678c455a796a852101e13e715d662cfa3e4f55c2c4204bbd2bd82646

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051501578_5.sft

MD5	fc480d32ca10bb904f7b1d815a6a2d8c
SHA1	a705cc45c1781d7a5276ec3c97d01cf96ce537a2
SHA256	e920f226c7c38ac35c403ac7da76acfe5e1b0ad8dee9e92f38c46954485cceb6
SHA512	873ed27140702997188be82367ccd82c8c4223e42596e5f822f8affca38aa7043f695c5fc64438df147a46f37bfb364d0c3c6f2ac5e07070262a1201581b1f4e

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051501578_6.sft

MD5	90be0585384310aaf731cc9c451cf905
SHA1	3889ae107ed768cfb75f8007102547ffded040b8
SHA256	6cfc665e2f6044580e97b26a804e613438e9bf9157bce10f88e4f2d067063009
SHA512	bb459bd724486a238a952c47fb6219d759a97f989fef5fac544f48649c9d425f064a4e077807cc597fca63f4f1177e88c206a670784970c5dbf78b1f2b57b1d5

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051501578_7.sft

MD5	b3b853f91fc7fa260c226e58b475ff5d
SHA1	5e28f04f48115164e994ce4d16e7d84fb27002ea
SHA256	969ec30a662312b169c2f13ff0f43b60bc504255ecdf77c59724dc3b509721fd
SHA512	ba417ed785e49fcf97f72b7fc8804837cbf9ebb01d7e10e4f3bc0a16c1a9920a9977824789f7553e8f5c1dad56e34f887b7ee16d376176266a8df14f94be6470

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051501578_8.sft

MD5	3ebde4e70ea260ef4f54e3fb10da857f
SHA1	de629dc81f260d7386829f5bf2c129d23c5bc058
SHA256	843d5171aa6edf73b9b864f85c4846f4adf663226420f3925d60336565ac2a46
SHA512	0e84ee6c9c1040c2253c80b0efbecddaa5d44e0db739aca53bbe2e5de1657139671b2883c850b631135d46760d8e86839d44689bf9f711334c6de5d86ca77af9

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051504136_0.sft

MD5	032f41d3b642217ffb33f9611501f532
SHA1	7fff1bd8cf7c305a50db37353aac74e797426479
SHA256	3f2eefc528ce69b9c9fc50800d410598ee33e7fd84139dc065b8e1dc1662faef
SHA512	e6d08f12d06100edbe8b5ea255253a1f4bebe16e16538cae68000db53ec20ff298251003dad64916fe5e322639c01c148058c0bee5d1b421dd496e9de9ec8ac7

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051504136_2.sft

MD5	317b0feca5b6e622817261af841f2b2a
SHA1	0b56f1437b70a90f1c7c7ee0512fb8609ea26189
SHA256	43bac20a9435470ce81be3d62cfcf8ddd72eb807fc821a1d6e64654ecdccd83a
SHA512	20cc22a03a6924475ed63e3656b3534571cebaadb886d4acbb8302d3307cdf24fd72dca383de989d8fe83cfdb2e1290d07374062a4a995be140c5e541b9017d6

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051504136_1.sft

MD5	352cf779c4d07e7fb28aaa67662dca91
SHA1	46d0b2b891be0d1949354fbd227d6d62fc438e76
SHA256	0b5eb1e46bd3a624b41b38c3bb0b069f63ff279a76454a9a8dd49c2f091cc7a1
SHA512	4a2d70a51a648015308c1b07f48dafd879a9ec1da6942f03c45aebbb6d02f697adf93fc487a45798f0427cc61faaaa723af01dd693361b8555c2efd31f76f175

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051504136_3.sft

MD5	8d7c011021a6051c6ea8ac51a2f05c8e
SHA1	2d6865d0ee6a1bf058f36c28d4178652a977a12f
SHA256	ff6b5f19fb02334edb1acef2399b54bcfcfd25dd9210383c0d7c0bfbf7ecc628
SHA512	5f2b58295d3d800b259101c432aa1925db4e03bb40fe6be9cf1b964ea2f7edaccd8ffc010a2600031c59df56c576b66620d6f626053d89408994c656c5fcd59b

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051504136_4.sft

MD5	bd6e75511c3ea569043a0be3142fcbfe
SHA1	8c28a5cc8b812a0d471bda0ef9b214c2ea774131
SHA256	b933c218a302b75e68286595de6d1ded6d0714f61059bacaa4ffebfc32ccc49f
SHA512	9c312085d3740fd1cce3320f9fb9113e8caddc6b0a2458b78795f08bf19701dea56358ee9f2bfba6e1b2692a0d9d679fab629c8cb7f5b6a3726a97bbd2eed8dc

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051504136_5.sft

MD5	3ca9207b85c44a5a0160284f483eff00
SHA1	5474c3f262b29e569625a9e199fcef97defaf879
SHA256	9bd9aebd75b77a82332021d73afa802c2bf86c2c590acbf3d5a38279c9d5eb60
SHA512	dadd783abe8986355a144d35fbc05ad056994c195fc52de3ee64c2c70a99e404b64d7568d1e07f25e98aacf960600c2c505068920c477ad396e89bb3338308e5

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051504136_6.sft

MD5	4fb72eb837da0a4579c91f44f6267621
SHA1	5245398059cf3316cabfae3145d800f78dd04f96
SHA256	0957908db2a2ef0768365fa9107f9489e1c3f24a2d446d964616fde70a946748
SHA512	bb19b76d34f5b94288256f353dee8a8a409c6f8444bb35f7a8f8f3b6a0689a63f5141a75b736c6702b3d938ee01bbab806a8a5523953d8ee75e0bc7dbcb35a41

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051504136_7.sft

MD5	3fb60ee2f518bfed316f5228be279d09
SHA1	7407bc55428b62dcc58bc47eaa49b9893d385453
SHA256	18ff98bd1d5d347831a0120c0a4705f6da6931f0d1707d2ffb5d5d239d4bdc88
SHA512	832ba7594f4a801ffcf17f3c40bb580e7a57d977dfefc4a1500b55bc5f76c969dbe01a9183eb3ff7ed55171d15d4964e653f02adf69a0a4e4d70a61ea281a89c

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051506617_0.sft

MD5	37f0fb87f79733beebacb8d5964d95ba
SHA1	fb304ba16b55437205f2dc3cd4a77b052923c513
SHA256	294ee6dc47cb85ccdf6efee650a04a90202408c7a717b2f968aeec1e24f78aeb
SHA512	a1f6c22a02fb5a29ee84eb5e46d66864b0c90e302e0ba7dfca8fa8b19007e5cf06dcae619d233fea5dd03f70b338a8d9bbedb70fbe592f9197541d27b862b7c4

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051506664_0.sft

MD5	6392c957344eb7dfc7ef3409121a45d3
SHA1	fc12c277d93fbc23b2882b9366cfe7f4939a1f94
SHA256	9599120a32e34b8eccec4ea828c1d7bb9a448315ffe2b41c8ed33dac02bb5de7
SHA512	6af39e46949172a462bd8c75c205f4834792d36c23f938a32136165575ad83f3f135c355743227179642b8dd53d91d580fcf6f58d4264acf98ae5ebe6848d283

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051506664_1.sft

MD5	13cdbfbc6fbb91b4b91ab7139cbf5181
SHA1	74ec1e32e397f1e41de056ccd3f0aae96c352cc3
SHA256	0e337e0286731dbe64b4eefa229a157b719164c1c9e967f5691e0bd5f9e43b1b
SHA512	2332caefb337d3bf3f3dbd5edd226e393a896760eafd1e30112b9cbe51a34e0f706d74d322441e9f04ec26c64e7e70a0f166ced6074aa08bd3643a2d80add314

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051506664_2.sft

MD5	2e3c30814efef641809efc1e6ebac0b2
SHA1	e54b207bec3f27b775b8172d2b7e3bb7b6d5a12d
SHA256	bad72c74a0c387204cb5c4c8dba198fb7df8ceb71085694a216e936b8e0d9c2b
SHA512	6bfbe53eb30bd05c5b8662f70f4c66a137cf4cce064b86b17dcb95f730d330aa4e75109befe5c47aad1a89093a15e6e4c36ca7eba2139e0e47bd51d80ac5a431

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051506664_3.sft

MD5	18e6a3aaa22c9c5a1aeea897903d7433
SHA1	5c61be5af00feeba96cdb233e7172c30c77450c9
SHA256	019dca8a7ad14f80cd003248f304adccdcd09550cb8617b56bca9e1da9ff39fa
SHA512	58d39d32f380944fda2182a3b94979de3c3217323778dc2446a5a364f3d9780ff5f36a6dc8dc40c8ed189afd808733edc6856b8e188b5078ea30a0836909ecfb

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051506664_4.sft

MD5	6887e71de592a213c822320675c3b94c
SHA1	4a3ece563330ce995d4c363fdf30fa0e93ee39ef
SHA256	56a5b65776f7cccbe1de68ecaec3c463ac812f3c76fe12ee499417ed6c9a6ced
SHA512	daced13c45afaaa06d90fe7c405ce253b08085471f360c2788af98ec350db557851da9e8172908664f8cfc38aee39adab8127a7b3f977a8ec55997cfe2a462b6

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051506664_5.sft

MD5	f363e6e539f995c3676786196e4b1718
SHA1	9430567518acb03d0bdef87631e22d42873c9861
SHA256	ea8a829a01c6a13ed1592cfa20868d8d4c9b2be5ddd89d19c52ec2b2cef6615f
SHA512	f248164215b0538b8682aa9a40d92b3a95232dd3b0b1048cc6f2df1251b9c88dbb5bebb99b9a009a12380b43458ea7475b49b582075e8b6715165249ca80d99e

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051506664_6.sft

MD5	311980ba63256583a162e1e76155b1b9
SHA1	6910d142b963310842121feaf5c78e88e6832fb9
SHA256	830a5a99f1f550a77646318b9b49eff1d920100c67efb37ae6901f08190d1ab5
SHA512	d63d07d0df69e77c6c80bf5605c105f1f0f6e048767f265f3b715a26dc46c2b676d015d14461cab6c9327a205599936d2acbaa0989c324e197e9e21703dc287a

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051506976_0.sft

MD5	4eafa2657a7447164319b3026cccb270
SHA1	c78e6933af5b376d42aa210756b6c1d585ea7a4c
SHA256	963aed0d723b2b612efcce5492855fbac84857c2782b4c484b0cc7a8115591bd
SHA512	7d4643bd3908732cdb0052b592fb997ccb01435585d59e3d0b94484a3edb22c7de9a41ccad588e699245dcae8b08652e70aed6fcc3ef76ef1858762bf9cd35e2

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051506976_1.sft

MD5	867211c4fde2e56e3e148b56f379a81d
SHA1	4cfe84eee927c35f3e3bff9cd8bb67d6060832ab
SHA256	c284a108c8eb49135dc29a3ceb9d3e45c38d4d41556ab18a4f7b86bd9653ff32
SHA512	fbeb9268b19ddcc9aebf61107293bcbca8ccd00ba2ea7a1367a79e430074066b89065fa430b19e2d8e85f814082861686392d08340e072700d40b037fddbb9ee

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051506976_2.sft

MD5	c308fd82beb1905b3d1cd967ecefa4bb
SHA1	ad92f0f734650bd965d1109250b51e7e0a30eab4
SHA256	8bd913702a77cd59a85c3857ff925c0687fa607d48c679f311b7a5b16f49f0e8
SHA512	4f910313bd48f559155c8eadc6e5438bd74e8d920f2052bf158fbe9edd1aee87869827681a27216b26e345cfbb6ed2e268ab97929935ade15a4e3f323d2c10f3

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051506976_3.sft

MD5	0964ec06be76f3e3c047331845f4d92e
SHA1	5eba367c29fdb938f54fcdaa92fdc60f65613b70
SHA256	f233094090b223227c9f35c7ee413e1a3eab6a3e9b6985f0d9a1fd1e464e6646
SHA512	409fb81625896c8eee033ca94e203183a5b975f87bb974f3a1bfabf725041ed532979b928d192c9b1d6b65b9731acc83d705e81d298c5fb1f2240812479e092a

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051506976_4.sft

MD5	15f6851680b91a92ef4e5f2cb177d2ef
SHA1	b70e24a210dc383cdc938643d4f0021c32479936
SHA256	b7b10e87bd34b10fff829d4a3b3b30014a554d62fcd5712a4e4855d12ecd9f36
SHA512	8e9ea484e040082d031f63989c078a3d292a45b4ca8bcd3a8aefcdacd911ca1ad0925a5afde6d3e3b1199001e1041bcebe6ba91b2bac0a64da6ed8dffe89434d

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051506976_5.sft

MD5	28c7d6634a6133e968b6ed59bb4e1fea
SHA1	7f992750d29a2d6e4b2da5b40e90d2ab4d735f88
SHA256	065570793eeb790e4c28cba895c1d918d6e12c1242828c9497ed40284f714513
SHA512	f9a8e11cf64a2d3dd0da8c040cc7aa6ff8b01101a8ddbdbc5b69434fe6ce99a950ee1ab856a9e7da242e1629c6ed1d865ba1f68606b78e0a0e292a699c7a2fb1

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051506976_6.sft

MD5	89bcf4f38ef37c99a0f8b11ecc98099f
SHA1	9533a4bea81ead650680e74454f63a88a356d8d6
SHA256	fd4db7a1a78ae184380f85606bad41c627511269cb7a717c55e9e58130f4eac2
SHA512	ccee40140f1f6a1e55f721ab067930c0ef68bb45aa487561584bab491d5cc57c5214f0bb96f7dea83646eb76c80e4354d6df4504c0851dec3991918f34958184

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051506976_7.sft

MD5	e58ecf5394c49629bda58ead51298e55
SHA1	0f466d255f941926c2ca4be69cf1acf7d0018324
SHA256	686068224cab9da4326608f6aee63349a1da769d198805c359b4ee273bdba8f3
SHA512	b75db1221ae96ff9ba9caa764fb7157cd6c8cc918899bb8903314748ec734ede1eaff7ba32711fc7f66e83a7620c0311dde7bc919e1bfb2dfa59f3f41ca5d2ee

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051506976_8.sft

MD5	8cd3aa194a0fc0c3bf9a4659f2658e48
SHA1	b026b816f28a1ab6d972134fdb9e8d3380b4c048
SHA256	5f28d52097229106b133407f7a0e85aaa33d4c46398d8cfa2e345f11357b9804
SHA512	2c75968ebda7ffe5569ae5dc9add1b0dcf9a10ff827e8dc04ca5e15aadd71a6da387eda2db9c7dcb658b4fd21ca8f9d6b2ade5a0a38c49c31dd57c2136d40838

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051506976_9.sft

MD5	6c2313db53b0150156771ad14053eec7
SHA1	ca077cdc63a80c7f5eb3e1dcc918075708d3f37a
SHA256	6d6467daf7c9bce25a89a63f0c44f49cc862f4ba9da93ccd36d753180f249d67
SHA512	2d46844206486fdb0e6c7460c9ccfbc82faf4f28eab5fb3b940dc30572027ed33cdac694fe26fa6126b785b65154e8e700b42344ccd780734eeef9823523e587

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051507631_0.sft

MD5	6990382119b394368b8de15c7856e492
SHA1	23c0777efc696e0d7cdc5c1a9fe73ba6d15e5335
SHA256	b552b4372767da415acdc041c20e4eed0f86f098afc7d3d50dca29f6e2dc2a91
SHA512	836d872e634032886f1b0058e2d1d691a5ab330eac1ade1b164d42da0d5a9e861fb9487c6e912665979c2c5e5a6b91b4dfc8ddd45e4531f1a2f8e78e794755e0

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051507693_0.sft

MD5	0080ea45be26c9d6ffeac4c645aa6492
SHA1	0af956ac5dce88ceb672fb8436b0f3a5c46926fa
SHA256	1dfb86ad9e9c120320a22b0a0d4b4de43d9e14ed48df40d24e53d511c1bc6ba6
SHA512	a48a138237f4fe0c8dcb3d29d5fcc435c7691b6574bafa7700869a6f0f5ec52f91b5790656a85ccd9995ff5d8ce4270fa068ed1ff62a7dabf3c181401b88e12a

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051507693_1.sft

MD5	7334ebab25bd8088a99c95b0c480bd85
SHA1	45eb4d8472c034901cd5136468f60615fe3bc2c5
SHA256	6f418f4a7256df7d455d51a156ab60067d455a3d8e7ede18f3d40245928e230b
SHA512	a0987412e483178b13520db3d4be5c75f6925f7827edb69b597014fd9f0f3b5670b39e71aeefcfe94ff3833251e9a9c180a81e8a51d6a12e017e2f711a791b94

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051507693_2.sft

MD5	4b100afa0c52edf556ea13147081749a
SHA1	1c431ca9b8c761af88f83ad717914dd55bdaf220
SHA256	00021cd74ac67cbdbae7370c801dea9ccf3d3823314abf66865277b3c4b6f07c
SHA512	6377393ed501b5a1c4f332619ae7819b9655f75a8dbb379da5739b4a448a64ac06775b264203959fcbd6ba2c1acc81921787efa4387cfda7a5aa4e5d2c7f6edc

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051507693_3.sft

MD5	228be792800b369d3b5dae243edb7f8a
SHA1	444509569c50d817f7d29670f3fdd9386d9622d8
SHA256	22a4cd41880ce26d3f7788a9ab9450df88d562e15cd34bcb10ccc9bb7a2432b6
SHA512	89f320957398cbe0fe7b6cfa2d60739762a2b7b9247ead0be4bda334cd7e707f1d66fe7775a6c4b0f0606014b45356221e1a40e12edbd00d50bf923f7d55cda9

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051507693_4.sft

MD5	d21bff8aaed0995490b24c897b8d7300
SHA1	b87884a81157d7215a63b028cb91711d8ceef8be
SHA256	917313cd5f5c26c2dffc1f976e285966c00f8cf5fda13066c14254ef984bfafc
SHA512	7086e99371e681ca1e643112515d0431d246ed2fc93a8203ac74c6b3a59fbb55262d6b7b9b6f682bf4f7ec6572d0e43158b48f9fb62d9f0e1a765303236f535a

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051507693_5.sft

MD5	e81b1cf6d4a207c01b33626474f0875a
SHA1	f6b796dff2f1b89bdca8f6d4787a15e1fc47a936
SHA256	932b97b7348d033f2a87670f2eb331afe4e7a9759b30447b553e7c4ebb9d9662
SHA512	29ac89e0ed346f7cb4a42ee322949a476056c7769de43715f56cd4b377c1eba531c42ffadbc746aa2f41497977c32c8750c29c2ac04b34cf00eb51644d3f329c

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051507693_6.sft

MD5	e6ab976b914e4628c93434bd67952623
SHA1	42376c72206cd0f9445f3a6bf631b7da7181df8a
SHA256	b7f73d19f78bc0e0c23d406645a73d2e3a176fe2aa28b192aa7c94c2adc93048
SHA512	14a4f9d072fe995f5d80e27779b59b611912b94a58ba8856f6431ae6dda8e7542a41a6fbaf41390ea45719618be31f7c7da3deae2db16d299f63952ed317c5b7

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051507787_0.sft

MD5	5e521d6c41dacf4a44251411d11e283a
SHA1	8036466cf3b1ea6c9e3743520ef43e12aa8f3df4
SHA256	2734880a803478a1ed81ba9cf6a3ad33228285bc047e9ed636dc3d8f81d0a8ad
SHA512	17370466d974a1c758eed55b5d7e39a442e50c02b286a5025e821386840652c83816e795cfa858f59d063267e2f06e035aa95556b1c81bda7936992c10f2338a

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051507787_1.sft

MD5	e823c13cf49037e322d14b5ff3fb2cff
SHA1	21793c5d26c5498b6f7b60bc44d985326b5eb3ba
SHA256	cab3bd2e27d8ef14fce2595a519d4ab64df2eaa2dfb109e6d8e0744f44a2e9fd
SHA512	47adfa950153d901f299266ecdec25ca9c193f9ba54ba05fbfb97e4cf712f88cfdd4dd3ad326e8aadc702f044be70d562e94c2fdc4912e1ddabc9f5336bd0daf

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_778702912_0124051507787_2.sft

MD5	6f6e9ca8b630b9cbd8bdd4bc374a08ce
SHA1	8220304ee8c4d0fc9ca337f477f609f05bc22dc8
SHA256	52e98806d88a9b129e215fca9e4b7e73dbcaf3f52f154f83fb3430b30b437daa
SHA512	aa57ea8868672f1bba061f1ab96cb4fd7300e2a303e3ad1c689e631a08bdc11f627ea4faa6e6b9600aac028b1ac9123aa0c2e437cc13ee7cfaa73585bed56600

memory/2416-120-0x0000000009490000-0x0000000009491000-memory.dmp

memory/2416-121-0x0000000008F60000-0x0000000008F61000-memory.dmp

memory/2416-122-0x00000000094D0000-0x00000000094D1000-memory.dmp

memory/2416-123-0x00000000094E0000-0x00000000094E1000-memory.dmp

memory/2416-124-0x0000000009000000-0x0000000009001000-memory.dmp

memory/2416-125-0x0000000009480000-0x0000000009481000-memory.dmp

memory/2416-126-0x00000000094B0000-0x00000000094B1000-memory.dmp

memory/2416-128-0x0000000008F70000-0x0000000008F71000-memory.dmp

memory/2416-127-0x0000000008FF0000-0x0000000008FF1000-memory.dmp

memory/2416-129-0x0000000009010000-0x0000000009011000-memory.dmp

memory/2416-130-0x0000000009600000-0x0000000009601000-memory.dmp

memory/2416-132-0x00000000094C0000-0x00000000094C1000-memory.dmp

memory/2416-131-0x0000000000400000-0x0000000000912000-memory.dmp

memory/2416-133-0x0000000008FB0000-0x0000000008FB1000-memory.dmp

memory/2416-134-0x0000000009610000-0x0000000009611000-memory.dmp

memory/2416-135-0x00000000096B0000-0x00000000096B1000-memory.dmp

memory/2416-137-0x0000000009580000-0x0000000009581000-memory.dmp

memory/2416-136-0x00000000095D0000-0x00000000095D1000-memory.dmp

memory/2416-138-0x00000000095B0000-0x00000000095B1000-memory.dmp

memory/2416-139-0x00000000096D0000-0x00000000096D1000-memory.dmp

memory/2416-140-0x00000000096C0000-0x00000000096C1000-memory.dmp

memory/2416-141-0x0000000009680000-0x0000000009681000-memory.dmp

memory/2416-142-0x0000000009640000-0x0000000009641000-memory.dmp

memory/2416-143-0x00000000096F0000-0x00000000096F1000-memory.dmp

memory/2416-145-0x0000000009660000-0x0000000009661000-memory.dmp

memory/2416-144-0x0000000009670000-0x0000000009671000-memory.dmp

memory/2416-146-0x0000000009630000-0x0000000009631000-memory.dmp

memory/2416-147-0x0000000009710000-0x0000000009711000-memory.dmp

memory/2416-148-0x0000000009700000-0x0000000009701000-memory.dmp

memory/2416-149-0x0000000008F90000-0x0000000008F91000-memory.dmp

memory/2416-150-0x0000000008FA0000-0x0000000008FA1000-memory.dmp

memory/2416-151-0x0000000008FC0000-0x0000000008FC1000-memory.dmp

memory/2416-153-0x00000000094A0000-0x00000000094A1000-memory.dmp

memory/2416-152-0x00000000095E0000-0x00000000095E1000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-01-24 04:51

Reported

2022-01-24 05:17

Platform

win10-en-20211208

Max time kernel

189s

Max time network

180s

Command Line

"C:\Users\Admin\AppData\Local\Temp\65041a83c88ba90e489de8ac275688815c51b93ae568c627b74fc160d2db6bab.exe"

Signatures

StrongPity

stealer spyware strongpity

StrongPity Spyware

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Opera\sivsnui.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Opera\srvolpsm.exe	N/A
N/A	N/A	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe	N/A

Checks BIOS information in registry

Description	Indicator	Process	Target
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe	N/A

Identifies Wine through registry keys

evasion

Description	Indicator	Process	Target
Key opened	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Wine	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run	C:\Users\Admin\AppData\Local\Temp\65041a83c88ba90e489de8ac275688815c51b93ae568c627b74fc160d2db6bab.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\OperaSyncService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Opera\\sivsnui.exe"	C:\Users\Admin\AppData\Local\Temp\65041a83c88ba90e489de8ac275688815c51b93ae568c627b74fc160d2db6bab.exe	N/A

Legitimate hosting services abused for malware hosting/C2

Suspicious use of NtSetInformationThreadHideFromDebugger

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe	N/A

Drops file in Program Files directory

Description	Indicator	Process	Target
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows64\driver\System64Folder\DriverStore\FileRepository\oemwin2k.inf_amd64_5a1fec2fbbccefcc\tap0901.cat	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\vpnpro.ITA.lng	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN64\bin\libpkcs11-helper-1.dll	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows\bin\addtap.bat	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN64\bin\libeay32.dll	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows\bin\deltapall.bat	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows64\bin\addtap.bat	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\memmgrset.dll	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\unins000.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\openvpn.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows64\driver\OemWin2k.inf	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\vpnpro.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\vpnpro.RUS.lng	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN64\bin\openvpn-gui.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\liblzo2-2.dll	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\vpn850936802.ovpn	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN64\bin\openvpnserv.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows64\bin\deltapall.bat	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\vpnpro.FIN.lng	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\vpnpro.ntv.lng	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\vpnpro.ROM.lng	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\superb.ovpn	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN64\bin\liblzo2-2.dll	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows\driver\OemVista.inf	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\innoupd.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\stop_all.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\libeay32.dll	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN64\bin\openvpn.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN64\bin\ssleay32.dll	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows\driver\OemWin2k.inf	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows64\bin\devcon.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\countries.tsv	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\openssl.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\openvpn-gui.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows64\driver\tap0901.sys	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows64\driver\System64Folder\DriverStore\FileRepository\oemwin2k.inf_amd64_5a1fec2fbbccefcc\oemwin2k.PNF	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\openvpnserv.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\ssleay32.dll	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows64\driver\tap0901.cat	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\libpkcs11-helper-1.dll	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\test.ovpn	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN64\bin\openssl.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows\bin\devcon.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows\bin\tapinstall.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\unins000.dat	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\vpnpro.PTB.lng	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\japonia.ovpn	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows64\driver\System64Folder\DriverStore\FileRepository\oemwin2k.inf_amd64_5a1fec2fbbccefcc\tap0901.sys	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows\driver\tap0901.cat	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows\driver\tap0901.sys	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A
File created	C:\Program Files (x86)\Innovative Solutions\Intervpn\TAP-Windows64\driver\System64Folder\DriverStore\FileRepository\oemwin2k.inf_amd64_5a1fec2fbbccefcc\oemwin2k.inf	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\INF\oem59.PNF	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe	N/A
N/A	N/A	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4076 wrote to memory of 3264	N/A	C:\Users\Admin\AppData\Local\Temp\65041a83c88ba90e489de8ac275688815c51b93ae568c627b74fc160d2db6bab.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe
PID 4076 wrote to memory of 3264	N/A	C:\Users\Admin\AppData\Local\Temp\65041a83c88ba90e489de8ac275688815c51b93ae568c627b74fc160d2db6bab.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe
PID 4076 wrote to memory of 3264	N/A	C:\Users\Admin\AppData\Local\Temp\65041a83c88ba90e489de8ac275688815c51b93ae568c627b74fc160d2db6bab.exe	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe
PID 4076 wrote to memory of 964	N/A	C:\Users\Admin\AppData\Local\Temp\65041a83c88ba90e489de8ac275688815c51b93ae568c627b74fc160d2db6bab.exe	C:\Users\Admin\AppData\Local\Temp\Opera\sivsnui.exe
PID 4076 wrote to memory of 964	N/A	C:\Users\Admin\AppData\Local\Temp\65041a83c88ba90e489de8ac275688815c51b93ae568c627b74fc160d2db6bab.exe	C:\Users\Admin\AppData\Local\Temp\Opera\sivsnui.exe
PID 4076 wrote to memory of 964	N/A	C:\Users\Admin\AppData\Local\Temp\65041a83c88ba90e489de8ac275688815c51b93ae568c627b74fc160d2db6bab.exe	C:\Users\Admin\AppData\Local\Temp\Opera\sivsnui.exe
PID 964 wrote to memory of 880	N/A	C:\Users\Admin\AppData\Local\Temp\Opera\sivsnui.exe	C:\Users\Admin\AppData\Local\Temp\Opera\srvolpsm.exe
PID 964 wrote to memory of 880	N/A	C:\Users\Admin\AppData\Local\Temp\Opera\sivsnui.exe	C:\Users\Admin\AppData\Local\Temp\Opera\srvolpsm.exe
PID 964 wrote to memory of 880	N/A	C:\Users\Admin\AppData\Local\Temp\Opera\sivsnui.exe	C:\Users\Admin\AppData\Local\Temp\Opera\srvolpsm.exe
PID 3264 wrote to memory of 3588	N/A	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe
PID 3264 wrote to memory of 3588	N/A	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe
PID 3264 wrote to memory of 3588	N/A	C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe	C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe

Processes

C:\Users\Admin\AppData\Local\Temp\65041a83c88ba90e489de8ac275688815c51b93ae568c627b74fc160d2db6bab.exe

"C:\Users\Admin\AppData\Local\Temp\65041a83c88ba90e489de8ac275688815c51b93ae568c627b74fc160d2db6bab.exe"

C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe

"C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe"

C:\Users\Admin\AppData\Local\Temp\Opera\sivsnui.exe

"C:\Users\Admin\AppData\Local\Temp\Opera\sivsnui.exe"

C:\Users\Admin\AppData\Local\Temp\Opera\srvolpsm.exe

"C:\Users\Admin\AppData\Local\Temp\Opera\srvolpsm.exe"

C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe

"C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe"

Network

Country	Destination	Domain	Proto
IE	52.109.76.30:443		tcp
US	72.21.91.29:80		tcp
US	8.8.8.8:53	mailtransfersagents.com	udp
US	8.8.8.8:53	iplogger.org	udp
US	8.8.8.8:53	mailtransfersagents.com	udp
US	8.8.8.8:53	mailtransfersagents.com	udp
US	8.8.8.8:53	mailtransfersagents.com	udp
US	8.8.8.8:53	mailtransfersagents.com	udp
US	8.8.8.8:53	mailtransfersagents.com	udp
BE	8.238.110.126:80		tcp
US	8.8.8.8:53	mailtransfersagents.com	udp
US	8.8.8.8:53	mailtransfersagents.com	udp
US	8.8.8.8:53	mailtransfersagents.com	udp
US	8.8.8.8:53	mailtransfersagents.com	udp
US	8.8.8.8:53		udp
N/A	52.109.88.44:443		tcp

Files

C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe

MD5	a4f59f6aabf8ff8453ff6993d88e807a
SHA1	745f0f43bc760c1f7e6cbf599bc3a4348a448de2
SHA256	0c0c7dd2fd712e94489d98e9e2bd8d72af39c9e8d5c505abe2972e88733a80bc
SHA512	f92c29e6e89dbbb8a04f823c365ea512b5c643cf847a363ddc2288bd5d92ae8f633277f21f6747f626d58ef05c0657464e32fdfb05f16433c399c9c20eb0b688

C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe

MD5	a4f59f6aabf8ff8453ff6993d88e807a
SHA1	745f0f43bc760c1f7e6cbf599bc3a4348a448de2
SHA256	0c0c7dd2fd712e94489d98e9e2bd8d72af39c9e8d5c505abe2972e88733a80bc
SHA512	f92c29e6e89dbbb8a04f823c365ea512b5c643cf847a363ddc2288bd5d92ae8f633277f21f6747f626d58ef05c0657464e32fdfb05f16433c399c9c20eb0b688

C:\Users\Admin\AppData\Local\Temp\Opera\sivsnui.exe

MD5	52a895199380705c514dd0a23ba52414
SHA1	daa7130a286d82b1bd054261514397954ca62e78
SHA256	a1ce1b78cc1a9d6092b086f2d0796cde519033ec0935d9cecdea86b6cda87882
SHA512	212980beeae31963e7922a2436931737aa2e609de384e78f37fae0569782b52c6c261bf54265dbc9d3703ffa14410943a409c0ef294b40c19e1a87e8e0a14b58

C:\Users\Admin\AppData\Local\Temp\Opera\sivsnui.exe

MD5	52a895199380705c514dd0a23ba52414
SHA1	daa7130a286d82b1bd054261514397954ca62e78
SHA256	a1ce1b78cc1a9d6092b086f2d0796cde519033ec0935d9cecdea86b6cda87882
SHA512	212980beeae31963e7922a2436931737aa2e609de384e78f37fae0569782b52c6c261bf54265dbc9d3703ffa14410943a409c0ef294b40c19e1a87e8e0a14b58

C:\Users\Admin\AppData\Local\Temp\Opera\srvolpsm.exe

MD5	10a222ed3c202e3d5ac83438a1b35054
SHA1	a96dc73215be43577b6184f4d20e45123d5801cf
SHA256	849aecfb2f29dd383cd69cf0c5731f94157ca25305f6b0e6d52a3be27d4331c2
SHA512	63ad6432c23250d5d2ddef8809e3f465d09bfc8c02cf7ad012e5c0209d6234b2a7ac99f6a4136b4b00a86da93e86cba1c31c6f77687f308fd71936e8975f646c

C:\Users\Admin\AppData\Local\Temp\Opera\srvolpsm.exe

MD5	10a222ed3c202e3d5ac83438a1b35054
SHA1	a96dc73215be43577b6184f4d20e45123d5801cf
SHA256	849aecfb2f29dd383cd69cf0c5731f94157ca25305f6b0e6d52a3be27d4331c2
SHA512	63ad6432c23250d5d2ddef8809e3f465d09bfc8c02cf7ad012e5c0209d6234b2a7ac99f6a4136b4b00a86da93e86cba1c31c6f77687f308fd71936e8975f646c

\Users\Admin\AppData\Local\Temp\nsa287F.tmp\UAC.dll

MD5	adb29e6b186daa765dc750128649b63d
SHA1	160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA256	2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
SHA512	b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe

MD5	1e3c7d4a228c5461d6b1bb0bf211e93c
SHA1	73b9ca33b15a63383a61d4c48c0e6b3446cd79be
SHA256	de7ff68cb42f166f5e50da8ba4fd762af765af68db9d03cae6be6d0847281af6
SHA512	2be191581688dd73e585388c6eda5f29eb32ee464f7e666b01f4eb9779b8429ab6ba8d2f8a3fa79cdda317f0b1dbcea5a5f73e627f692d998f475498fd6b2494

memory/3588-123-0x0000000077CF0000-0x0000000077E7E000-memory.dmp

memory/3588-125-0x000000000A1C0000-0x000000000A1C1000-memory.dmp

memory/3588-124-0x000000000A220000-0x000000000A221000-memory.dmp

memory/3588-127-0x000000000A200000-0x000000000A201000-memory.dmp

memory/3588-126-0x000000000A250000-0x000000000A251000-memory.dmp

memory/3588-129-0x000000000A1F0000-0x000000000A1F1000-memory.dmp

memory/3588-128-0x000000000A230000-0x000000000A231000-memory.dmp

memory/3588-130-0x000000000A210000-0x000000000A211000-memory.dmp

memory/3588-131-0x000000000A390000-0x000000000A391000-memory.dmp

memory/3588-133-0x000000000A240000-0x000000000A241000-memory.dmp

memory/3588-132-0x0000000000400000-0x0000000000912000-memory.dmp

memory/3588-134-0x000000000A1D0000-0x000000000A1D1000-memory.dmp

memory/3588-135-0x000000000A3B0000-0x000000000A3B1000-memory.dmp

memory/3588-136-0x000000000A4A0000-0x000000000A4A1000-memory.dmp

memory/3588-137-0x000000000A360000-0x000000000A361000-memory.dmp

memory/3588-138-0x000000000A2F0000-0x000000000A2F1000-memory.dmp

memory/3588-139-0x000000000A340000-0x000000000A341000-memory.dmp

memory/3588-140-0x000000000A4D0000-0x000000000A4D1000-memory.dmp

memory/3588-141-0x000000000A4C0000-0x000000000A4C1000-memory.dmp

memory/3588-142-0x000000000A450000-0x000000000A451000-memory.dmp

memory/3588-143-0x000000000A3E0000-0x000000000A3E1000-memory.dmp

memory/3588-144-0x000000000A4F0000-0x000000000A4F1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061746088_0.sft

MD5	77ebfd13b5ef5293f75a28b6b2ff27e1
SHA1	b4193e6ea6d9b68a4d050204bdee9adce4a844fe
SHA256	2ea3ecda8bb56cd2b54400d256baf6e648f8b7bc10e6f982c71f89914ce54c30
SHA512	a5a51cf3417e651bcabdc51ecd25a722fae74ce1c859a4b6eaa193eca7d6ef0e0a75303ec5986aefd8976fa00c36c015e6b6d9e9c1c8d7e58f6807fee53b02ab

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061746088_1.sft

MD5	7788caeaf159ba5b2175c8d76f5a7684
SHA1	fd8a732216dad6ec27608cf03d4163c17ed10c53
SHA256	44ef263a629e0cc57501e90fdaebfad857025632cb5c9c573122df5655815718
SHA512	132d356e2ee0c4f3cd6108a6d0063d5084c91a36c81490e9f7bb1da463613a395f3f2dea0b13595bcbd032b7fe1000d99e53356c983afaac6ecdef06e1555df7

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061746088_2.sft

MD5	7c9f6bf097d37205ede39af712619080
SHA1	ecf78d714608d757a1bb477e56329884ab54249d
SHA256	554c051430ff6bdded1e766e8ee2c189a16ff4842bf706cc005b9e9d0524ab75
SHA512	39f51a8069277b41763d972aa6ea92c7ee05082b3e313cbb282efd240ca8003c8376acd9e5cda4bcdb8805d74615f4ce8d0106501ad3f848940c0b64e0809fef

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061746088_3.sft

MD5	5a2688c977541a7e91da6624e429b5dd
SHA1	7139d95ce22ae785fad3b11d624a6389cba9bded
SHA256	8b1202efffbfec8217991e9e7b289bf61cad668137117b31423a3e95ea31437c
SHA512	4a2e8e9721bd5b422f8ef712f3553201dd677a989eebf4de95523effd3a4b55bda03728a47f2802fd655920c4766627d3d5b50ec1b57bea601225ad16781da99

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061746088_4.sft

MD5	9d8039a60d0fbadf65047084276e624a
SHA1	09a897f4429ea3dba6847d2d8cc7b169271b4471
SHA256	ceb9ecbcdc872967682c7d7c8f7b2f442d6165e7165f7e0282729b9f493e6f80
SHA512	2940bb15d371f66fce9f75616c54824c31c63307384203642818b4387a5cbeb23873ece5128eeb0e7b517f751a2783e415128f1da46faa54d887d43dd2d60b30

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061746088_5.sft

MD5	86aebff3d524495f797f8c07034b8a12
SHA1	a5df9de12108619e82a87969797204f98dd8723a
SHA256	c861b3bf8fef2c005456459869f3f278603a77160d4be983530d75d9db7fb836
SHA512	529939b7d910edafdbdbf64906cd80ba7ffabfa640fa2b2bd9577598f13e305d0c1408738c98d74c8e1c4ae510fff07368dd3f57adbfdaeb26043eecf2df77f9

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061747135_1.sft

MD5	e285ef9720aeec89a5f5e34a585b41fd
SHA1	17e11cffe803f8154550dd446ea13ccee4287b52
SHA256	6e524719e79a80c802bf27b9d6f64f2c6c5f5c89355d9d853a792d9220295e1e
SHA512	0165f1e3a8336b1998b37348aeb73cb7d422209d1fb7d221e28cb3c2fc6cd899a54b36547359f87a4d7a861ac542adaf88183df99e479b030b2a1d4b046d4ac2

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061747135_0.sft

MD5	0e125ba7328ee5a57c0b4c4f7b983f87
SHA1	28f62f5d4e236a9178b3c77f6b8cb9b0aae7a85d
SHA256	e406add30566995cdafe3ec8e5c4fb194a3ff62bdee6faab829a4788b5b6eee3
SHA512	07eacfc32c8086c0d22d1b060d0ebe377927dd410cb898cfd24df95f3cea6d71d0dd605b0f20c9d1a097367f70304cc3e4a53ddb01389eb077846736c6a7f48b

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061747135_2.sft

MD5	7ab6bf3cc7373ac2a30d994755288a01
SHA1	96fa0a7abe7847a6f402ba8f99b65d9284cb085a
SHA256	4eb84b20d92751b5d04a915c380d2739e0c1272c2c143742ed7cc541548f14d4
SHA512	c5408914daa63ccae6264fe30a174ce5050732f25efd7ee5d9070b32495486ef731fed63243e70c6b463f449a24c1a4da3087985d9c39ca453205a5d5ca6d2f3

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061747354_0.sft

MD5	37f0fb87f79733beebacb8d5964d95ba
SHA1	fb304ba16b55437205f2dc3cd4a77b052923c513
SHA256	294ee6dc47cb85ccdf6efee650a04a90202408c7a717b2f968aeec1e24f78aeb
SHA512	a1f6c22a02fb5a29ee84eb5e46d66864b0c90e302e0ba7dfca8fa8b19007e5cf06dcae619d233fea5dd03f70b338a8d9bbedb70fbe592f9197541d27b862b7c4

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061747385_0.sft

MD5	11f433b2be8208ba7ce657a42ba1b585
SHA1	c16281cebd8b54e9d261a7dee707acb92c1c0495
SHA256	0402a5abf6b6603d4620cd4f8bed5581741d19e2cabac2db5fcae4f5149cf836
SHA512	299f9585d34f4ec7db2d510fdd0fd9e1c94ae6b7bce8b8b14cba664070c2cc2e6bd6122ff2cade6d23326557b25fc12d65b44834f135c438244ddd3592d2b8b2

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061747385_1.sft

MD5	679568d8093d5a15fabfd60f01189d1c
SHA1	40fdc35dafdd8f5114589f6a389cd4ccb6980718
SHA256	5281b2e1b2a04b31e4ada833c8b80a620a257aa733c0eda969c332738700b1e4
SHA512	79a96b4b425d657ec79f02c067209dc5d2a2ff6ed1ada3d84f9b8f42c1e72f8627da4e7bfb5d877968626311b2e00584d986e1d8926c881a4b532e25c6a6dd67

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061747385_2.sft

MD5	5ff8247786c832f87d60a38e9416d4c1
SHA1	4c5198e469d0f2b647a1ee8d74950874c3f01212
SHA256	4666895fed31237a2bbd91aa68245dc8c5482ffd8731090a67627e8df562fbe6
SHA512	6d7f9d0781d20f5c03ada1a8df1618d485b1ca56ff86c76f68f8596b89d93441289cc0e599549b6c15874465107e17ef9c626c677ab8c1615a183080068e5815

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061747385_3.sft

MD5	ba85e468586b61725938746311a99265
SHA1	22b45ee5dfeac114ef71b93dc7a3fd3088f7aa20
SHA256	ff15b48ac6d3d4a640292095194b09c7732a05e0009d1fce39421b9413a66a3b
SHA512	b3714edf25f31d60f30f0ea587da789c0817936d6209e57343dbdfce0dc0fdc32e4a2b03c136be4a99b958c5cf6bfd18970f567b239c215fe20bb262756cc69e

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061747385_4.sft

MD5	856b9fc60c865daf12493ab6a4534634
SHA1	5688a8007ecaeafcefca18e1966e6d2cee88f04f
SHA256	679c88e03547016d6e0b51833a18099e79ec86fcb0cd8a7dc978ea9ba669dd49
SHA512	302be3a70142f6685e14592a0d4262543e00ac6086b56c2d01781c0e8021791a09b69f5c74238992e45aad0bbe8d629250f514145622b8e57fd2fea8c552dfe8

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061747447_0.sft

MD5	6990382119b394368b8de15c7856e492
SHA1	23c0777efc696e0d7cdc5c1a9fe73ba6d15e5335
SHA256	b552b4372767da415acdc041c20e4eed0f86f098afc7d3d50dca29f6e2dc2a91
SHA512	836d872e634032886f1b0058e2d1d691a5ab330eac1ade1b164d42da0d5a9e861fb9487c6e912665979c2c5e5a6b91b4dfc8ddd45e4531f1a2f8e78e794755e0

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061747510_1.sft

MD5	3288ae85e8d835b2ffa511c8b1b617e8
SHA1	613843fd2b978724cfc75d74dbe5cfae344bdce4
SHA256	93f42e19cc1a3591015634bda99833533b97db926c0a0782b7bffccc5e1fdd9d
SHA512	804d79746806ae3747b33ed9865376bb3a4d5b7ceba7e91e54a59be03a993b38cf9d7a4805333d2ef9b83dc2fca1f9c83b374e032a42874e2d10d92299af4cb1

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061747510_0.sft

MD5	ae8390764ffb9efa01097870d1a0b33f
SHA1	8a0f3a48da08a41862f71dd86f6f411d2abcaa6f
SHA256	aa83532221fb5052ae8d0718456548f70dd7bb8bc06cc77bc290a8b7f5445689
SHA512	6cd1a986b8f8f4d55c692126b60c604ddc7cfe0bcef4e050e6a56b9ce8892a9990d355682a0993affee01eee58a65cf09f0be05d79b3848552a2cfb4d509b864

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061747510_10.sft

MD5	bf371b3696c014f6e58f8194494265d1
SHA1	fab87ac81f989cdebd52546b58dcba5aeea3554b
SHA256	ff8fe6377673cc979f3d8bd674d8ec5583c72f30cfa3ff8f17696a5c0e9630a9
SHA512	83e22448513b4e9d8d9188f7117717a5697f12c790b0f8b30aa0ce12b4903057eb3e39868ef8e3980706280ac88c175ec6beaf63b0742603d5a16a4503eaa0c5

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061747510_2.sft

MD5	27d0a6eb1ff18fd2d5bf28140aa0ad7f
SHA1	4e31fc694d3ea26880c8c8f0d0cb6b0226863264
SHA256	204d24b58253166b421fb0584fbf20c8d6fb39acf9381fff0cb02cbc2f207859
SHA512	65a3111d2acea08ea881e6cb5952df67a8e78121a156a08d85a6015f4372495b46e7b4cf18f1381105ed346699e4e9f03ec36f6be226b770fcc4ebe19da139ed

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061747510_3.sft

MD5	89ec094bce13d60083f7f3f909266bfa
SHA1	0673c4335eed084ce079dfa60c7cefb9fb3b185f
SHA256	6b93a0d2c56b0127a5a1fced4c9e800ab3daabf3ca08d9acf3db1b3753218bc3
SHA512	b41e98d5ef075adb011af0faf1f5eee34d474e6d99022b170ca33118bff4145cf52f4cbe8f85ce81d27d998699c4f80907e35baad06b901917e48c5473d4f584

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061747510_4.sft

MD5	61ebe95cd820680aa6f6cfc708d6d5df
SHA1	60e3e572bd37c87b3876848b9466ad04219d1575
SHA256	6abaa8c02d4cf620a7c6016ad41b625fec0eb0885ce0b416cad614ce1fe9f712
SHA512	cb366e698e1b918dd55d8ae5bc9fc1ba49923b55239de405d36460d7cf6d145e1ae0c2eaef7449683bf73918a74ee2cf2004f7043fee2ecc15d82e7a808595b4

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061747510_5.sft

MD5	a2d8295870b9e8cd5b5c069ccdcd09f1
SHA1	b844f47196ae1e94d168361d4d8f09c1564eb89d
SHA256	57e3d2ec9eb78bcf35c9a756f43146c436bc4c4773b0d1bec19b855ca55f2ae0
SHA512	6bf5db660e91b44292800f9fa4ab0a9f7726e43d5976e83138406b0db05522cfe62540a30c167a2ed1d31cd94223d7172f082a60d2219a619d0e734449c50165

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061747510_6.sft

MD5	33de0ca4431bedf08540643fbb5a1a0c
SHA1	117d85e2a76bf0a679d6124564be926c697943e0
SHA256	fd5079f14d6e749d13d6915f26440abcca429cd6bebff3641f0012a96fa11b4d
SHA512	9a6a64f621d637ff008a39a572c8041fd4d3fc749c340f25841c19bc2d660e9a12d2211abb1166bf3beb2e4a85fa3641433935c28f47b7a229f02bfb25fd48b1

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061747510_7.sft

MD5	20e7a103f64be71e9c3b7c937ede86e4
SHA1	4053e2ad3a26f7bd55e923caa2f69a4c73cb7d4c
SHA256	4ef6316fbcd56d020a0f8ff8a7062fe28cd83090ae2e7a9d0a56e68add7dd65b
SHA512	0635ad5c4d204fcd904352dd6909e7bdb7ef34394c864765345df7975a79692392fb176db33a4ea0e27327f5942830630aacd92f001092ac1b913d00f05eb00c

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061747510_8.sft

MD5	90f731f27054ca0b96099ea9e223cee9
SHA1	2f4c4d4b282d943780a24605f5b941ed3a285618
SHA256	4006927f30f01a3258e906971b0543640c8731db09f06091159146d2c5130805
SHA512	084c37593d18f283600b5cf978fed00d92dced291f6d4846c928b93ab00906df76fa6c85d5be06a3efb4c3797569f636c45746e33cf6dbb50dcd56bba6fe0513

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061747510_9.sft

MD5	cf054191fdaa7b0a4da1810e4c003894
SHA1	15cc6a6a654bf1d94dfc4fba43ca02789514136e
SHA256	0a7471f3e7935e7edd0913811300f07220fdf0132a0671670eab6fadb21e1757
SHA512	3861baaf896fdba6ed7fb4a030862c40db40e096eb0953f8cae2160fd7a81c1c13e84dc0cf2338b63b84aefb4616e76835587f328e8ef0612e93b97b50051e39

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061747869_0.sft

MD5	49945b0cadc2a7a570f6e2269ac2e118
SHA1	126721c5707d68ce9bb28918828e663aaadf9b52
SHA256	a6c54ee5620f79155d5e34e0a2397c0aafeee2f7d2a2e75509158b20d2a83e0d
SHA512	10465c9bd7388edd0d823505151529bc248879724f1b7ba9af0c90d0b4453789c33d8bcd8095c1d9ec84321ad0dbae2e6b82d142fbc42c15f5f3e020bc6505bc

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061747979_0.sft

MD5	1bb981ab58ab477defdf3dc28b820b44
SHA1	3b6e649fe4cdb35e29ff0348b519fc3c0d2839f9
SHA256	6c7f1df9d39b9fb4f7ef7884fb967bdb78165777f83051426eec34eec6d5b83f
SHA512	2058e2ca35ee2bb4464d097466cd411d625d4eac942a26fe8e802e31d7de66248dda0c42fb7ca3ec9430eb2387751dad6e11866006c6e28b45b8659a2112ab88

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061748026_0.sft

MD5	cf4b9bad4c374bc61bf6d475e6575623
SHA1	8469dbc7a33d820f8d21fc8b1b4e1bf70acd8b7a
SHA256	72a3a48be146746b8f5907c153c0ac47f9ad9592201fdbfedbb8ae71460d67df
SHA512	f7b0a6b935cf8153f73b9ecfc30f4818cf87fd20e45e8b1048322222f650b60383cc05ed686da790430c3043ddad0274fdc046b1b6864af6d1dd934398990967

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061748072_0.sft

MD5	881488db4939c8f42f6746a6a9dc8a15
SHA1	bbe1713aead1f5c4e0d74483effafed9f6df4a05
SHA256	53e3f592cb74dfbaaec7dcc924d8f61785d43ff8f0862a562890842336fd2531
SHA512	b0bd51777d61591220534baf7a6a00b5e6795562bfdad9ae551290d0b56fc45e31434e05ed2d3259296d55a69a1cea20d303b216a6f3c9d7a83cc136d4191349

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061748072_1.sft

MD5	c8297a4c6164fc99e79ce2001c0a8453
SHA1	ca87fe74361b7a9b161f36b3b9b1a251b3796ed4
SHA256	44111f44a7f71da7b24c66e000592b437df09a72f618933e6fc7204a882bd3c6
SHA512	d95710a4b39310b9383d15ee3013883bf69bf9fa982083f0dc04bd8dd1ae21b6b131b36137f1fb91454c3719ad9a0474752a8b0932a26430753887b5d61bdc4c

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061748072_2.sft

MD5	9132ee11f0efdf0ade16180973f353a8
SHA1	3ff9f612adbec432a44d498fec43d14efe68050e
SHA256	8a3bbad7469ef951ffb2fea8fc057fb756409c4bfd25daba4713da0c2eea1e8c
SHA512	962875756ee8d122c44e0e411646627be5eccde44121e368a297ea04e83dda4582b28e7dff534f23f02096d5d36febd5225892302b52673e8afeb8556aa1f140

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061748072_3.sft

MD5	d39bfeed30603d8f12b749f45bc6df13
SHA1	add33a87eb4f727262fb6bbfdb4443c753c4808b
SHA256	6cc25cb7603fa589dbab1cd7604436f74bcc1c821f813ca443bfaf7063aba38e
SHA512	6e8b73fa80991a20fa1a58924b135c1f589d219d2da4e0e8d70aee065afe0c3d4e96e205bf98a8e5328fc0774fde583e85f3134d97da1722571b74a47c4b5ec6

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061748072_4.sft

MD5	270f002fc7856247249b3ec17e667c05
SHA1	b1fd8959349f14b21fc3b9ff76ce2b78c78ad949
SHA256	82e110d6538b0eee722f12bb725a49deed79fae7dcf192dab690fce5a650b750
SHA512	fea270a0b3b04042ac9b2c87faee47d7d86773fdf0bdd4f790b4355cf7d907bd584ff9b964e09c51df6283c62f249b88ff7402ab0656d0b15b46793f91e443e2

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061748072_5.sft

MD5	349f2dcdcba4298126cab01cbdf5b530
SHA1	d06b85d87bf984657789cab6c046bd47a859f504
SHA256	175690293a5837d983af69a1085a2492f1d150f3eae730bf2a7c1bd662ee5889
SHA512	a7ba9bd6097365f113b0ca5cdd7133f8c6182bbf018d9537fe533ebf3dcafe6d38f795e1fc163346dafb52dcf344fd4356345a565cfb967e64ad61a2ae45dbb3

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061748072_6.sft

MD5	b6d291f7368aea194671d0383589255f
SHA1	1e09e2e480770c7d7abec9161487a4772e638613
SHA256	0bf330be4ff54225389c0aebc01765767526de95393d7d1d3a32b54379e31589
SHA512	5813f3069ed0401cc7a68a5dd33a1106e308545001619ca983f23f6edabb7ceb6c9274af4918633431a8a2873810ee8f2a7609027de4f8a8d94b3bdf6aea3c0b

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061748119_0.sft

MD5	999feb59bc66374667cfe856f355edfc
SHA1	ea8aa21338e0b3425cd08c0125841993076e4807
SHA256	8ffbda2e4d864a7c8903b9286c1cfda0eb4a363b3ad327af58c83fbf96f562a5
SHA512	fd1f713112348058d67c1b7aeb74b5df398643ceab1f918f986f8f6712ac7f17bfdaeaa9a8c054da71c1c62ff72464f8efc7e3432cc1b65914351e5d7ae02763

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061748119_1.sft

MD5	ffc7390052cc0aef36c54d72d92e6de4
SHA1	830256c197e71276d12ff445b1d2fd2096a2a100
SHA256	9d856a7678ea44445539a4e7fe374d5461573a564e04b8e65c96a15938f8e9ce
SHA512	fd9c8aa5a1a1773b8d7f238f0ff35f16776b8a26c0709ae41f940259ca95e3141e105c3b844067add60c8beab529bd07f64f1e48d08e57a9187f07f9099e9247

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061748119_2.sft

MD5	249b5c1c7692243a48803c938731c907
SHA1	26d7899ef55f1257c55d7d8122449b57c50e281b
SHA256	d27c07b0bf43651b9600262de00bc8cb27cdf4591f587d80e9c4773318de992c
SHA512	11a4d4a329148b24cd07cf997fe4172d0823e6a72867127267495844abcdb9d7b9e99dd983328a1848b68cb55873b04ba78067d95cf63b799a85da720b999e4b

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061748119_3.sft

MD5	1c0b208993e3307091e2baae70be7565
SHA1	420e7f2e70071159367a08fbf1526432b9480b04
SHA256	ae2eb1ad310f03cd3ae0bb210f6a7b3ecbb756f35fadba1320ec3d22a6f87ca2
SHA512	32ca781d90c4dd3325def6318b09f8ac87a1ab76a253aa1fcdc1943e080d64c20f2f05af87e88c81759e80d5ffeab5098059516f460de85bf08ee27732d7fbbe

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061748119_4.sft

MD5	841a166df62adaf9217cd90a3bbb1175
SHA1	bc0c5318342c2cdbe27338839ecf49514309e808
SHA256	426550caae9f7ccd9dba3bd74bb88116f1a6a9a112463d93876d1f576509e10d
SHA512	acc8c3fff31d1be2953daf43ec948704929466d11e69b8ebda962922b31522199c5bef90f8c472cc386ec3ceca37aeaa7e8847a697738be9fd4655a88c75f6b4

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061748119_5.sft

MD5	46f64fc169c79cd25ffe37c391aec1ca
SHA1	8fd1d69dd9d9ffd61e997f167782b63b7e6a6bac
SHA256	bc0b51722ba5f58fec1fa220d16c4e35c43d3ebbd654e53917484be64205f56c
SHA512	0afa1dae431ba6ee6f33f68e858a5f339c03e884a3e3f6c2a1cdbdc9fcf95ec3d2ee41d7d48f9a33f5e4e7dfc01a960fb23061343a76e75b17fc6955b1a4a612

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061748119_6.sft

MD5	922e43ed31bff5af1e127486f46b473c
SHA1	1a5ae318896008f2ab7971cc558e6c2cf9d9bd3e
SHA256	0df7d1495e40f12ca65a1402379e8b2f8cbd6ecba581357dbfb354ed0e44d1b7
SHA512	5a0afa2a591ae1d754f6458bad81a93533dc2c324224669aa89ad1cf7f49021fe0a09aabdc4259a66ddec69b0a3b213f7f66fb5e2335aa7885071d3ae0f7aebd

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061748119_7.sft

MD5	9f0a421747a36f2f91a1f718a969ba73
SHA1	272e2f99e8323372a759c71001bb7341bc4658e5
SHA256	0a6735bc871c3fbf41a852033f9b4c02c9160022070b5ff6afcc2715e4a8face
SHA512	26de8a436b768c2c4e79e646595660bb28f4d1de6aaf862a05d6afb66016d069ca6d6d988102ee1dff8cf6bbadbf6e4edd7cec453f13ae6760a1cc547b9174fb

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061748229_1.sft

MD5	86425a0c1a9b6b87f3ec2188867bbb2b
SHA1	9c84a3798d34c8a026f946a6466557892fc4dadf
SHA256	7b9c74f0f926963e192b8e5e441d1f72da87a5e0dc6bce480cdfc8b860b141a2
SHA512	0a4eb045b2e0fe19c6152b674484cd7886176b93410112c619c08055ddb5d0ced3c8f75056495e48799eb75bef25be8d23faba9c5262be8e8bb9d79020564b6d

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061748229_3.sft

MD5	53f057a22074754574ecd98d6bb68148
SHA1	bb9c8b14da2a18dcf6bbadb3969dfc21d6b7bdbc
SHA256	59c880903558d63697c432756a5b1f1aef836bbb082b09cccd2010d02c04f241
SHA512	2f6cd958bc8c0978f2771314217939dd630b9d2e8aeae7b608ad559dabf317dd7a450091726b59dfb8657eeb8995709216e2be229354c938c99bca691efbb9c2

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061748244_0.sft

MD5	dacbeb140c6519fd048823bc602e08a0
SHA1	e5a982d79865d14210386f294fba0fdba5d345d2
SHA256	849ca57df0626b863e4167acb04259e04a6672a909fa1cb21b05055aa762cecd
SHA512	67c3d654d64ab57af8ff88276594f7ca742aa65b05a5e5761f099b3d5ddcef74a16de49f4c1e96a3bceab42170f615f6ea23cc79525b40594334dc2908327f31

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061748244_2.sft

MD5	451cc0e376b0c19bb52c841c31410533
SHA1	f01ad43d5fbf0a0227ff6aba9c91b39b8ff1df3d
SHA256	1a71c6245cf0257f26fa064f57c7c715781ae625209ea113d3e4f9692f7304a6
SHA512	3c19b82265f69de8ec1b4e6d6068379f6859caad59f8c02777a0ccb42889d1f4b6a7f241f449322135f90a475a768c46c86d4a9b0207ea2c31d58e21bd719c82

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061748666_0.sft

MD5	bd6612461430fdb75070ad758df004c4
SHA1	044f59fc5f1718d1ebe5f397179c6bdf97c9f4c9
SHA256	06c5e8f021d4a9bb5f3a9a3a0a5b1ed05501f11c5eb10fcc457b627fadbf6f9e
SHA512	25efb3d730287be7592c19894734432583ac95933775cd5b171230815630af5e3eead4a2ad30573952c52bd8a7f5a43c82f0236f29d39a4330e317c885cbe328

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061748244_1.sft

MD5	a48e1d1cfe9770902ad7d5162d367c8a
SHA1	5c65ef3789405f59d4963fefbb28612f8e5b6c97
SHA256	178a95b635ff7f89031ec5e18b7855eec0ec7a4f131979d1dba311a5c710f5ca
SHA512	8c4ff69a13c043583396e241a3bf69554f59004b663fcf9e97c3d2c9a831198247d2efe546d792a9dbb9bc40feafdcd73772bdbb34ee5aec658644c57dff624b

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061748229_5.sft

MD5	a0c007b96d564877b88ce7a79cc18f6a
SHA1	7ec4595fe131d5df588b43107d0f79c0124bc470
SHA256	299823e99d25dc05f88228e8ca5ff2de16ea8468bcba323813922aa45a706ef4
SHA512	0e58fe2e0d072ec9547fda3a85ee63184870de70b68a1725b7e8bebf6b85152a7cc205d4cb84a5885f8a41e42cb51494184c059ae30b9f4d721ea900626e7de2

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061748229_4.sft

MD5	3fbaafce8b921af1f3ea0040f91057d5
SHA1	52d91939d8d25e422e5dc7f7ea2863fbf93f4c8e
SHA256	79c2311a30897087b2d808429d33b2645036b7193b75bafa4c2664f112a529ae
SHA512	493081875b9054e84bbd4aa9f93d890fecb8b68314b3b1aa53c281f82521b489df8d451aafe576ac1fdec828aca4496ae7a158eeceef2685362177c629eced93

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061748229_2.sft

MD5	66d74d229cf07d5278ac94a209167863
SHA1	ea07353adb6e3c5fde8e9d5d4b7ed13a0e72042f
SHA256	8b45ebdb9c0be53b867e5ea6afad5b0ea3767a260129dd07d0547bd824e87a93
SHA512	862ee4c86714830f0e350a271fedb6779d2b11ed3d2bbd83f5f46969b5e15e5c6f5a46c7e8d76086866fea850bd89d1442f8399e6e9932e7339f4bebf35529fb

C:\Users\Admin\AppData\Local\Temp\Opera\guid_app0_3116772670_1212061748229_0.sft

MD5	27f2b24b066c2ae2c17eb03867ebc18f
SHA1	2eb51beb4a923ed8151314efa111de94b21de7b7
SHA256	cd686171d695231285860183260ec02bd921d2d76a3f22d85e1b6cd36664dd7d
SHA512	2db28e3f5d94b0d4b40d34685ac85b4f90b90a37539a3e2b90a4ad679b57a3e9626f3ec15ca9fc0da6101ff12a13088b0a78b303428a344a4302fd0c6ffb0380

Sample ID	220124-fg6vqaccgk
Target	65041a83c88ba90e489de8ac275688815c51b93ae568c627b74fc160d2db6bab
SHA256	65041a83c88ba90e489de8ac275688815c51b93ae568c627b74fc160d2db6bab
Tags	strongpity evasion persistence spyware stealer suricata

Malware Analysis Report

2024-09-11 02:37

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files