Analysis
-
max time kernel
194s -
max time network
220s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
21/11/2022, 19:04
Behavioral task
behavioral1
Sample
ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe
Resource
win7-20221111-en
General
-
Target
ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe
-
Size
14.1MB
-
MD5
b296b125e38d267c16352c34bda84241
-
SHA1
3828e51e8ca4b695fe0d2da0afad96b83c7987ba
-
SHA256
ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed
-
SHA512
26115ff0bb42ad52047fc81034b6516791967e4c2b10d72b792b6617893181d655d0d36ea898418cc6385c9217ed0998c47f5d14db6472b40992ae6bfd4846b5
-
SSDEEP
393216:hNoMWBm87i6PT00odV3iKmgmGKyBcOcfeBq73D5bw:nozH7i6ZcV3hmgXKyBc/mo73Dlw
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 7 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000500000001a41a-58.dat acprotect behavioral1/files/0x000500000001a41a-59.dat acprotect behavioral1/files/0x000500000001a41a-64.dat acprotect behavioral1/files/0x000500000001a41a-63.dat acprotect behavioral1/files/0x000500000001a418-104.dat acprotect behavioral1/files/0x000500000001a418-106.dat acprotect behavioral1/files/0x000500000001a418-105.dat acprotect -
Executes dropped EXE 1 IoCs
pid Process 560 opera.exe -
resource yara_rule behavioral1/memory/1976-55-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/1976-57-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/files/0x000500000001a41a-58.dat upx behavioral1/files/0x000500000001a41a-59.dat upx behavioral1/files/0x000500000001a41a-64.dat upx behavioral1/files/0x000500000001a41a-63.dat upx behavioral1/memory/560-67-0x0000000072280000-0x000000007337D000-memory.dmp upx behavioral1/files/0x000500000001a418-104.dat upx behavioral1/files/0x000500000001a418-106.dat upx behavioral1/files/0x000500000001a418-105.dat upx behavioral1/memory/560-111-0x0000000072280000-0x000000007337D000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Control Panel\International\Geo\Nation opera.exe -
Loads dropped DLL 6 IoCs
pid Process 1976 ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe 1976 ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe 1976 ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe 560 opera.exe 560 opera.exe 560 opera.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA opera.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Opera\region ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File created C:\Program Files (x86)\Opera\styles\media.css ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File opened for modification C:\Program Files (x86)\Opera\styles\private.css ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File created C:\Program Files (x86)\Opera\program\plugins\flashplayer.xpt ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File created C:\Program Files (x86)\Opera\opera.exe ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File created C:\Program Files (x86)\Opera\profile\cache\sesn\opr0000E.tmp opera.exe File opened for modification C:\Program Files (x86)\Opera\skin\standard_skin.zip ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File opened for modification C:\Program Files (x86)\Opera\styles\user\disablefloats.css ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File created C:\Program Files (x86)\Opera\styles\error.css ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File opened for modification C:\Program Files (x86)\Opera\pubsuffix.xml ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File created C:\Program Files (x86)\Opera\locale\zh-cn\standard_speeddial.ini ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File created C:\Program Files (x86)\Opera\profile\cache\sesn\opr0000D.tmp opera.exe File created C:\Program Files (x86)\Opera\ui\widgets.yml ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File opened for modification C:\Program Files (x86)\Opera\gstreamer\plugins\gstdirectsound.dll ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File opened for modification C:\Program Files (x86)\Opera\gstreamer\plugins ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File opened for modification C:\Program Files (x86)\Opera\styles\images\customize.gif ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File created C:\Program Files (x86)\Opera\styles\search.css ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File opened for modification C:\Program Files (x86)\Opera\styles\user\toc.css ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File created C:\Program Files (x86)\Opera\gstreamer\plugins\gstcoreplugins.dll ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File created C:\Program Files (x86)\Opera\profile\widgets\wuid-019d1403-16d7-4e49-a8f5-a704e9c826e4\cache\activity.opr opera.exe File created C:\Program Files (x86)\Opera\styles\images\red_right.png ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File opened for modification C:\Program Files (x86)\Opera\styles\user\contrastbw.css ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File opened for modification C:\Program Files (x86)\Opera\styles\user\outline.css ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File created C:\Program Files (x86)\Opera\html5_entity_init.dat ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File created C:\Program Files (x86)\Opera\profile\cache\sesn\opr00009.tmp opera.exe File opened for modification C:\Program Files (x86)\Opera\styles\about.css ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File opened for modification C:\Program Files (x86)\Opera\styles\history.css ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File created C:\Program Files (x86)\Opera\styles\mathml.css ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File created C:\Program Files (x86)\Opera\profile\styles\user\disablebreaks.css opera.exe File created C:\Program Files (x86)\Opera\profile\cache\revocation\activity.opr opera.exe File created C:\Program Files (x86)\Opera\profile\cache\sesn\opr00001.tmp opera.exe File opened for modification C:\Program Files (x86)\Opera\profile\cache\sesn\opr0000K.tmp opera.exe File opened for modification C:\Program Files (x86)\Opera\styles\images\red_right.png ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File opened for modification C:\Program Files (x86)\Opera\styles\user\disablebreaks.css ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File created C:\Program Files (x86)\Opera\styles\user\disablefloats.css ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File opened for modification C:\Program Files (x86)\Opera\profile\cache\sesn\opr0000H.tmp opera.exe File created C:\Program Files (x86)\Opera\profile\cache\sesn\opr0000U.tmp opera.exe File opened for modification C:\Program Files (x86)\Opera\styles\images\arrow.png ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File created C:\Program Files (x86)\Opera\defaults\public_domains.dat ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File created C:\Program Files (x86)\Opera\profile\icons\redir.operachina.com.idx opera.exe File opened for modification C:\Program Files (x86)\Opera\region\cn\en\bookmarks.adr ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File opened for modification C:\Program Files (x86)\Opera\locale\zh-cn ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File created C:\Program Files (x86)\Opera\profile\cache\sesn\opr0000Y.tmp opera.exe File opened for modification C:\Program Files (x86)\Opera\styles\message.css ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File opened for modification C:\Program Files (x86)\Opera\profile\operaprefs.ini ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File created C:\Program Files (x86)\Opera\defaults\standard_trusted_repositories.ini ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File opened for modification C:\Program Files (x86)\Opera\defaults\handlers-ignore.ini ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File opened for modification C:\Program Files (x86)\Opera\profile\widgets\wuid-019d1403-16d7-4e49-a8f5-a704e9c826e4\prefs.dat ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File created C:\Program Files (x86)\Opera\profile\cache\sesn\opr0001L.tmp opera.exe File opened for modification C:\Program Files (x86)\Opera\styles\im.css ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File opened for modification C:\Program Files (x86)\Opera\lngcode.txt ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File opened for modification C:\Program Files (x86)\Opera\profile\opr8D3B.tmp opera.exe File opened for modification C:\Program Files (x86)\Opera\styles\user\contrastwb.css ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File created C:\Program Files (x86)\Opera\profile\opssl6.dat opera.exe File created C:\Program Files (x86)\Opera\profile\cache\sesn\opr0001A.tmp opera.exe File opened for modification C:\Program Files (x86)\Opera\program\plugins\NPSWF32.dll ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File opened for modification C:\Program Files (x86)\Opera\profile\sessions\oprDED6.tmp opera.exe File opened for modification C:\Program Files (x86)\Opera\profile\cache\sesn\opr0000S.tmp opera.exe File created C:\Program Files (x86)\Opera\styles\images\customize.gif ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File opened for modification C:\Program Files (x86)\Opera\styles\images\root.png ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File opened for modification C:\Program Files (x86)\Opera\html5_entity_init.dat ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File opened for modification C:\Program Files (x86)\Opera\styles\user\structureinline.css ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File created C:\Program Files (x86)\Opera\locale\zh-cn\bookmarks.adr ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe File created C:\Program Files (x86)\Opera\gstreamer\gstreamer.dll ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 560 opera.exe 560 opera.exe 560 opera.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 560 opera.exe 560 opera.exe 560 opera.exe 560 opera.exe 560 opera.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1976 wrote to memory of 560 1976 ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe 28 PID 1976 wrote to memory of 560 1976 ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe 28 PID 1976 wrote to memory of 560 1976 ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe 28 PID 1976 wrote to memory of 560 1976 ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe"C:\Users\Admin\AppData\Local\Temp\ad4dc234d8f66b3e106724e3cdf1c56005537029ff7632b041996f65350c37ed.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Program Files (x86)\Opera\opera.exe"C:\Program Files (x86)\Opera\opera.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:560
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.5MB
MD59665f64ab1ccd81eba281a6a30f57c19
SHA116cc436793578696f5b8106f1e2ada35b42579ec
SHA25656cd59854b23468b52f58b7ebadbd7e9e9d25e00bca77014587e0e2bd6097d93
SHA512f621acfab76b83bd8d81f1111a26849a7736e02997e981a87cc5685d6df4ac72ea18ebdea6f2b8950cbd49bb808c34877164dc6b70651dfd98b8fbcb55b4eec7
-
Filesize
718B
MD596897c2320e0a9a84661bbbf570c1755
SHA1d69c03651420166b9272d771c9392003d8016376
SHA256259fa4d3a21e353c4828415126fd853b1a5c5277892ab861573f883851dab109
SHA512ddc4a586fa745aae1d2482db18b6aa3bc723fe5a59c67c30c74aaf9aa22e3769179f128eecba894f8941256546bb18b33d6b5c848b28b2be64b0dac219a2359d
-
Filesize
1KB
MD59d0787971f5bace1ce91d86d6e451431
SHA1ab9de7f4b3820fe200fe522ac0f1787823c43acc
SHA256bb52f3ddd00d2752d66fcc5a1fa6341f7cbfdb600448b016880a900237c1cb46
SHA512414773d7912f88cde67cf7270b75347fa88a833456e65d0e230645f0e59d49170539ec3b3e5517d6ecce16553a6564883e57f3f2107d193daa8e4f35b830bfec
-
Filesize
98KB
MD50eac0ca005c0bdfcb7259caa0c1fd601
SHA14e8360f1e6052f8c41a2cb08a28f73747208c2d8
SHA256c61afe4c69394e2ce8ab1f8b738617e8a14122fc9d26abb0f8986b9ea19317e1
SHA5121a12ddd9b4bd67c065c1478ce36c06d963f55d2bd8ff56f32f5b359c72d0beb72b8e11dd41fbea349a32f9ff320186105f78b66645efa7a19d6e988d8833e859
-
Filesize
1KB
MD52ce659dfc60d15f14ac7c0feb5ba09ff
SHA196d2641cb35c842167199d195badfa83b02ff758
SHA2561c605635db5daa9449531d94ba45b4dfa84e2404425f523c34dd35fe17e12f00
SHA51255198a921c6abb959f92eddbace3ee92bb465e06d47041dfd2fca8d705aaa90c25d1725437d53881c5d348dd64f035fba7607e1c040e7e51aaa2ba9e9b74fec7
-
Filesize
591B
MD52aaf53192e71457e9669d912886dfb44
SHA18eb6cf03f967ca30bd060be025d4a77dbc391419
SHA256974d1ea2cbc231f2389a144fe3b32e0e25f5072959f0c8993cefdd3e9aca2bff
SHA51266ce8ce52f196d87c782b6d2ba57df0aa15aa4d77e286aeddedc431f988dc9c3bb1327316b69a5401fdb4f45c7846d7fe46ef4247367b4b1e1cdb88f3b4c706e
-
Filesize
513KB
MD5136d9e4fd817aa5def373b1062bffbe6
SHA15d7a0ac4ec9407039c6c19e184e50a7224df1dad
SHA2566208eeccf4a428520869a5a174ef8bd805c0b3a406cde4526c0434a129771941
SHA51299f0d76791ec9c95378a8bf5b537b53a4b029e1c24a835566396ae92b6dce54532a8e370b6a152304b38f20fc670cdaffb54a33d81cbc9df78ba431e1b5a41c8
-
Filesize
17KB
MD5ffcaad9ee34f4f1e999bc2b4fd636ade
SHA1c500c0c49daf07deac067150244eb6d9eb1d59c1
SHA256033214e6cb79339285853704d1fc283d1e753f90cc7cad92c280ae9a10d38e37
SHA512857f49ed41be9e27c6ecda2f75e94dda4c397285c8434a1066fa71a7fdb0a65677dcd8a7b4bf441fff1c46e099352daa9e45ab3d1334cb9a80f6effdd609d4d2
-
Filesize
35KB
MD54cca21dc97bda85b46ea16a0a83a9304
SHA180a6e15925bb55eb5610c22fc4c591003fce9b53
SHA256e2a6e808fb3e6b9d48ba5affc8976d458203dcbe8dc2f3f26f6015cf79b2d9e9
SHA5123d233cc039343594a2a62c3d4042334b8cc4a6100cdbe10474f73367d1f9b6fd5a79633cc1be20def4129528705a352dff8e237df5e90137cc155a7997098432
-
Filesize
3KB
MD5213a5b2a126d18b004817da57968d6e1
SHA11f68f59433edcd95f6bece94ff90dd7c1117bc4d
SHA2569959674a77a1ef7f955af5a92201ae1901ae6ace7455971eeac3b66900527063
SHA512d1964d1c2de599e2003997ae993a2eb306c2e8fc2a08215cec6116d783ec491fb58782ce9ec6ff29d7286a69f3f265f6c0081ec04b4a2580bf2b5b800a3502df
-
Filesize
186B
MD5b2bf595a2fc3c69305110b4c035d9373
SHA101ad920a9a735ddd1d96b80ee182be697f9e63d7
SHA25664f78315d238c597b5b0206443fc00c584c3dacd57cdfab98ebf053200a13fc7
SHA5121579f4587b6c5d27bb02b58c67febd0a6192693820b48a98af5b566169c5fc44992ae011a147a2780c5fdc74e28f9a069112ecd8653ce44fbffd9a34e89055bc
-
Filesize
8KB
MD5860e58bdd240152b0521ebfa38ba3680
SHA1cdbe10df1bed83272e01b3e16558c8e4240a9742
SHA256502f37a7162792844bd6461a2e87490890ef5e37bc0394aea694c3ad3c7f63c3
SHA512281dcf6a2c7911fa6b967d3accef46e84feb1055ff6cb5a7522b2240058fde1ece13a5d52cea9218c4d00419b9dbef6647a4d609177acac99766f5cdd7c1d3f0
-
Filesize
182KB
MD57024e8941bef0f7845ed95d99cf8cf3d
SHA16c09d2a71cdd508ea1afabb2d4743a405a691233
SHA2563d642aa0a8c39bdee9cd591db1b14d161ae42ee0c5cc5c874b72ef316ad5e8b2
SHA51228262dbcd6c7d19587d253282cb15149a68e27f12b79087ecfe5152168c9ce6aa4388e4c4c68a1cad87bf8dc58fb7557976e643b0164987e32867cdbba6b936f
-
Filesize
858KB
MD5c079504521b4e5031b794f5d3a9cc8a2
SHA140d5e76725f1e0f17f58f3a120dd8516c7f548dd
SHA2561e06e3ac46d9ed93c7fff847380760c78b6b20ea05b28333d958ec9a3ef20c1e
SHA5125c03c8e7fe588c161578a2514c65242494127bcb4352403ca2b9309ab44378a0797dd63e542f9054c22e8e2f5a568da6ab40a7a038f0e7fac999d232d5e60c57
-
Filesize
858KB
MD5c079504521b4e5031b794f5d3a9cc8a2
SHA140d5e76725f1e0f17f58f3a120dd8516c7f548dd
SHA2561e06e3ac46d9ed93c7fff847380760c78b6b20ea05b28333d958ec9a3ef20c1e
SHA5125c03c8e7fe588c161578a2514c65242494127bcb4352403ca2b9309ab44378a0797dd63e542f9054c22e8e2f5a568da6ab40a7a038f0e7fac999d232d5e60c57
-
Filesize
298B
MD5838ccae47e78b89548e656513f2a2f3b
SHA14d5d17e7749674028d6f468f9111e7e21a8c18ec
SHA2561613dde7b10b5a84b047aa5539bf271628546e76d62c8db03aec6fb45120ce73
SHA51258643b12ef7ec7978e2942304571a8c41f76a49e03c5c7d5c093e9d153897387fd79372851d5f64a0ba3830def890ef5db302b78f079ea30916dbd7adc73c045
-
Filesize
1KB
MD5dc51c06a7b7c4e2148b073dac09b114f
SHA13206a64f49974982bb5dc542da860a912efaea18
SHA2561577105516b9543d7a38ede50745c814ece2f0907ab92b2a5e9a86398bb6cbb3
SHA512a69f4f1f84c9af88548f7507d03c585c06fce2ba82dae0774aa5058377889d7ecf855800dcc75072b240906e112a7d5ce5f031ca51c4e3f63b2df3586f96629f
-
Filesize
1KB
MD507d5801035ba7b7c3d756c543bd684c1
SHA1fdceb8881492382ec7542dab55b756d1659b1f44
SHA25671ae467915905f364685df7ba771563b8422d970a33ca29f4d8a9847fa171f92
SHA5127488e5d92e2671ca589f44947bb781125abe622fa4a4bc03306f6dc2392f1cee144aa4134b2179764591a1c37d8cb9a5c1568cdc59156d94b6d5530e92232722
-
Filesize
1KB
MD57240348c2b25867dfaa11d070a1067e3
SHA1c6c78e24a620088a5edc72cc08e913f4f297141e
SHA25677de540c677b0a1db095cede247ab3b888e00ad61392516969717baf0d5c07fd
SHA512939602ea1291182fe9799afc2f078fecd2114e2078a70577306650f3312d2b0c809b20848bd11598be3153e28fbcd746ceb3fe81e8ad3e5143286cffb3ff5035
-
Filesize
1KB
MD57240348c2b25867dfaa11d070a1067e3
SHA1c6c78e24a620088a5edc72cc08e913f4f297141e
SHA25677de540c677b0a1db095cede247ab3b888e00ad61392516969717baf0d5c07fd
SHA512939602ea1291182fe9799afc2f078fecd2114e2078a70577306650f3312d2b0c809b20848bd11598be3153e28fbcd746ceb3fe81e8ad3e5143286cffb3ff5035
-
Filesize
1KB
MD5201d4bdddf1a15618d6df26a7169533c
SHA14fd12a25f49a392af64208fcbaa4635d11e9da69
SHA2566eaf72ef41daecf27a2a9b4c7372517bf074e8b6d371e2fb03d30750b2bac9fa
SHA512d9e4be5424f6b41bf151f301067b7555e25b9403ccd85a0c9a976dce9b228186d4ac0c881a83186adf74537cd0ca700cc9402abda697defd4d73556af7539226
-
Filesize
356KB
MD5ae276cd526604f145a9d15fb984c2218
SHA174435241c61bd1d0d3de2c448627da6e13ada41e
SHA256973458943cf26fdbd641f5b99f597b1127104ccf24ed16243b470f5ad2321adf
SHA5120def07d228223e61a125ac32e2357ae40b26740e1295a74b62d004acd7fe800502077502bf7c693a2f4313a68b8c75bbadcb9e0872a63cbd0951969f0b992c0a
-
Filesize
1KB
MD54dc2fb0e4275a4e75e913d2d8769ba72
SHA17190860eda5a541769b54e77c29b023cc25cd173
SHA2569a6a9fb3e87e37e5659946942c3cd866d7ef1e99d373dc826326abc114b7fd85
SHA512f2b1e86d3ced01098136a71ff8945cce20959874726c2501448f36edfdf9346132448bd27e888e3b2eda435c1c0a1a38246eff5004fefb8d35eacfa08ad970bf
-
Filesize
13B
MD5f8f1abb5a51912ef13a3f4e944f5ee01
SHA16325d28ac8886c201eba3ae0a9e406a82ec26cba
SHA2566275ead00a733e30583c20dc9233553407fa8a0fb9b42a9a11008a5dfffa405c
SHA51256d091b0c0af763bcd8f7d7e7e7eafa956c3897f021bc9abe0d2e7b31e1eae3ae4c3c727207621cfb4efcfe615c3fe10be7cf6cb04a899c06091575517a902f6
-
Filesize
483B
MD56410aca3775499bae7f4496f634e4884
SHA1e9eb115c017af40e4773ef178578f538c97a8de8
SHA256a66a94bc544f4776775ccde0e5095e59b64241f553f09ea4335cd3bed6b23429
SHA512416ad295316446276761c6ef3babbb3ce427f8bf7f50ff17a760751e15e5f6315a8bcdec91c8b8e01dafe488e6310620971e88190ba4ba4eb50e79889529edcf
-
C:\Program Files (x86)\Opera\profile\widgets\wuid-019d1403-16d7-4e49-a8f5-a704e9c826e4\pstorage\03\15\00000000
Filesize1.9MB
MD596bf537ac5cf42294c6b8fb42e0c2d7f
SHA1f239462d94dca9d8473d6b523d63f5297611c6a3
SHA25613770502bb4c23993c6bd326499e5102c17c7b955f9b3f23b0a69b002a8cb848
SHA512abcd2332202e34aa74c3b76c439a525f9217436b8615f81bdd781638443c79a1f1942437567646f3dd21567240c950f402ab5931137440b71be0d6162fad078d
-
C:\Program Files (x86)\Opera\profile\widgets\wuid-019d1403-16d7-4e49-a8f5-a704e9c826e4\pstorage\psindex.dat
Filesize396B
MD5d95851a5ae6277857b7099cba1d538c8
SHA10e3daa066fc3cec6d28630c4b94eec9eac58c479
SHA2560eb49c2064984fb8f3b470f07745fa4fece592b748b2b074bca656b215059e2a
SHA512053cabac1a9eff5c24ff5ff27593cf8e0c8577d7eecf211fcdfbcc044b7dcb5a7febe9b03d241ecae18c9d9f59c6d29f9ac9a7b780aa731b8673fe8ea36ee2ac
-
Filesize
3.6MB
MD5e728cc86a0af1e36df2bd6bdf8f5169d
SHA1a09f12b19377c3dc2013932bd28fc70de8826e41
SHA256085888a9ae1e09cef6fcba22f74990151b68e9b88b5b39143f08d05ca7f4a5ec
SHA512b659635cbd8fa09756eadf3a3d829ceea63e0ed76fea2ecad420e55911d940006e327e63f159849815fc79b9801e6219c9d22568c9263914b680530bd5c0a99b
-
Filesize
145KB
MD5f3289d36c962b084100869867224f2d4
SHA1b44afe78c25bd5a20244220a1664de0fa80c90a6
SHA2565693bdeabcf1b666f9dcf256e5646d15d5273b27a323e654ef65a1f0e5825334
SHA512ec11216516519201961cab15285c34994c563e0802ae7942050f7a0b15176762c97b7b88e754d7d0f815d18bb879d09459bd56a4f6af81103f3423c61d0f0308
-
Filesize
107KB
MD5045b3af575dc478c61ef0d1fe1dd7f9b
SHA1de6e55f0810f1cc093b925708d8827e476174490
SHA256bf27f5fd782b6b33298fc66e407b8ca33a79ec8f85f1dfb15a3e0fea6823104a
SHA512e6f168ebfd18b887c602f02141a69e6d347a11d577463094852a72e49e20e769a423d003b28b0b0fb2e6effb1b9d88d8d70f59c6c7413025c88aef23cd35e926
-
Filesize
130B
MD5a120fb9094c6a5a8c3b8fdefc4a77d9c
SHA1dd0f304bdf4df37a8d92ef7d1e187b08da98f11f
SHA2568594a1c349c97092d6df9f78addd8a40f131453722c0dfd08ea6109def399295
SHA51228d5d06c633d761f98f250a5507bd56ba6859e7a95a07bcc14fbfb26a216e6fa90228ad454fac7512f455211c087c9e63ff8859392e521c379a4aacf82d50c9e
-
Filesize
1KB
MD535834d0759ad32bb7f2aa8c9621ed236
SHA11bb22c815ff34e6424cfe2a7c58999a1fbf1cabe
SHA25663060ef60491365f250ac838507fcc5337c1f9e06750f6c1c58de5e17218b5d9
SHA5126836f9503d9ac6eef6c6f820fd7e18aff90150a8a97c2efab4347dd35c1e89e318d170e9ebc031871bf84abf645e617f55a4f29b5dfb0ef28568fd9a6cd4d71e
-
Filesize
1.3MB
MD5ef221b057f38be331ba498a5de14b647
SHA17c9b2ba84d5dab4e2d204bfaef79e60d74ced4cb
SHA25646f0b2cf2af270f43ea443a783e2f7589dbd2d5a23426d251e501381d5ef7f22
SHA512b1d2ac9e7c4f4a6b58bf498d140654127962ef740fe603449d6592014eb9ed7468ff382586de568a3f10e25b35906bf504c726ebf1dc2664c92f4cd4f677056a
-
Filesize
331B
MD54c4b45ee37ad77e34e8390972f687f4e
SHA1ef2151c7db9121f63eb8c916aee57224c4874e2b
SHA256d2e76d633d48d7691486bf3adedf0cee6d9c439c8fa25dab694b2347e10fa57b
SHA5128b48bb22bffff3123bdd91cb27ed2b2221ddb764786821681b8d8dc0b9bb4aaaa192eced9709ead5d58a96cb972070046efc79317ba95424fa7d806d6889befb
-
Filesize
14KB
MD5262fba77f490b6a064ba5660d28a9ad2
SHA14d6c1a1227d7dae9a79e42bb0657008bf133eaee
SHA256b21c3bb9f4c9783d11adcb171d7ee924f88c89a8af46b6773c24df73e8d4bfa5
SHA5123523f178bacf9ebd46b7fff987f6bf4f61a110639f07dd9f14a14576ecdc3a099403123e51585b3daad46d2fba45ca7038825060104da9230178e5c48f6eb06b
-
Filesize
2KB
MD5f63675e362af1465fdb6790c65fd880a
SHA10afffc762eb585bcbc803b8c4fb20c6c7afbdbdc
SHA25689c4f4cfa8b614758be60cbd22680b426cb555a03f8b169814fe5c66899093b1
SHA5124eaeb793a30f196514f434134c40e27ef3af4cf65432bb82cbd3ed8ad5ae4ad941f981aa7d7d8124e632a4ac9ebed9c9cba506f97ee00f2fe7ecb17be50025f9
-
Filesize
1KB
MD512dbec4d282073caf20ce649e7a8fae5
SHA1f948fbe5df38bae46a8a44e5dabfd54bde7b66dc
SHA256e9389d9b31ebb923b146f8977c303b6d8cc462e26b05badc2288b2fc4e96a877
SHA5127e89be5bf70585ae6746951e7b07a26b0cc75ce4a08e14cc151cd405785ff1343e5a28521136877ce77fb058b0acec96e372be64416b45efef2ce19600b89397
-
Filesize
1KB
MD524c288dbc4ea56b8df8352265e92e4fe
SHA15c6141f76a56fe60a421a0bf220022db20cdfbad
SHA2566ea2f66839b98f8a886ed70d012b7b1f69818ecefec4110aec199b481a3f6796
SHA51251f9da0857a1c8b3e08292862ba7fc259916b4e4520af63c440e84124a139ff8df06ef8f1008830854ea407574de9d83a18c021e4b3d3722dd62c415ea05f177
-
Filesize
673B
MD5d03c477790eb58f6cde6cd5c8a52ec0f
SHA12d39dec27d1102dd4914469d4d20ca80e6e710e3
SHA25608f1ddac33898024f71eb030ea65f691bbc7c49dc8f610c2c1b35c14da679571
SHA5127980cb4f907111c49c6a57f11d7d6c17e316fe626ac20ca073fe7cae4763d2ee45f3c410245228a6ec1a8cc3c3c31bdf3a731447bb22c92e4a5eec0000446aa9
-
Filesize
705B
MD51e4a9f7e2b33bf14400eef8b5ee7bc24
SHA1bcc167cc14fe236090ddd3069be08e2eb494b703
SHA256b923f88123dccb7482917d3e48384808eb134d1f9f6ac0083ad2edcf8f3dd34d
SHA5125617f944cc55a115aaaa55b0df79140cf8d48d954bb8a0a491ee6b8fa06a730c3f6fd4f824c94d57da02321b4b903bf7ee54c1c879402aeca49aa451d3ba09b5
-
Filesize
213B
MD55c9742c3499b9f785c0f87dd589775ea
SHA1727c2d78472c67b927882b1c7320376269cf5399
SHA256583ef46eb02bcf8b68a90cb85cc4b11c817d0cc00ead91c779b854f1f256dcde
SHA51287a0be1e3183825600db2053c6ea358512969bd4f0fc4ea81586a20679608489fd9dcb86aa8e19a05c91590f035c7063821aea04cc5ad588a1d092b3d717e2ed
-
Filesize
229B
MD5462f5b7f2e7518220502a45c9f7bfb07
SHA1e9d504bb1f292dc09b280b90b9393bee3d80d4c4
SHA2569fbddba01a279c7f09e72b9aee5f7c7cdf4a6f1b366c69acc5f43b7037748697
SHA512ae3d3fba3f11265fb6653fa5a4ebc8e856c179ae9704ca08c28fa1043deeb42b07b1e6d6f33156d795d3ef499d2a2d535077a46f9a77e9be703b1625aa835b55
-
Filesize
269B
MD5b6ef0ddecdbe86809f9e7c9c97a07900
SHA1d1fdf49afcb6fa5bdf5f8a585c20c13de0f99c28
SHA2560c222df5d62383c17ef9bbc77d359ca34e8c41e01a3bbeec033064f1feeabce3
SHA5129ae628b27fa24655f61a86a05bf154cbbf578c0f7f7a000bbecd523e3ecb2ca3758331467401ddc3b201f591ba9336ca5fba2f11d6a4d057018af3010a3a51fe
-
Filesize
243B
MD5c89688b5dc281e7a3e511c078b1ce694
SHA1ab2eb6d9737c114c39fad73f4934675d99baae50
SHA2568f9384e62344281c15207f37e19ee98c1402068a2500b26e5cc70635b9c4741c
SHA512982e9fb4bb48650f5cc40254f456fc65354f825f954901d27d7877f99a39d991d1efb7b3d70a3dabb10844d755915564b4d9f766cb6f3675c65939a684fb8198
-
Filesize
410B
MD5813f40fc87af0bce681c16a2d4ca47e0
SHA1b3623e71c382de1369c93ba72975797a346bd659
SHA256cec832f24c8eb2058de34e74daee44be1e7c5ed2c42235d4e5ff0ce67a60d3a8
SHA5120e902b692249f61498aae2caf591a62a4e49eadfa62d1a0017490281173c4db3f9ed6fa73a3470fb6f74d094fb99047d88f1c5a1841f7139ad5b2c465d9490f9
-
Filesize
735B
MD5177d51043a104142a751c9b0ca625465
SHA1de3cd29f869de4144ae92152b0d115c4bb8e62c4
SHA2563bf7278b4222ec25cdb348b0a14af3e581f523b3d03885b591523d542b904684
SHA5128ed43ae893e0731a468beb89ff60999c3f440248ee778e83d09c098164c4f3de1c9026e9b8a75cf49e63a9cf2be1e8967fa1d8c1e3bc38f7d3a91bdaa5f78359
-
Filesize
4KB
MD5fecca7ef7cef40a59a6dbe9ba7da1ec5
SHA13dd24c40ab3d17bffb01e3129b61c869e9f5e183
SHA256cbf2d9b22b1283ace68111b5217db28dd28fd92a969f2f7ecbae44f85abefca3
SHA5122981d8612bc38ab082c4f0cdf27574d5a88d72fb1a75987352dd39a72e819ef027de514d7dd390e0aa8f265bf7c095c9d5b09204efef0a0bea921ea1be5b5e08
-
Filesize
2KB
MD5424c716705f3c9ae1d097db975f762ac
SHA1f21e67dc9e79eb105593d1de3d5abf0c5c504e38
SHA256d49aff8702c02ab482a61a5e89fc23bcf00aada85d1ffd325e49082890373787
SHA512032526de236cf1e2de1d03507fb4bcaea8c57c19378fd6f995be9cc3779a3ddacb5523264c57a783ec8394fdac0597ed14f6812995b3b3df29774e5b14617dde
-
Filesize
2KB
MD5ba23cf3d52f0b829ae4e799a9eefdd94
SHA1e4aff060c95b80a60e2ef5cbe9e186ebd19f25b8
SHA2561cf888e15640437db0707ecd61f6a84b6334c7c9641e4136bedacdc00a38b651
SHA512e277be569fa65391a27241b9be2b9967b63e49f4bddadc33b6cadd1ac9202aacc857c2ea5f7860a6e3b9ffe52eef738045f65cf02ef03d96c7e334f932896a5d
-
Filesize
258B
MD57adf06d5733f4e92a6ce71e7af2b76ad
SHA1537ad5ae08375ef45d1189121e38a94f850c1563
SHA2567746b3dd2322ab0cb8357189956f0a2574050f6106b8a809a75e4fb6cdbd4a0b
SHA5120527d78f5b296cbf708d55f38ef1e524c162f06026d1f205cc8ba246d32f05839fa615ee3be68a0b6840c8b3476f8fa63c525a49161db61eb974237edca28c5b
-
Filesize
4KB
MD5561a69ec60bb33ef4ca3f2a5a000a1ef
SHA1a58c3e4d6eb205c9fc9966f10a3c5e40cdfb5b98
SHA2568b000eefba52ab4c97901f162608e3844f2cdc6b0cd048715931670c0eaf807e
SHA512d3ff41764fe378988421215599991126e904acb9b91401dbd9d87419a1ca44a1bb4ebd94ae3ce826d88521fd34ada62976615dd3aaba374fd7cab7c99eb86103
-
Filesize
1KB
MD503f54ccbd6a7fd6604b68ac9f4078740
SHA11f1f4c724887589e8fb98f87d9b2003eff04cf7c
SHA256a00d07789a3b8c911ad7ac677e0ffcb9a31338efc64954f5c038195e1bfd52bc
SHA512c65cf6569a8e86c6ca53212f62ac22954e62c1000440e856d85cfefabe817ce026335acc9471480ebe4ce8105053ce29be610319a9f4b09e94236bd778368eea
-
Filesize
167KB
MD52fa322260480c5a0ca63e144f7bb0541
SHA1861d4a5941641cc2904974f32eab474ca9ef4a8b
SHA256278774221af2f1fd82d10ba9d82d7f9960da03eb9c68b70f2af9e25187162778
SHA512a0b0a397a3b086c0e941c0d5e96c825196849148b77000845ab41b8f2f61efe0ad3da7b2ed25290e685c059d3ddeddd11c6b246736d7329ac5823d2d52fa048a
-
Filesize
2KB
MD5b2d4180bc37cf0a49fad0673f9344b79
SHA13bf42df1a90bca40c2caae98b22f10026f14f81d
SHA256638be2be30190c85c7c3abaf4d99824f87482f84149ee5b5d2f6dd02c255c66e
SHA512448937a5360945b78cba4821906c9c11d62e3ec7ba2bfea1fac6e1671ceef1d5e9f124e5b371d8b6a8b73db45a0c1c095af098fe5aa55e3a8cb041d30c0dc130
-
Filesize
28KB
MD5984287eadb5d8cd3ba0ee9a2bdd17720
SHA1cc8321091a0bd039996a8c91e5e2cc4fadb8500b
SHA256f729aa3996391f5b6a59dafd76a4983e627b2ab749895c4bab567827c604fdb0
SHA512766f0f2c4cdc76e2757ba418428dc6fa99fcece04ad41233cec43aff2ccbdf84b8daef9327fae237060ff418a175a296a33398a1d046c1402bb101105b3e1e8d
-
Filesize
98KB
MD523e0d9b16d06b0132976c1b078c760e1
SHA1d9130d29365d11c0be9da689b57565c7e450fdfa
SHA256660c0fcc21af7f23a5cae011aab1456d7fbd8149e3011e0470402812b9593aff
SHA5121d6922a910425b9f788b102abf55434d0d23e0aef7e10cc897d0c05a0070dab9e95b2b2883f886491f8e0292c199e8d95b9f24b8e19d8ea682f470196e8bc207
-
Filesize
1KB
MD55b5e88c89399ab4fd9686676e609aa49
SHA12056ceb51f3a6aebbfd73d985a008d1da7591364
SHA256203613a48ec3bd2a5332813a50eff3c46b9233c6776b2ff8f39056e6a85cc6af
SHA512ade98eb3daa6d8c6c313d5bac7283450aafcb39bba5eb06010b2a7e7b11cf2f105b1f6cd4cc434bc388ba73884828c276dae598c2a5549b5123edac758e8f03e
-
Filesize
53KB
MD58209cff7a4f587c4995a250b7736d47a
SHA158f473b226618dd964769274ec0ca59e95e4d795
SHA25638195859fab208501e52e46b62746b8f919836f79f501581e94d1f12fae7fd00
SHA5125a3a624af7a204ec131c3fdc2b03e62b02e2beaf16a6e5873e86a14bebd09a1f587fefe7a09c93ee9e8a97461f69d964098381b6748fedb308116cba643aa7ec
-
Filesize
7.5MB
MD59665f64ab1ccd81eba281a6a30f57c19
SHA116cc436793578696f5b8106f1e2ada35b42579ec
SHA25656cd59854b23468b52f58b7ebadbd7e9e9d25e00bca77014587e0e2bd6097d93
SHA512f621acfab76b83bd8d81f1111a26849a7736e02997e981a87cc5685d6df4ac72ea18ebdea6f2b8950cbd49bb808c34877164dc6b70651dfd98b8fbcb55b4eec7
-
Filesize
7.5MB
MD59665f64ab1ccd81eba281a6a30f57c19
SHA116cc436793578696f5b8106f1e2ada35b42579ec
SHA25656cd59854b23468b52f58b7ebadbd7e9e9d25e00bca77014587e0e2bd6097d93
SHA512f621acfab76b83bd8d81f1111a26849a7736e02997e981a87cc5685d6df4ac72ea18ebdea6f2b8950cbd49bb808c34877164dc6b70651dfd98b8fbcb55b4eec7
-
Filesize
7.5MB
MD59665f64ab1ccd81eba281a6a30f57c19
SHA116cc436793578696f5b8106f1e2ada35b42579ec
SHA25656cd59854b23468b52f58b7ebadbd7e9e9d25e00bca77014587e0e2bd6097d93
SHA512f621acfab76b83bd8d81f1111a26849a7736e02997e981a87cc5685d6df4ac72ea18ebdea6f2b8950cbd49bb808c34877164dc6b70651dfd98b8fbcb55b4eec7
-
Filesize
858KB
MD5c079504521b4e5031b794f5d3a9cc8a2
SHA140d5e76725f1e0f17f58f3a120dd8516c7f548dd
SHA2561e06e3ac46d9ed93c7fff847380760c78b6b20ea05b28333d958ec9a3ef20c1e
SHA5125c03c8e7fe588c161578a2514c65242494127bcb4352403ca2b9309ab44378a0797dd63e542f9054c22e8e2f5a568da6ab40a7a038f0e7fac999d232d5e60c57
-
Filesize
3.6MB
MD5e728cc86a0af1e36df2bd6bdf8f5169d
SHA1a09f12b19377c3dc2013932bd28fc70de8826e41
SHA256085888a9ae1e09cef6fcba22f74990151b68e9b88b5b39143f08d05ca7f4a5ec
SHA512b659635cbd8fa09756eadf3a3d829ceea63e0ed76fea2ecad420e55911d940006e327e63f159849815fc79b9801e6219c9d22568c9263914b680530bd5c0a99b
-
Filesize
3.6MB
MD5e728cc86a0af1e36df2bd6bdf8f5169d
SHA1a09f12b19377c3dc2013932bd28fc70de8826e41
SHA256085888a9ae1e09cef6fcba22f74990151b68e9b88b5b39143f08d05ca7f4a5ec
SHA512b659635cbd8fa09756eadf3a3d829ceea63e0ed76fea2ecad420e55911d940006e327e63f159849815fc79b9801e6219c9d22568c9263914b680530bd5c0a99b