5d3543abd635628552357db2559d4448e57288852b826cf430ffe3a1463ca316

Analysis

user interaction
yes
max time kernel
44s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 06:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Roblox manager assist.exe
Size 10.6MB
Sample261027-hjp14aa17w
SHA256 5d3543abd635628552357db2559d4448e57288852b826cf430ffe3a1463ca316
MD5 fdcaaf792c9083074efeca0359d1026c
SHA1 0a2bfbae4fde225e44f598378b25691f0d02ae59
SHA512 64b86de2fe3c365574a4020156e03a2c29f06520fd129e52c231d1e2821a7dec61207e06c2f96d5bdc6f1f1a0b5d6021787e4bb0dd73fc8b63c1b7b72c7eba4e
SSDEEP 196608:fDbJlRYe1J2Bfga9Y6ZDIykMpJzcZAFoHasHCUzFhDGD7bO7caSGcd2uNbRrC8A7:fDt7YaJWgoDsMQZA4CUzDiDu7Qd2cVr0
TLSH
T114B62317F24E633EE47996365972AA10553FBA20641B8CA386EC3E4CCE790611D7EF07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit discovery installer persistence spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
30	5080	Roblox manager assist.tmp
32	5080	Roblox manager assist.tmp

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	Roblox manager assist.tmp

Executes dropped EXE 18 IoCs

pid	Process
5080	Roblox manager assist.tmp
5696	63bdcfac001ad18626d4adad4ef7e863.exe
5952	eae9821fde6a3d3a15e070223c196a07.exe
5636	installer.exe
5968	installer.exe
1176	installer.exe
1620	e715e691fa7ba4188c4e96a1456b99b9.exe
3864	63bdcfac001ad18626d4adad4ef7e863.exe
3584	installer.exe
5576	installer.exe
1112	dly.exe
5848	6633f7704b88b40f42e4d36111c74b98.exe
5792	6633f7704b88b40f42e4d36111c74b98.exe
4188	6633f7704b88b40f42e4d36111c74b98.exe
3412	6633f7704b88b40f42e4d36111c74b98.exe
5176	6633f7704b88b40f42e4d36111c74b98.exe
3972	6633f7704b88b40f42e4d36111c74b98.exe
552	6633f7704b88b40f42e4d36111c74b98.exe

Loads dropped DLL 1 IoCs

pid	Process
1620	e715e691fa7ba4188c4e96a1456b99b9.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\D:	installer.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\D:	installer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	e715e691fa7ba4188c4e96a1456b99b9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Roblox manager assist.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Roblox manager assist.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	installer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	e715e691fa7ba4188c4e96a1456b99b9.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	e715e691fa7ba4188c4e96a1456b99b9.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	installer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	dly.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	dly.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Roblox manager assist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Roblox manager assist.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	63bdcfac001ad18626d4adad4ef7e863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eae9821fde6a3d3a15e070223c196a07.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e715e691fa7ba4188c4e96a1456b99b9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	63bdcfac001ad18626d4adad4ef7e863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dly.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
18600	setup.exe
19448	opera.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/4652-0-0x0000000000AF0000-0x0000000000BE1000-memory.dmp	innosetup
behavioral1/memory/4652-7-0x0000000000AF0000-0x0000000000BE1000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5080	Roblox manager assist.tmp
5080	Roblox manager assist.tmp
1620	e715e691fa7ba4188c4e96a1456b99b9.exe
1620	e715e691fa7ba4188c4e96a1456b99b9.exe
1620	e715e691fa7ba4188c4e96a1456b99b9.exe
1620	e715e691fa7ba4188c4e96a1456b99b9.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeRestorePrivilege	5696	63bdcfac001ad18626d4adad4ef7e863.exe
Token: 35	5696	63bdcfac001ad18626d4adad4ef7e863.exe
Token: SeSecurityPrivilege	5696	63bdcfac001ad18626d4adad4ef7e863.exe
Token: SeSecurityPrivilege	5696	63bdcfac001ad18626d4adad4ef7e863.exe
Token: SeManageVolumePrivilege	1620	e715e691fa7ba4188c4e96a1456b99b9.exe
Token: SeRestorePrivilege	3864	63bdcfac001ad18626d4adad4ef7e863.exe
Token: 35	3864	63bdcfac001ad18626d4adad4ef7e863.exe
Token: SeSecurityPrivilege	3864	63bdcfac001ad18626d4adad4ef7e863.exe
Token: SeSecurityPrivilege	3864	63bdcfac001ad18626d4adad4ef7e863.exe
Token: SeShutdownPrivilege	3248	Explorer.EXE
Token: SeCreatePagefilePrivilege	3248	Explorer.EXE
Token: SeShutdownPrivilege	3248	Explorer.EXE
Token: SeCreatePagefilePrivilege	3248	Explorer.EXE
Token: SeShutdownPrivilege	3248	Explorer.EXE
Token: SeCreatePagefilePrivilege	3248	Explorer.EXE
Token: SeShutdownPrivilege	3248	Explorer.EXE
Token: SeCreatePagefilePrivilege	3248	Explorer.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5080	Roblox manager assist.tmp

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 5080	4652	Roblox manager assist.exe	84
PID 5080 wrote to memory of 5696	5080	Roblox manager assist.tmp	95
PID 5080 wrote to memory of 5952	5080	Roblox manager assist.tmp	100
PID 5952 wrote to memory of 5636	5952	eae9821fde6a3d3a15e070223c196a07.exe	101
PID 5636 wrote to memory of 5968	5636	installer.exe	102
PID 5636 wrote to memory of 1176	5636	installer.exe	103
PID 5080 wrote to memory of 1620	5080	Roblox manager assist.tmp	104
PID 5080 wrote to memory of 3864	5080	Roblox manager assist.tmp	106
PID 5636 wrote to memory of 3584	5636	installer.exe	108
PID 3584 wrote to memory of 5576	3584	installer.exe	110
PID 5080 wrote to memory of 1112	5080	Roblox manager assist.tmp	111
PID 5080 wrote to memory of 5848	5080	Roblox manager assist.tmp	112
PID 5080 wrote to memory of 5792	5080	Roblox manager assist.tmp	114
PID 5080 wrote to memory of 4188	5080	Roblox manager assist.tmp	116
PID 5848 wrote to memory of 3248	5848	6633f7704b88b40f42e4d36111c74b98.exe	56
PID 5848 wrote to memory of 3248	5848	6633f7704b88b40f42e4d36111c74b98.exe	56
PID 5080 wrote to memory of 3412	5080	Roblox manager assist.tmp	118
PID 5080 wrote to memory of 5176	5080	Roblox manager assist.tmp	120
PID 5792 wrote to memory of 3248	5792	6633f7704b88b40f42e4d36111c74b98.exe	56
PID 5792 wrote to memory of 3248	5792	6633f7704b88b40f42e4d36111c74b98.exe	56
PID 5080 wrote to memory of 3972	5080	Roblox manager assist.tmp	122
PID 5080 wrote to memory of 552	5080	Roblox manager assist.tmp	123
PID 3412 wrote to memory of 3248	3412	6633f7704b88b40f42e4d36111c74b98.exe	56
PID 3412 wrote to memory of 3248	3412	6633f7704b88b40f42e4d36111c74b98.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3248
- C:\Users\Admin\AppData\Local\Temp\Roblox manager assist.exe
  "C:\Users\Admin\AppData\Local\Temp\Roblox manager assist.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Users\Admin\AppData\Local\Temp\is-I8ORH.tmp\Roblox manager assist.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-I8ORH.tmp\Roblox manager assist.tmp" /SL5="$60230,9979468,924672,C:\Users\Admin\AppData\Local\Temp\Roblox manager assist.exe"
    3⤵
    - Downloads MZ/PE file
    - Checks computer location settings
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5080
  - - C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\63bdcfac001ad18626d4adad4ef7e863.exe
      "C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\63bdcfac001ad18626d4adad4ef7e863.exe" x "C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\gamesi.7z" -o"C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0" -y
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\eae9821fde6a3d3a15e070223c196a07.exe
      "C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\eae9821fde6a3d3a15e070223c196a07.exe" --silent --allusers=0
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\7zS047D2109\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS047D2109\installer.exe --silent --allusers=0 --server-tracking-blob=ZTNkMDA0ZTNlMWQyZTYzODdhMzU3OTA2NjFjY2ZiOWMxZjFjMzdjODNiMjQ5MGNmMjhlNTIwZTM1ZDAxYzVhYTp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPXJzdHAmdXRtX21lZGl1bT1hcGImdXRtX2NhbXBhaWduPW9wZ3gxMDYiLCJ0aW1lc3RhbXAiOiIxNzkzMDgzNjI2LjMwNzQiLCJ1c2VyYWdlbnQiOiJJbm5vIFNldHVwIDYuNS40IiwidXRtIjp7ImNhbXBhaWduIjoib3BneDEwNiIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6InJzdHAifSwidXVpZCI6IjUyYTQ4MzNlLTUwYzUtNDc5MC04NzQ0LTBlMmU0NTVjYTRlNSJ9
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Reads the TCP/IP host and domain name from the registry
        Enumerates system info in registry
        Suspicious use of WriteProcessMemory
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\7zS047D2109\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS047D2109\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=138.0.6044.45 --initial-client-data=0x278,0x27c,0x280,0x250,0x284,0x7ff65a9a02d8,0x7ff65a9a02e8,0x7ff65a9a02f8
        6⤵
        Executes dropped EXE
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\.opera\f7f185a1-6a46-4613-b5be-f134c11e4b1b Opera GX Installer Temp\installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\f7f185a1-6a46-4613-b5be-f134c11e4b1b Opera GX Installer Temp\installer.exe" --version
        6⤵
        Executes dropped EXE
        
        PID:1176
      - C:\Users\Admin\AppData\Local\Temp\7zS047D2109\installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS047D2109\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=5636 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\f7f185a1-6a46-4613-b5be-f134c11e4b1b Opera GX Installer Temp\opera_package_20261027064710" --session-guid=7b7595c3-139a-4c97-b05c-5dc72349abcb --server-tracking-blob="YjE0OWIzZDRkZDY1Mzc2NTAwOThkZGQ4MGQ1NDczZDJkZGZkZTJiNjEzYzg2ZTkzNDBmMGI1M2NkYjI0YjAxZjp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPXJzdHAmdXRtX21lZGl1bT1hcGImdXRtX2NhbXBhaWduPW9wZ3gxMDYiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3OTMwODM2MjYuMzA3NCIsInVzZXJhZ2VudCI6Iklubm8gU2V0dXAgNi41LjQiLCJ1dG0iOnsiY2FtcGFpZ24iOiJvcGd4MTA2IiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoicnN0cCJ9LCJ1dWlkIjoiNTJhNDgzM2UtNTBjNS00NzkwLTg3NDQtMGUyZTQ1NWNhNGU1In0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=6407000000000000
        6⤵
        Executes dropped EXE
        Enumerates connected drives
        Enumerates system info in registry
        Suspicious use of WriteProcessMemory
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\7zS047D2109\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS047D2109\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=138.0.6044.45 --initial-client-data=0x26c,0x270,0x274,0x248,0x284,0x7ff65a9a02d8,0x7ff65a9a02e8,0x7ff65a9a02f8
        7⤵
        Executes dropped EXE
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\137.0.6036.65\installer.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\137.0.6036.65\installer.exe" --backend --initial-pid=5636 --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\f7f185a1-6a46-4613-b5be-f134c11e4b1b Opera GX Installer Temp\opera_package_202610270647101" --session-guid=7b7595c3-139a-4c97-b05c-5dc72349abcb --server-tracking-blob="YjE0OWIzZDRkZDY1Mzc2NTAwOThkZGQ4MGQ1NDczZDJkZGZkZTJiNjEzYzg2ZTkzNDBmMGI1M2NkYjI0YjAxZjp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPXJzdHAmdXRtX21lZGl1bT1hcGImdXRtX2NhbXBhaWduPW9wZ3gxMDYiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3OTMwODM2MjYuMzA3NCIsInVzZXJhZ2VudCI6Iklubm8gU2V0dXAgNi41LjQiLCJ1dG0iOnsiY2FtcGFpZ24iOiJvcGd4MTA2IiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoicnN0cCJ9LCJ1dWlkIjoiNTJhNDgzM2UtNTBjNS00NzkwLTg3NDQtMGUyZTQ1NWNhNGU1In0= " --silent --desktopshortcut=1 --install-subfolder=137.0.6036.65
        7⤵
        
        PID:18020
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\137.0.6036.65\installer.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\137.0.6036.65\installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=137.0.6036.65 --initial-client-data=0x264,0x268,0x26c,0x240,0x270,0x7ff78c0869d8,0x7ff78c0869e8,0x7ff78c0869f8
        8⤵
        
        PID:18052
        
        C:\Users\Admin\AppData\Local\Temp\.opera\f7f185a1-6a46-4613-b5be-f134c11e4b1b Opera GX Installer Temp\opera_package_202610270647101\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\f7f185a1-6a46-4613-b5be-f134c11e4b1b Opera GX Installer Temp\opera_package_202610270647101\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant" --copyonly=0 --allusers=0
        8⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\.opera\f7f185a1-6a46-4613-b5be-f134c11e4b1b Opera GX Installer Temp\opera_package_202610270647101\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\f7f185a1-6a46-4613-b5be-f134c11e4b1b Opera GX Installer Temp\opera_package_202610270647101\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=138.0.6044.45 --initial-client-data=0x220,0x224,0x228,0x1e4,0x22c,0x105b558,0x105b564,0x105b570
        9⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant" --run-assistant --allusers=0
        9⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=138.0.6044.45 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x73b558,0x73b564,0x73b570
        10⤵
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe"
        10⤵
        
        PID:7404
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
        11⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\137.0.6036.65\opera_crashreporter.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\137.0.6036.65\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=137.0.6036.65 --initial-client-data=0x158,0x15c,0x154,0x124,0x164,0x7ffdad188ca8,0x7ffdad188cb8,0x7ffdad188cc8
        12⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
        11⤵
        
        PID:18608
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\137.0.6036.65\opera_crashreporter.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\137.0.6036.65\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=137.0.6036.65 --initial-client-data=0x158,0x15c,0x154,0x124,0x150,0x7ffdad188ca8,0x7ffdad188cb8,0x7ffdad188cc8
        12⤵
        
        PID:18628
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=138.0.6044.45 --initial-client-data=0x260,0x264,0x268,0x218,0x26c,0xfb3f60,0xfb3f6c,0xfb3f78
        11⤵
        
        PID:18772
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
        12⤵
        
        PID:18848
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\137.0.6036.65\opera_crashreporter.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\137.0.6036.65\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=137.0.6036.65 --initial-client-data=0x178,0x17c,0x174,0x144,0x170,0x7ffdad188ca8,0x7ffdad188cb8,0x7ffdad188cc8
        13⤵
        
        PID:18892
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
        12⤵
        
        PID:19004
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\137.0.6036.65\opera_crashreporter.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\137.0.6036.65\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=137.0.6036.65 --initial-client-data=0x178,0x17c,0x174,0x144,0x170,0x7ffdad188ca8,0x7ffdad188cb8,0x7ffdad188cc8
        13⤵
        
        PID:19028
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
        12⤵
        
        PID:19100
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\137.0.6036.65\opera_crashreporter.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\137.0.6036.65\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=137.0.6036.65 --initial-client-data=0x158,0x15c,0x154,0x124,0x150,0x7ffdad188ca8,0x7ffdad188cb8,0x7ffdad188cc8
        13⤵
        
        PID:19116
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --start-maximized
        8⤵
        
        PID:18460
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\137.0.6036.65\opera_crashreporter.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\137.0.6036.65\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=137.0.6036.65 --initial-client-data=0x158,0x15c,0x154,0x124,0x150,0x7ffdad188ca8,0x7ffdad188cb8,0x7ffdad188cc8
        9⤵
        
        PID:18524
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-event-stream=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1800,i,11584343361077218996,7534792623504464101,262144 --field-trial-handle=1788,i,4137052368789230002,14991607023941664010,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1908,i,13392071675849433828,4880582072060471451,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1784 /prefetch:2
        9⤵
        
        PID:19392
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-event-stream=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=2144,i,13125641477441881222,16789510165211084914,524288 --field-trial-handle=1788,i,4137052368789230002,14991607023941664010,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1908,i,13392071675849433828,4880582072060471451,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2152 /prefetch:3
        9⤵
        System Time Discovery
        
        PID:19448
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-event-stream=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=2424,i,10517101941111711301,17675403591845638070,524288 --field-trial-handle=1788,i,4137052368789230002,14991607023941664010,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1908,i,13392071675849433828,4880582072060471451,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2436 /prefetch:8
        9⤵
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-event-stream=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3424,i,15161035974759932199,5138249883408437054,524288 --field-trial-handle=1788,i,4137052368789230002,14991607023941664010,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1908,i,13392071675849433828,4880582072060471451,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3244 /prefetch:8
        9⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-event-stream=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3472,i,8265983299919834979,6131006760677133385,524288 --field-trial-handle=1788,i,4137052368789230002,14991607023941664010,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1908,i,13392071675849433828,4880582072060471451,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3580 /prefetch:8
        9⤵
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-event-stream=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3484,i,4538451532800405228,11864428496805119990,524288 --field-trial-handle=1788,i,4137052368789230002,14991607023941664010,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1908,i,13392071675849433828,4880582072060471451,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3600 /prefetch:8
        9⤵
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-event-stream=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3436,i,13816762908731145946,9827712296095086652,524288 --field-trial-handle=1788,i,4137052368789230002,14991607023941664010,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1908,i,13392071675849433828,4880582072060471451,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3520 /prefetch:8
        9⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-event-stream=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3460,i,13607300488853267540,13271644955500749997,524288 --field-trial-handle=1788,i,4137052368789230002,14991607023941664010,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1908,i,13392071675849433828,4880582072060471451,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3560 /prefetch:8
        9⤵
        
        PID:7896
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-event-stream=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3448,i,4452509884540542595,11530883614929935257,524288 --field-trial-handle=1788,i,4137052368789230002,14991607023941664010,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1908,i,13392071675849433828,4880582072060471451,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3540 /prefetch:8
        9⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 OPR/137.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-event-stream=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-full-api=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4184,i,12233463245265585608,3173439859312200062,1572864 --field-trial-handle=1788,i,4137052368789230002,14991607023941664010,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1908,i,13392071675849433828,4880582072060471451,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=3080 /prefetch:1
        9⤵
        
        PID:19476
      - C:\Users\Admin\AppData\Local\Temp\.opera\f7f185a1-6a46-4613-b5be-f134c11e4b1b Opera GX Installer Temp\opera_package_202610270647101\assistant\Opera_GX_assistant_138.0.6044.45_Setup.exe_sfx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\f7f185a1-6a46-4613-b5be-f134c11e4b1b Opera GX Installer Temp\opera_package_202610270647101\assistant\Opera_GX_assistant_138.0.6044.45_Setup.exe_sfx.exe"
        6⤵
        
        PID:16408
      - C:\Users\Admin\AppData\Local\Temp\.opera\f7f185a1-6a46-4613-b5be-f134c11e4b1b Opera GX Installer Temp\opera_package_202610270647101\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\f7f185a1-6a46-4613-b5be-f134c11e4b1b Opera GX Installer Temp\opera_package_202610270647101\assistant\assistant_installer.exe" --version
        6⤵
        
        PID:16628
        
        C:\Users\Admin\AppData\Local\Temp\.opera\f7f185a1-6a46-4613-b5be-f134c11e4b1b Opera GX Installer Temp\opera_package_202610270647101\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\f7f185a1-6a46-4613-b5be-f134c11e4b1b Opera GX Installer Temp\opera_package_202610270647101\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=138.0.6044.45 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x105b558,0x105b564,0x105b570
        7⤵
        
        PID:16804
  - - C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\e715e691fa7ba4188c4e96a1456b99b9.exe
      "C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\e715e691fa7ba4188c4e96a1456b99b9.exe" /s
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Writes to the Master Boot Record (MBR)
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\360TS_Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\360TS_Setup.exe" /c:WW.AZ.CPI20231101 /pmode:2 /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /s
        5⤵
        
        PID:17596
      - C:\Program Files (x86)\1793083716_0\360TS_Setup.exe
        
        "C:\Program Files (x86)\1793083716_0\360TS_Setup.exe" /c:WW.AZ.CPI20231101 /pmode:2 /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /s /TSinstall
        6⤵
        
        PID:18340
  - - C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\63bdcfac001ad18626d4adad4ef7e863.exe
      "C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\63bdcfac001ad18626d4adad4ef7e863.exe" x "C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\7453d4a20ad5b3642727ed1abfdce372.zip" -o"C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp" -p"Klauncher2026Vwx" -y
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3864
  - - C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\dly.exe
      "C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\dly.exe" --partner 418804 --distr /quiet /msicl "YABROWSER=y YAQSEARCH=y YAHOMEPAGE=y VID=195"
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      PID:1112
    - - C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe" /quiet /msicl "YABROWSER=y YAQSEARCH=y YAHOMEPAGE=y VID=195"
        5⤵
        
        PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\dly.exe
        
        C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\dly.exe --stat dwnldr/p=418804/cnt=0/dt=3/ct=3/rt=0 --dh 2308 --st 1793083640
        5⤵
        
        PID:1264
  - - C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\6633f7704b88b40f42e4d36111c74b98.exe
      "C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\6633f7704b88b40f42e4d36111c74b98.exe" "C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\Яндекс.Игры.lnk" 5386
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\6633f7704b88b40f42e4d36111c74b98.exe
      "C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\6633f7704b88b40f42e4d36111c74b98.exe" "C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\Warface.lnk" 5386
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\6633f7704b88b40f42e4d36111c74b98.exe
      "C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\6633f7704b88b40f42e4d36111c74b98.exe" "C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\ВарТандер.lnk" 5386
      4⤵
      Executes dropped EXE
      PID:4188
  - - C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\6633f7704b88b40f42e4d36111c74b98.exe
      "C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\6633f7704b88b40f42e4d36111c74b98.exe" "C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\Майнкрафт.lnk" 5386
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3412
  - - C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\6633f7704b88b40f42e4d36111c74b98.exe
      "C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\6633f7704b88b40f42e4d36111c74b98.exe" "C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\ВПН.lnk" 5386
      4⤵
      Executes dropped EXE
      PID:5176
  - - C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\6633f7704b88b40f42e4d36111c74b98.exe
      "C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\6633f7704b88b40f42e4d36111c74b98.exe" "C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\ChatGPT.lnk" 5386
      4⤵
      Executes dropped EXE
      PID:3972
  - - C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\6633f7704b88b40f42e4d36111c74b98.exe
      "C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\6633f7704b88b40f42e4d36111c74b98.exe" "C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\Мир Танков.lnk" 5386
      4⤵
      Executes dropped EXE
      PID:552
  - - C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\6633f7704b88b40f42e4d36111c74b98.exe
      "C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\6633f7704b88b40f42e4d36111c74b98.exe" "C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\Мир Кораблей.lnk" 5386
      4⤵
      PID:4352
- C:\Users\Admin\AppData\Local\Temp\{E896FA69-263F-4DE4-B487-96128ED3B476}.exe
  "C:\Users\Admin\AppData\Local\Temp\{E896FA69-263F-4DE4-B487-96128ED3B476}.exe" --job-name=yBrowserDownloader-{C82682B8-5C7C-4421-926A-02A43C5620A9} --send-statistics --local-path=C:\Users\Admin\AppData\Local\Temp\{E896FA69-263F-4DE4-B487-96128ED3B476}.exe --YABROWSER --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=6035461-195&ui={20740a09-4a94-42f0-a5e0-e00198f8b9ca} --use-user-default-locale
  2⤵
  PID:840
- - C:\Users\Admin\AppData\Local\Temp\yb5565.tmp
    "C:\Users\Admin\AppData\Local\Temp\yb5565.tmp" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\ad92181a-88b3-4fc6-b748-9ad899486afa.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=655647492 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-{C82682B8-5C7C-4421-926A-02A43C5620A9} --local-path="C:\Users\Admin\AppData\Local\Temp\{E896FA69-263F-4DE4-B487-96128ED3B476}.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=6035461-195&ui={20740a09-4a94-42f0-a5e0-e00198f8b9ca} --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=lite --use-user-default-locale --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\500c6773-2e1e-4596-af0f-6f5a1633acf7.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico"
    3⤵
    PID:7224
  - - C:\Users\Admin\AppData\Local\Temp\YB_92365.tmp\setup.exe
      "C:\Users\Admin\AppData\Local\Temp\YB_92365.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_92365.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\ad92181a-88b3-4fc6-b748-9ad899486afa.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=655647492 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-{C82682B8-5C7C-4421-926A-02A43C5620A9} --local-path="C:\Users\Admin\AppData\Local\Temp\{E896FA69-263F-4DE4-B487-96128ED3B476}.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=6035461-195&ui={20740a09-4a94-42f0-a5e0-e00198f8b9ca} --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=lite --use-user-default-locale --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\500c6773-2e1e-4596-af0f-6f5a1633acf7.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico"
      4⤵
      PID:7504
    - - C:\Users\Admin\AppData\Local\Temp\YB_92365.tmp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\YB_92365.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_92365.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\ad92181a-88b3-4fc6-b748-9ad899486afa.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=655647492 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-{C82682B8-5C7C-4421-926A-02A43C5620A9} --local-path="C:\Users\Admin\AppData\Local\Temp\{E896FA69-263F-4DE4-B487-96128ED3B476}.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=6035461-195&ui={20740a09-4a94-42f0-a5e0-e00198f8b9ca} --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=lite --use-user-default-locale --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\500c6773-2e1e-4596-af0f-6f5a1633acf7.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico" --verbose-logging --run-as-admin --target-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application" --child-setup-process --restart-as-admin-time=688334968
        5⤵
        System Time Discovery
        
        PID:18600
      - C:\Users\Admin\AppData\Local\Temp\YB_92365.tmp\setup.exe
        
        C:\Users\Admin\AppData\Local\Temp\YB_92365.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=18600 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.10.0.1854 --initial-client-data=0x280,0x284,0x288,0x25c,0x28c,0x7ff6fa601ed8,0x7ff6fa601ee8,0x7ff6fa601ef8
        6⤵
        
        PID:18652

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:5564
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 606D0BAF55B77D7F84E3BB3C4B59E3E5
  2⤵
  PID:4888
- - C:\Users\Admin\AppData\Local\Temp\08EED2F1-23F6-45FD-8A5F-A5020659C3A1\lite_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\08EED2F1-23F6-45FD-8A5F-A5020659C3A1\lite_installer.exe" --use-user-default-locale --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --YABROWSER
    3⤵
    PID:2436
- - C:\Users\Admin\AppData\Local\Temp\ADEE51D0-3E57-4A7F-B31B-F1EAA90C3793\seederexe.exe
    "C:\Users\Admin\AppData\Local\Temp\ADEE51D0-3E57-4A7F-B31B-F1EAA90C3793\seederexe.exe" "--yqs=y" "--yhp=y" "--ilight=" "--oem=" "--nopin=n" "--pin_custom=n" "--pin_desktop=n" "--pin_taskbar=y" "--locale=us" "--browser=y" "--browser_default=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\68A20210-3543-4217-956A-3673EC51D98B\sender.exe" "--is_elevated=yes" "--ui_level=2" "--good_token=x" "--no_opera=n"
    3⤵
    PID:4896
  - - C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe
      C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent --pin-taskbar=y --pin-desktop=n
      4⤵
      PID:29668
    - - C:\Users\Admin\AppData\Local\Temp\pin\explorer.exe
        
        C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent --pin-taskbar=y --pin-desktop=n /pin-path="C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.lnk" --is-pinning
        5⤵
        
        PID:15392
  - - C:\Users\Admin\AppData\Local\Temp\68A20210-3543-4217-956A-3673EC51D98B\sender.exe
      C:\Users\Admin\AppData\Local\Temp\68A20210-3543-4217-956A-3673EC51D98B\sender.exe --send "/status.xml?clid=6035492-195&uuid=20740a09-4a94-42f0-a5e0-e00198f8b9ca&vnt=Windows 10x64&file-no=8%0A10%0A11%0A12%0A13%0A15%0A17%0A18%0A20%0A21%0A22%0A25%0A36%0A40%0A42%0A45%0A57%0A61%0A89%0A102%0A103%0A111%0A123%0A124%0A125%0A129%0A"
      4⤵
      PID:15468

C:\Windows\system32\werfault.exe
werfault.exe /hc /shared Global\ccb03ffc28ca430bb8c0af1ff76d967c /t 3856 /p 3824
1⤵
PID:15756

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:15964

C:\Windows\system32\werfault.exe
werfault.exe /hc /shared Global\f8e621b5d19a45279778728de1e1dfda /t 16016 /p 15964
1⤵
PID:17548

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}
1⤵
PID:18420

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:18436

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:20076

C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
"C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --autostart
1⤵
PID:11632
- C:\Users\Admin\AppData\Local\Programs\Opera GX\137.0.6036.65\opera_crashreporter.exe
  "C:\Users\Admin\AppData\Local\Programs\Opera GX\137.0.6036.65\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=137.0.6036.65 --initial-client-data=0x178,0x17c,0x174,0x144,0x170,0x7ffdad188ca8,0x7ffdad188cb8,0x7ffdad188cc8
  2⤵
  PID:11644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e598cf7.rbs

Path C:\Config.Msi\e598cf7.rbs
Size 911B
SHA256 9cfb643dc21fa76393ab7f125aa2fb9836ba7404e15d38102e84fe1fe72a3293
MD5 6533afa174054e862c083595cd54e0e9
SHA1 57f0c5c431b05be7deb897736bb74b1b43b11d9e
SHA512 ddd794882eace967707071abf6f43b5c9934f600602b943f500ce64f05d82939b4d77d3c3d0c4e32254bf34e8fa01284e1e00241067ffed383f1f8a95530e591
TLSH
T191112F4FA7BD82C6C84580325F9A5DEB945BF430AB5F88D0990F6C1A249D2303F08183
MD5 SHA1 SHA512 TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7
Size 1KB
SHA256 6702766fb548af37a6b391421a7bbdef922a7d59e231928db4a7aadbb2838e4a
MD5 e9bdd68a0f2e23b144f2da5b1d3c8a5e
SHA1 d7a279b692cd5ca4082a403a2be0d4395aa10fae
SHA512 7819ed4b0fc3b9c60d186d4a8b5076aaf25140b155658d5eb0b73863f5d3f91c1417af3f01871fba6fbb4e59322f581d94d35131ba8d04eacd8140f894313644
TLSH
T16D31FA4915DD3BC26BDE4F502DC986752BB061543DBC6612312662A971413F32F69C24
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 1KB
SHA256 df544e6fea8505211052dcaa1954bd459198c1ca9f0591e5a7f9117d301b4903
MD5 74c0465d5edd80191bdadd385bc95d0b
SHA1 5126d2eff72be049fd91436c9515c58608a98af7
SHA512 08f72f908f58a988bd5a069f62762b5685e3ab02fbb456d348b41093b9c253177bb177961a31313b67dbcb8657d1570e8997cd5c01e404eece94feaf2c7dfada
TLSH
T1DF31DA6A5D7832426D50EDA819E5F23BACA47A5064DE7040AA260D1B20903735FC4C8E
MD5 SHA1 SHA512 TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7
Size 536B
SHA256 531ac0d271dde3cd8e49df57c463d691237fc43f06bd1b85d4369194abd0d8fb
MD5 db913ae5a921db9b2359ee42c5c75f9f
SHA1 4dc3572446d7ac61b7f75b7da51aa6af709c97dd
SHA512 eea277e34abdd3f5a7e1f3b12feeeadc8644c5eb3ab936c2fcf6bd81fbcf9ebb4c6b9a49e1f4f677a33f88619da8d438d9c7b2d05db2c6413b8dfc5af8d48224
TLSH
T1F7F09E3045FE002EF033CB780AD0569A9D55FA121965961C1EA90309BE38F007E92A39
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 536B
SHA256 ab62b004be905a55ef42cbe29eee40c72ef3fef9491d75e6c2de7659c2d9d44e
MD5 e355bebf3e0f9df1afee7f54bc8a202b
SHA1 a1ac798bac502542b6312c32600efb588255189b
SHA512 a394e3b1e8b48740fe202403ed723a6b4be7f3bca48874034a75c13e7e62eb150135caf0e971957ac1a90ce1a06e60233080ed6728ae956d4d1d1871171734fb
TLSH
T19FF0DC0806F9832FF0B2CD784DCC9616E96AF8022818822D07514B0DAE31F009D2282E
MD5 SHA1 SHA512 TLSH

Submit Download

yandex.ru.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Services\yandex.ru.ico
Size 5KB
SHA256 6bb91f1d74389b18bce6e71772e4c5573648c1a4823338193f700afdf8216be5
MD5 a6f6261de61d910e0b828040414cee02
SHA1 d9df5043d0405b3f5ddaacb74db36623dd3969dc
SHA512 20cb7b646c160c942e379c6e7a1a8981a09f520361c0205052c1d66e2fdb76333ffaaf0ca1dfc779754f0e844b9946900fbd5690d01869e1607abc1fda6dffab
SSDEEP 24:ErelattlSx7HQyQzOhxWLn/gFx6VVG0GG8efv1olaLLDGdKo9SpxeHGzr31+o6sd:EilaV67H9PDyg9sala25HAn/t
TLSH
T178C103C971D510A9C0BC6BF022D37A15CD53ED6B84B01CA75531B41AADFA7162F0A2F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Yandex[1].exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U1Q3VPCN\Yandex[1].exe
Size 12.3MB
SHA256 451fdf67f60e4a9f2f4493dc0ac5378f4e34393c4fb9797e8e4b097b4454b8be
MD5 9faa737e5bb51eaaf17ae28f95b2d76b
SHA1 a34f547f6cacb4ace3c74713645418ac85099683
SHA512 9c949a3dd5196050f3a5b44acc2869fff41a8bdd3bf5b294c9b52e8329db263420454d0aeee9aa48a34c166a0dd7a5d782f10207bf16f294440b54aaf1aaf72b
SSDEEP 196608:8nGtuzX2hn6Ak+mhvj2AT/NTx9Pe20/xtiu6Eor:8IOX2h6N+mBjdTldCxtieY
TLSH
T1DAD6E086EB822125DA2B7A71113C3DBB86197DC95B704BCB97EA7C8405317D31836F8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0e62eb4d1cb11d947dff5f6b03408d68.png

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16h2m5ny.default-release\thumbnails\0e62eb4d1cb11d947dff5f6b03408d68.png
Size 5KB
SHA256 a08d93fef42579ebf000b3496ae50837ba14024fd07df04304534de480c72a1c
MD5 2d0a37bb716f9ad9fb916eb8b08d34c4
SHA1 48658fb5f716478bcfa239ba635589184edc33cf
SHA512 15216319722cd68b7e0018cfd360a3ef3ba512a0686646677b51f4926ee8290f984e72fdd5a815dc5fdfc7170e8d9b2f207413574c96c7189291140475fe959b
SSDEEP 96:r822Cs1+pd6KdnkmN81n5HXKDkhrhQJzQz7xUTZTr8u9FaVVmstmjlQtxMs5u1HK:2NK7dFN65HNhGlQBUTZTrJ9EDfmjSFco
TLSH
T19DC15C2A78D214C260CE5095380AB43FDE25E45182998BCFBCBF5C264A6337955FF7C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3794392fdaf98958d3acbd7228ce5344.png

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xlhu326a.Admin\thumbnails\3794392fdaf98958d3acbd7228ce5344.png
Size 6KB
SHA256 cbd302b0ea2218f495b9f0a814f34733f2c5f13a6634d74c6e85a5c0863b5621
MD5 e05d28ab78d61968a7132eafe61f54b4
SHA1 dcf260ab7cdea7b6fc934e54765c964c1a20bd36
SHA512 ebea612bf803692fa3c7b2573c58f2e43fba0f7039e01b57203978cf69b6f8ca538b563791a760a7e901bb5e392879bd57bdbdb69b6a3781a3886fc0c01eddc0
SSDEEP 96:4llcHitlIxv9vk7C1+I4wWHLihk/x8f2XkP5buMJWb61HYFp+AvJSJTRmZuwq5M9:rIIHUCD4waY4mWW2CKURLr5Mm2lVd
TLSH
T1BEE16C8CA99D8C16A1485AED20D75516C83FDE44428B5E8A9E9FC00ECC70AB1AC6D3DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3ef50c93bc935a3f82c7e6fe1e3d6ba4.png

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xlhu326a.Admin\thumbnails\3ef50c93bc935a3f82c7e6fe1e3d6ba4.png
Size 15KB
SHA256 2435c0376fca765b21d43e897f4baa52daa0958a7015d04103488c606c99d1d3
MD5 af80a936c10e18de168538a0722d6319
SHA1 9b1c84a1cf7330a698c89b9d7f33b17b4ba35536
SHA512 9a1325c8ce05806e5c161a4cf47239f62baad8f79650fbd713e74928fce8171ced10ba7f24fac46c548e1dbf3f64106270cb25ca88c836c870107f5dc1f97879
SSDEEP 384:XJ9H3UgBY5QpDWZoc94ukwZ8UI9wujvkJL:XJWn5SWNVnI2/t
TLSH
T14862AE03295E87F5984CD6DABD8307AA6F69392EE8E2722E465B0C8738507714F4E07D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoft.windows[1].xml

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QN9OQICH\microsoft.windows[1].xml
Size 97B
SHA256 f1783fad08dee6fcb675cfaa41f3b88334061a4e13c2567623367018ac4890d3
MD5 e1432a805a93070cc8e7bb6028b49226
SHA1 e891f1fa815dd3afcece64b3a287d3e2865d1168
SHA512 19482059d5faf82695cb89b571116a46ece58440e864544cfb08dcdfcf211504c138629abe6907738af3028e23ef97901305450f0b60eda3d889102c740abcac
TLSH
T188B0121135C9CD1C16564EF93D0D50E432FE009692457DF434E4BC41B6C5D16C013CE0
MD5 SHA1 SHA512 TLSH

Submit Download

0.0.filtertrie.intermediate.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{65170cb8-d553-4dd0-bf2f-a7edeeb2213b}\0.0.filtertrie.intermediate.txt
Size 30KB
SHA256 a71bc257f72b056f1f1e2ba231ed3e33ec58415a5bd7498b39ee6fda6de7b951
MD5 9da8656ab27cbae4ee1a893b12e95951
SHA1 2ea3eb679cc299f559f4d3e09260dc2f5190307c
SHA512 6dc3ead42a2f965230e26e10e505dd74deea3c2778a440dc4c23d18ff6c292d169e2306fc783f807fb454ff6668d7063226a11ee68759793752802a4373bd9cb
SSDEEP 768:9/4/9wchIEZDgYpSfd28y0oyXGaFHVDi2C9hnjq:CV9DnS4AoyXG+RdCzjq
TLSH
T181D2FC35C772A16A70B15AE46F478352BC02C44697C7A9520BEDBDF4E4CA0B18FA727C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0.1.filtertrie.intermediate.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{65170cb8-d553-4dd0-bf2f-a7edeeb2213b}\0.1.filtertrie.intermediate.txt
Size 5B
SHA256 8e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c
MD5 34bd1dfb9f72cf4f86e6df6da0a9e49a
SHA1 5f96d66f33c81c0b10df2128d3860e3cb7e89563
SHA512 e3787de7c4bc70ca62234d9a4cdc6bd665bffa66debe3851ee3e8e49e7498b9f1cbc01294bf5e9f75de13fb78d05879e82fa4b89ee45623fe5bf7ac7e48eda96
MD5 SHA1 SHA512

Submit Download

0.2.filtertrie.intermediate.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{65170cb8-d553-4dd0-bf2f-a7edeeb2213b}\0.2.filtertrie.intermediate.txt
Size 5B
SHA256 d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f
MD5 c204e9faaf8565ad333828beff2d786e
SHA1 7d23864f5e2a12c1a5f93b555d2d3e7c8f78eec1
SHA512 e72f4f79a4ae2e5e40a41b322bc0408a6dec282f90e01e0a8aaedf9fb9d6f04a60f45a844595727539c1643328e9c1b989b90785271cc30a6550bbda6b1909f8
MD5 SHA1 SHA512

Submit Download

Apps.index

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{65170cb8-d553-4dd0-bf2f-a7edeeb2213b}\Apps.index
Size 1.0MB
SHA256 64478d43d10ec7f2262c5446e67c52c847dfcc876ed99c04821140a87e6d48e4
MD5 5752e0a5c1d997b131eed63f3424bf16
SHA1 6bcaba9bda20b29b0ae290eedd603bbfed2914f2
SHA512 ffc809234998d3d0b45f10dbc7a9ea4521533a6768be37c54b05b0ebd798a11628c2da5c6c792e79543e186f597d99512db91d220ef72f73f31226017bf4a5cc
SSDEEP 24576:AoLr7YfoyFxz8GfoLr7YfoyFxz8GSYdp:AMwf1xz8GfMwf1xz8G
TLSH
T1FF35E00A6F60626BE4255BB42FC32F123FBBC51993BB53AB8B35413C1CB43457D6942A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppCache134375572853288976.txt.~tmp

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134375572853288976.txt.~tmp
Size 85KB
SHA256 481c77c31a28689334f8554076f25d30b89a836651247b1ec5d834dee8aa1498
MD5 e8968db7ea5737b0d6b75f29890a1117
SHA1 2c07fa0800873ce5cba76e10243372b896740415
SHA512 90d7cad128e3d83cab41d7bc110564aead9928cbb4d6813e9574e4af0e989d285ab9565292d3d353ad79cb0aef64633246adf2c2ffd65cb9e3ef891dc266b7dd
SSDEEP 384:i/v8/n52/kh/ymL/aNU/gT2/Hl/M1/h8r/hJ/Zk/Ey/eX/MA/NV/CzS/1o/Yd/eT:v/Gzoz/rouRyV1D
TLSH
T18583B3A53281CBF3317966A0BCD9E435E13926B1E0A88F4461FA9617FC5ADDC62313D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browser_assistant.exe

Path C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
Size 5.3MB
SHA256 8dbcc04ba61e81430dd5ced37d93e9a0a4d9c07cdbf69d1acd1a52cb3994e325
MD5 2ca9049b8046875e0c2d9b5d2d58d12e
SHA1 f0d13b562b7d49763d644a9233287bafb711bedd
SHA512 697eb65aab4ae2c556fae06932d6a8d553ffce692f50c7a8aad7345c6eb0f78313849c2b172ed9ef38794e4a1d05457cc8ac52e3ded96f6f306bba53609e7996
SSDEEP 98304:i6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwI:XuwTTmYkJumW2tbE6smmPFGoT3sz+l
TLSH
T1E346AE42E71120B8CC066571643C6B7B8C285D63AB2187DF9BD87CA12BB45C2367FB5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_prefs.json.backup

Path C:\Users\Admin\AppData\Local\Programs\Opera GX\installer_prefs.json.backup
Size 1KB
SHA256 d705fe8106d32571a51962f117d1e0870d1b024c60534e55d50703512506353a
MD5 83d7abca1fbc6a1aa644236effa5a52a
SHA1 ce55f0eaaefb455e9885215e58ea39eac871a937
SHA512 eaf7ec5b41edfb340e0a469d4908b4fd43c64ded1c5512ece724fe71ff5506dc530a4b9d9f17e3b2cab6d5c37fc427122ecac14ac59d8a2f7e8bbbd7e028f2ac
TLSH
T1A031873462264036BD22D3DFDAD7660973430003952974E4E5FB0A6A34DBCE617B6917
MD5 SHA1 SHA512 TLSH

Submit Download

opera.exe

Path C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
Size 3.4MB
SHA256 9affc5d320b2daa663faaa21d4eb5c39666022e749d0297cae81b163d4d3a031
MD5 d4f4a7cfd9bc1d1e5833ff3180ff7432
SHA1 3f4203e80b71227c3b2244c67677f2d4607c1ef6
SHA512 d61bf1dd95087daacbb2204a349067e3b5979f1608387e2f71ecd580db772a47000b32eea5594771338107b82dca8ed2f920be174e3da668703ffe764f9384e7
SSDEEP 49152:QxiokxQqdMqT56I4PZo3E+Nc9PD9CubIfEj7HjoljoYwV4q9DkwTEQqgSADMc81P:EQ0OwuKD9KA9TMmY
TLSH
T1D5F58C13F2D910D8D01DD1798B9A8633EA72BC454B3176DF0690B6262F7AEE06B7D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5602319ed8e715b162b8c5ab0113c374.ico

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\5602319ed8e715b162b8c5ab0113c374.ico
Size 4KB
SHA256 e0a76e4274e59cb28d4d2581f73e4356da5121556170c8f7ee93773d67056f7e
MD5 0b62fa810b679347e21d64f20930040a
SHA1 79ef4a1c38b86e8fc669d7d8805d15e504f8241e
SHA512 b39a5f5fe8146f7c41eea6f1237c2fd3eeb00ae0f235bd0ba098f8b0a59d87e0ef92bb83590a6f8ba794ba741098cfad1b40ce2d095fb94c40253c2e12d81f72
SSDEEP 24:suhp7txIHgY5Dtw6oXwADfFyFEKjI1gEXAvZ74RC:BJD8hVoDfwtMYmk
TLSH
T1619116042125308BC90C12F44FC5EE56C28DBE87377D007AB6A97ECAA2B61664C67C92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d74c7ec43ea3b1a933b4fceedb0d59f.ico

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\5d74c7ec43ea3b1a933b4fceedb0d59f.ico
Size 179KB
SHA256 66cb2ca03b4b752d952cb421103824f463e48b28983c34e7bf91bea08b3fa31d
MD5 efc99cd99f602587d797d1ac83765e12
SHA1 9f81b03a7bdd5e0b9e2f22877bba3f285c8cb35b
SHA512 62beb2d82b492142e9cf682b593a2a00d63fc9187a1e7ce19147ce751a85cd756ea61df5e7ca1768440c68a0d5c10a3f6bee298427ad09f6c12751a4d20b26fb
SSDEEP 768:Ig+C045sz/THAxtiZN1l4+gNpq+6ijnT1R/KaRx9S6LRx3qESVz0CAmhn8SipxUi:8nCsz/zAjNZx3qEKbhnYUAibrBcic
TLSH
T17E0496F296019A35E9511BBC4332DA7ED5BB6EE82975E20561EAFC737F332C20854843
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6943619653bc19c5ac7c305108e4a2f3.ico

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\6943619653bc19c5ac7c305108e4a2f3.ico
Size 37KB
SHA256 10895d9cd3f7761b771bb201843d0880404b4f38a8356d57473f5c139bd5329f
MD5 de55bfecba0f6b7748ff487a604d0d1e
SHA1 ec6ea6190316824b2151b6c112ce762e457ca98b
SHA512 27d3550a933b98d5400c43688c71f14147281ce8bcdd4219baf24fbec8528e65976fb808394b956492005532a8c22c39fdd6007e1a95cf5a386acddb8b1738c9
SSDEEP 768:8oyUEtNddUCHa+BK1m0CCjXm6QudHauFuh0NRNC1aHj6q:8oAtmyaofCjXdLdHau0h4rCIOq
TLSH
T1D9031A984F5F0F84E002BCF80DB5924AD9B1AD3F4C144073BCAB19DDAE3E6957E98994
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97a97f107aa42ab2fbdac8cadf977a5d.ico

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\97a97f107aa42ab2fbdac8cadf977a5d.ico
Size 194KB
SHA256 85dbffe50a7cdc50d9890f117aff9f45a8f4fa81a3a420a1dfb412b907fe9bbf
MD5 f027dbf886d0de36af3e3a180abd5275
SHA1 4df31372bd461245446fe663a4b04c3ddad957d9
SHA512 c5f11583afd689cd2291eec4e5d88bacd4d64de600a4b03e38bc7028fe0a3f150e595aa3e26294b63c6b1df2666f7b561ac2d40896740c87661dc1727ac62fee
SSDEEP 1536:sl+rgJ47eRJrZqOZ1z+2HAiRUgSsSqz2yFFOAlwVLILH92eUACHD:847+rwOZF+2HPagZzRCAXnpCHD
TLSH
T12B14A87E7F17C9B1D803113EB5AACF3136124C45C0349B969AE7FA2FB971386611EA12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ChatGPT.lnk

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\ChatGPT.lnk
Size 1KB
SHA256 1f17ea3ad0bec1b5819021df5788eb011860686d4a161582b89eeb95bef11934
MD5 3bdd18d3741ff48fbee1c316017788ee
SHA1 402e95cdf69da6f475b337bc82303880334abe8c
SHA512 bb3b25ca9c415a3154396e2981a7bc305b81405edc9a956c72a71a1bab9d9071a5301dc45e8538d3c9e70fa1e34a91c0690d440219d4396e39b7ec4c4138b557
TLSH
T1EA41EE19BAE2035AE3B7443984B7A3818E7BF416F7516F0E015543CE1CA9B009D10F6F
MD5 SHA1 SHA512 TLSH

Submit Download

Warface.lnk

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\Warface.lnk
Size 1KB
SHA256 eacd7678ee38040d9bee80c81099a828474ebdcec2a85089317ab778a8be0eda
MD5 4f84a0f6404ccbba4559f25a1ba69da7
SHA1 52e7b7246150ead692b3c0989d597be057dff05f
SHA512 a316589303c10c610ec38d8fa75075986bbfa962e7f2b9cbd9323792429c85b8dd3df39e3e124880b8b0e9e0d2486382783682925253fb7c6fcf3784c35f76be
TLSH
T17E41EE2C69F21326E3B3843D88D7A3429D7BFA10F5501B0E005443CA0CAAB116E90F6F
MD5 SHA1 SHA512 TLSH

Submit Download

ae885b1d4a210999d18698bff5ef5e02.ico

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\ae885b1d4a210999d18698bff5ef5e02.ico
Size 37KB
SHA256 4f08b891ecb4e4e1fa581f9e175ce34f6a7e388b67cba41819acf5978e6b3d0c
MD5 4e933320895c320155aa7a5dcd764345
SHA1 9f23530c266a9b6b78d96a38a978db5f8af04b9f
SHA512 893eadd7b99e4c80b08dda3a37c7f48c08649448babc8ba1b40f1107b0cb540a0ffd6dbd38de9a8b8e040ff089750b1777f2b118a72a475f6987dab2a30aeff2
SSDEEP 768:/baYwkvlFJH8+JQbvkO+igEBqAEBLbHVjv0ftZ:/zjlFJH8Y/O+ig4YXHVz0lZ
TLSH
T1E503020B6CC903655AA544C2D1615F432398469C6F7FA1DB967394C8B1EAB40E1FB32E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b57fc2610fd1d201d0d40cef012083bb.ico

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\b57fc2610fd1d201d0d40cef012083bb.ico
Size 16KB
SHA256 cb06018625fc2685ba759f5f055243c7105c651e53d6522d4590733744eb38ec
MD5 bb268c46c65dbec31ff9eaac888137b9
SHA1 b2c7f6d7c5b9b63c0e2f8977890da6d7c89dd224
SHA512 af34e174ff4a238accb4d4fbf8e83127b9998b0c249a92c00f183f813520d71e19eb058fe9c4a2d9135318abf0be1bc1318b11cba0acdd18d1ace7b0f5ea4ffc
SSDEEP 24:jO5y0lfO2vi+jyUliafc9kDAEzwhxcHPdNaSfkVEzoWz:MR42rjxRk9kDA6wT1V+z
TLSH
T1B072159592885574E682F4F5D0B3637ACAF4CB454B33AE001AF5F2C6EE70E8E348B241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c48d039b741714185d5920ef1674dba4.ico

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\c48d039b741714185d5920ef1674dba4.ico
Size 12KB
SHA256 48e602c32f5c87a3f9fac6a8cffd3ebc8febcec139f0f34549e4e7fabe5e5006
MD5 864b52b374fbb67bfb6966480f673d02
SHA1 975ff7d84f5293a1e322485533f94394bd72baab
SHA512 dd5243e74a1dde85182872536e58825da45dcf4a0513d40d7987872bf208a14269500fbbf56d0d3509aef6fa4afe7cef9f75dfe49e039a6325bca66bb150855e
SSDEEP 384:OciBrjHJPlstVJ2OGTdHWBzvNWKvq0zaXNuv2iMmR:0hjpmzJesRVx5d+W
TLSH
T1DE42BE784E7745ECDA27F0BB51242066B747F2933AB4D2C5211B8EAD372986E94D3218
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c7f0093faa39d6fa76420f591251fb40.ico

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\c7f0093faa39d6fa76420f591251fb40.ico
Size 52KB
SHA256 fba4363c30bfc260b503a9bb543cb3c29682810929ff4b424b8687389eee9fbe
MD5 2775cad0fffc9bdf8811cad876dc938e
SHA1 4119a7e087355ae9723fea45e924834315026349
SHA512 078dc3cbc8030118eefe75e74ea726ffbd9a49c21ada9a7605684bd0f0f8ee3d78f0fca0e5c804cc21794bf8a89221f2ca2483f044f8aa06398868aeef234c2b
SSDEEP 1536:3TTKXwXywMGsEH8OfiQac9Mv7bq0M1LDfrsB1ivJT7bAgtX:3Ce8UYcmPq5o1+tAMX
TLSH
T18333022BE4F6121183562EEBBC69F3DC94EBE50298AB31327DF43B99E9484D481C511F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ВПН.lnk

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\ВПН.lnk
Size 1KB
SHA256 a3d02a5b67e88dfba8a09454f7e42210ece07a0f7f6f536b0e6b88e4c5695d19
MD5 4e56eae49407290ecb9c50aaaaf4c8b0
SHA1 f2b5c2047b6bbc4bb3c4e337a7a4c2d8be0f15c1
SHA512 df1d9127c181c0bf1afaf038615b9b86544e7c1e601f6b5c5df0f8f69284b9daeb378c162772fcfd5771ac0ca25c2e4f6f3fb4ad634377966fe74ddc729d18a5
TLSH
T188319B2C9EE21717E7B7853894EBA246DA7AF815FA605F4D004443C94CAA7006D50F6F
MD5 SHA1 SHA512 TLSH

Submit Download

ВарТандер.lnk

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\ВарТандер.lnk
Size 1KB
SHA256 042ec41b6499e35bfbcfd2aea28cf8f8dcda153e327038bceddc99fd8a7adb8b
MD5 32b3fd7eda7625894d686c711873c148
SHA1 554cc39c07e62c6d5b12ad637527c42c526b7167
SHA512 aa69b95fb6e118533b65a179bd1ded88382a08d7951ffb4decf0fda16cb570e9f99604679a0934410fe5747e3ee06f1754203c79fb333461561794931a27cc4f
TLSH
T14F419E0D5DE2236AE7B7853884E6A382D53AF414FA611B4D005583C94DAA702AD10FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Майнкрафт.lnk

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\Майнкрафт.lnk
Size 1KB
SHA256 c50a771c6f2475777980cfa6b7c3fe27c2afea601bc7fafe89d2bb4ff529798c
MD5 7e02542f67bc4c422ce38978ed91bb36
SHA1 0d5cefa3197f153238d9372476d2626cd867cfe6
SHA512 1d6c47f39eaac46a99c92644f3ec89917d70eba371ff0084ff3c550a1852ed3270eed1640e9bcbcadee60e7ae04df62eb020cbbb6d9186aa70c3a1a16d49cdb2
TLSH
T12341AC0C5EF61366E3B7893988E7A292AD37F416F6504F4D001143CA0CDAE016D50FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Мир Кораблей.lnk

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\Мир Кораблей.lnk
Size 1KB
SHA256 0f8f73c867d2628de9c32a97c6e83cc91d09beac7fdea72e562932870bda54de
MD5 c691081ed3a9bb8570a1ab60117c49ae
SHA1 3abd1a41db57361f859d0b8ce1c4845e812874e8
SHA512 4ec5207c4197dd58aa9eb4d78d9f1f34537161b0e3d2684cb56dd9c3b2873881dd6411268a66d2c8a948212b2baa8a8fb3c8664b45a4bd8541cea49075e9144a
TLSH
T11541DC0C5AF22745E3B7893988D6A283993BF910F6502B4D409143C91CAA7106900F5F
MD5 SHA1 SHA512 TLSH

Submit Download

Мир Танков.lnk

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\Мир Танков.lnk
Size 1KB
SHA256 e8f921a30644001367f462fca0ae9e7af528a360f1754b3e281bf2d4eb08b88d
MD5 ab7bee0ca69ba8d0d27e4bd0cb658dd2
SHA1 ac8af7a1dcae1554fed573a0fb8acaa136a9a095
SHA512 8337eb07d9e2778e5cea851be99965ba7a201f9390e6fc6aeff2c446e189a7f7bd43a122a70c17898270263fb7d8c9d77d11e3ccf53c08028c88afd8c6b54857
TLSH
T17041CB1CAAFA1356E3B7893894E7A682AE7AF405F6505F0E404583C90CAAB016D40F6F
MD5 SHA1 SHA512 TLSH

Submit Download

Яндекс.Игры.lnk

Path C:\Users\Admin\AppData\Local\Programs\Roblox v2.4.0\Яндекс.Игры.lnk
Size 1KB
SHA256 a38fb93bb0d3e496e5fc654effab17b4c826a0cf0c925c5eca09e304392c05fc
MD5 f4b800fbc7be99355564cd155afecbd1
SHA1 1f31aadfd57c58924e49b98b9b0bb1f96029892e
SHA512 74a550811b16eaf930bc4f04c6baf2561e7d96cd46b00496ffcdaf319f29c7782d77b9c9f8b5cb0cf3d5eac5821c1392a61d443e0afae6390e5b8cb567628a85
TLSH
T17C41CB5DAAF2136AE3B7843994E6A352997BF412F6510F0D005543C81CA97006914FAF
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 653B
SHA256 906828f26bd66d535603ffa286d9fcaf54d61d970f18d87c1040ef09cad62594
MD5 946e33e764149d280e226cc6a7e3bd59
SHA1 08d8eb1736175a355b725b8a17250e5395b8b92e
SHA512 2b369237324fabcb3df1c6f412ca05110ede801dfe77033fefe6c0b8dede1dbfc50e030e3bb8cd6f0a233b22bff3bf67860fc76a46b541101b28e79e1581203c
TLSH
T1A5F0836D4B07A81ACEA2E6B9C00917804B22E242390888F83031829C95A29811989A55
MD5 SHA1 SHA512 TLSH

Submit Download

setup.ini

Path C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini
Size 830B
SHA256 662fed62e29e1b4bd000a9c456a761a28c44c1724a134f7435e44627de715a5f
MD5 594e9a9d2dbf1dc654a6862bc0be00fa
SHA1 f86d137aa346d3b8f7acb88600df429bdd3d92c5
SHA512 8c343673634de936d0bdf83d73b82c69228c3c46c300219e6bb8ad35547f1b2a7f8eff922f5de70028197ff3c7b6b1075976fd198caf314e1eb6fdb888fcfe01
TLSH
T1EA0146F44934F4B4FA248007441351D5BB7B4F32DAC35526B09B265CB91095FD75528F
MD5 SHA1 SHA512 TLSH

Submit Download

Opera GX Browser.lnk

Path C:\Users\Admin\AppData\Local\Temp\.opera\f7f185a1-6a46-4613-b5be-f134c11e4b1b Opera GX Installer Temp\opera_package_202610270647101\Opera GX Browser.lnk
Size 1KB
SHA256 b2d8560f0b0dff6038e983b90dd60db219a36db8dc3fc41a8d0ac6d9a32d2aa3
MD5 bd2f68c2af14d853590b36c0c7a9fa33
SHA1 7f1ddcef5f20898b0ab3aa656e0b9d2178af2030
SHA512 e2357ba858eb24a54591b8dd4c5e0b0d277bd7554d2e03062584a23ee1830fb6f7623f1fec61e913e344e2281e7e2178b3116b70889416196b27f17f3c71f9e8
TLSH
T15021515D6BCD2B15F2FF453949BA3B21A17BB840FB074E0D418043890CBC642A5A8F5F
MD5 SHA1 SHA512 TLSH

Submit Download

additional_file1.tmp

Path C:\Users\Admin\AppData\Local\Temp\.opera\f7f185a1-6a46-4613-b5be-f134c11e4b1b Opera GX Installer Temp\opera_package_202610270647101\additional_file1.tmp
Size 3.2MB
SHA256 ff87215ff4c75e1f741fae5b0d7d00b933c2e967e70ce31431d898a4de998131
MD5 9aee4a436778bba572e429bfb8f10263
SHA1 6a1ab229ae3ecb064596f1b694c02ff18fcff352
SHA512 a9e516b5a9d90e0e8a328a0078bdbf782734b05af65ebd7f43e493ca2d962e44c042d413e4d15ef352cb2163725190b671909d32fc436a941a89abc0b090628f
SSDEEP 98304:Tkio8qAxndcSJFb/9fYTFDAJqOrmDGUy6LlHdyAI9n7xFYaIXb:TlqAxn/F79wTFDoqG8XyW9o1xiL
TLSH
T12FF53352AA94C4B0D52315374CE9B3FE5AFFF6617EA41B9F23880B4E9FB05D2981041B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

assistant_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\f7f185a1-6a46-4613-b5be-f134c11e4b1b Opera GX Installer Temp\opera_package_202610270647101\assistant\assistant_installer.exe
Size 2.5MB
SHA256 677a5ca267c49bcd4e39cba49ad0a7e2f489523a070f1b113512497f5d489d76
MD5 704647b8c3db95f4f8ef554eb2849a2e
SHA1 3669a684c5733fee82b8235d7347c987885c4a99
SHA512 4215c8afc883d7cab206094493c551c06b2128b0ec7ff5ac388e05d8168cc3257fd2cf73c7a87b5b0b5fad180f3674789c88682a48e3f87f150bde6251be954b
SSDEEP 49152:/5zJ7lRnxcSTHGKbmaO8b2j3R2I0Ya9NF7ayPsoWcqCxlv8RUjQa8jN40:/XxxDGlafQ3R10p93fPxWc3xlvcUpCNp
TLSH
T140C59E01786090B4D8563072711CBB3E9E605E169735DDCBEBE8BCC46BB46E2263B35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_prefs_include.json

Path C:\Users\Admin\AppData\Local\Temp\.opera\f7f185a1-6a46-4613-b5be-f134c11e4b1b Opera GX Installer Temp\opera_package_202610270647101\installer_prefs_include.json
Size 229B
SHA256 76f19c00e4df0f826922f37ea0e9e9f891fe276d845205b31f9a894eeb59d0e7
MD5 342aa9917e9cf32ea0bff76980a284d9
SHA1 0811801d5f3aed94e0fdce3378fbe44b47bd1f87
SHA512 9cd5bad8df5b00efbc21755950cd6b77de0c219223b3a4846de4af4296efb0661bc73b3ed26bb9062951aa8a12157ad024032aee0a11cdefd849b75b068f0297
TLSH
T1AFD0A5415027C4524561C283787633CD52536501C8517D5DF7DF52B0407D57215F6D5D
MD5 SHA1 SHA512 TLSH

Submit Download

installer_prefs_include.jsoncec09dd3-4f16-4e5f-ba4e-75a16bec97ab.tmp

Path C:\Users\Admin\AppData\Local\Temp\.opera\f7f185a1-6a46-4613-b5be-f134c11e4b1b Opera GX Installer Temp\opera_package_202610270647101\installer_prefs_include.jsoncec09dd3-4f16-4e5f-ba4e-75a16bec97ab.tmp
Size 244B
SHA256 6abb7394893a8a1729f4c82f5fe64e9445c4fb4a04eeb60aaadc532efe6a22bd
MD5 17da06b325f8a490f4dfef5a4f1c98d4
SHA1 0c5eb6b6da3257c0c0b547e3cbed9408754c5144
SHA512 2b7d2b2068f3c7b2c69877e237d62d3c9a2633f27ef9b76fd54f952d1041f8b6c6f4b4982bfa843c87aa8e8754c2921ec255ef64e7028b4b8a914b0fa5aadd6a
TLSH
T184D02B015027C5624A60C2873872338C52832A0188517C4AB7DF62A0407C0B215F6D19
MD5 SHA1 SHA512 TLSH

Submit Download

installer_prefs_include.jsonf753f37b-cd9e-4d25-bb97-138b6b55d192.tmp

Path C:\Users\Admin\AppData\Local\Temp\.opera\f7f185a1-6a46-4613-b5be-f134c11e4b1b Opera GX Installer Temp\opera_package_202610270647101\installer_prefs_include.jsonf753f37b-cd9e-4d25-bb97-138b6b55d192.tmp
Size 975B
SHA256 552e97da4242861b07b798ea6d8848b25c3457dd084d911b0ac9533c83e25929
MD5 44bdcd7f18bbe2087b6a9d98569a5963
SHA1 46500033fc5eb322e0417eb22595e4d5e84b9a82
SHA512 f8717bc11cdea53ba61ce1be39a7b3fd202d49c70531c746b65e4f83ca9241ed2b1592855e807cd0e468f1edd30a4c5b4c020f321ccaa82b24e204139176bf11
TLSH
T19911253425569022BE66C39FEAAF130AE3435503452574E5E0F7097524EFC7107B5926
MD5 SHA1 SHA512 TLSH

Submit Download

custom_partner_content.json

Path C:\Users\Admin\AppData\Local\Temp\.opera\f7f185a1-6a46-4613-b5be-f134c11e4b1b Opera GX Installer Temp\opera_package_202610270647101\resources\custom_partner_content.json
Size 245KB
SHA256 84bc1efb211c6b45f2906278a36f1414922f994a9611bbee7713ffd4ae21e967
MD5 f68d0557a8931cf979a21c59c1bae019
SHA1 e0bfe0f9a947916ebc1fffa52d7dff524e76c2ff
SHA512 2f0ef8e3e11daf0ad266c4fdc35d1e6e2215556115054f635ef9199b03a6924b1aa989f052461d59b9cdf57ec5eafa918e806fbf2d242f63699a8a65b0328ecc
SSDEEP 3072:iwK+GwaiHEaacjK+eMuhKS1d/ttUYD6W6Z2NrwYrVZCs0iUCabiKfAu/wX2OCy:XGuE/c9L+1btUYOnkrPVZCCUCabNU
TLSH
T1BA349D7BD4090CE327A561E68879611EEC21D26B0CE97C257B4C254C0F9ED6F25BC2BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

360base.dll

Path C:\Users\Admin\AppData\Local\Temp\1793083716_00000000_base\360base.dll
Size 1.0MB
SHA256 58f13d919f44d194827b609b6b267246abc47134bb202472c0dfe033b9d7ed73
MD5 b192f34d99421dc3207f2328ffe62bd0
SHA1 e4bbbba20d05515678922371ea787b39f064cd2c
SHA512 00d4c7a0a0097eb4b31a71a0eaf6ff0d44619f77a335c75688565e34e6d7f4fb6c258917457d560c6b0a5077603845ce012e01d9862e87fb5327d7f8da970f95
SSDEEP 24576:g2mj42MEVQPGEorkSYPuX/7DkbSrh/qtoT/cgB8SnLF:2jnMEVQuFkS/vkurNqtoTkgCSnJ
TLSH
T1FA35AE117A86C433EAAE0170557CEBBB047D76320B2184CBEBD87EAEA8305E25735757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\7z.dll
Size 1.1MB
SHA256 898bf5db34d9997b3d90b87091f34ae4e3e9cf34b6f2ae7fb8fd86e8a1bb684e
MD5 e74067bfda81cd82fe3a5fc2fdb87e2b
SHA1 de961204751d9af1bab9c2a9ba16edc7a4ae7388
SHA512 c0b1d851d97df2635b865d7f0a252881eef622363e08190e1f45ec308fdbd81f94ece53a6c2b1b36c38fcb82c2b8262f31a936a399cee567631b9146cf3ef60a
SSDEEP 24576:3W0UltW4A15Q+XlcGjHXipnalbw7V5WvzG2:ZUlM4Y5Q+XlcGj3YnalE5QB
TLSH
T1F0357E25FBF9C4B8C68E51318524E79510F5F61BCA20918B76D02F6F7F318E6C628E89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SysSweeper.ui.dat

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\config\lang\en\SysSweeper.ui.dat
Size 101KB
SHA256 15cba5db6305130277d5e8ec673e1c3b5b421b964bf9b368bdcd05ba090ffacb
MD5 bb541b01343008f756ffa991b21d26ac
SHA1 41ad3ae228cf18a7d049aee1ae51b0e2ca4cc668
SHA512 eaf040f909d3abd2f3615c07122a300d92730f255e8480237167e6fb54a33b4cb6bf35c558e25a93ed7e4f8ef947774bae0e9706a1fee4ab2c49dee9896a34d5
SSDEEP 3072:gx0yYtEZcQdagD9jvoXKG1GSzJ2Nids/FVt3Sjw3J5:y01ECQTjvJYwTlue
TLSH
T1B0A3E1A7330588E67499E82F4FE1BADCF48D3923128DAF58C80DEE991DCF51B3A04615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

art.dat

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\en\deepscan\art.dat
Size 38KB
SHA256 81adb709eec2dfb3e7b261e3e279adf33de00e4d9729f217662142f591657374
MD5 0297d7f82403de0bb5cef53c35a1eba1
SHA1 e94e31dcd5c4b1ff78df86dbef7cd4e992b5d8a8
SHA512 ce8983e3af798f336e34343168a14dc04e4be933542254ce14ff755d5eb2bcb6e745eda488bc24be2b323119006cf0bdb392c7b48558ca30f7f2e170a061a75e
SSDEEP 384:tXHhC/cKbA0HGMxVBZU/xly+amHdoPEbR9jB:tAkKxmkDq
TLSH
T109031E81F373615B056BF061DD429A2D8CB7C6FB67EACBCC9494163F38CA2A245D1938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dsr.dat

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\en\deepscan\dsr.dat
Size 58KB
SHA256 4649eedc3bafd98c562d4d1710f44de19e8e93e3638bc1566e1da63d90cb04ad
MD5 504461531300efd4f029c41a83f8df1d
SHA1 2466e76730121d154c913f76941b7f42ee73c7ae
SHA512 f7dd16173120dbfe2dabeab0c171d7d5868fd3107f13c2967183582fd23fd96c7eeca8107463a4084ad9f8560cd6447c35dc18b331fd3f748521518ac8e46632
SSDEEP 768:vAiFDMIhnjuOE2vN0ni6fifgNPb1IWXusCxAOxUMGRzxreHRHodyb45U7fLZjyAA:JM4A6UAHRHF4aImg
TLSH
T136432254303DE29F1FCAE5A29D4889FA9D67CF6A5F4460A8D198877CBDCC376122C0B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dsurls.dat

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\en\deepscan\dsurls.dat
Size 1KB
SHA256 b0355da8317155646eba806991c248185cb830fe5817562c50af71d297f269ee
MD5 69d457234e76bc479f8cc854ccadc21e
SHA1 7f129438445bb1bde6b5489ec518cc8f6c80281b
SHA512 200de0ffce7294266491811c6c29c870a5bc21cdf29aa626fc7a41d24faf1bfe054920bd8862784feaba75ba866b8ab5fd65df4df1e3968f78795ab1f4ad0d23
TLSH
T11311A54BB7C61217DB23C835F5E00882FE2BC2623A7CC51E9C61D2068DB553718BB29A
MD5 SHA1 SHA512 TLSH

Submit Download

ssr.dat

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\en\deepscan\ssr.dat
Size 47KB
SHA256 656c1ec3308eec42f541e0bf1b719dab057b11b3f549060cb059ca70d525274a
MD5 36f40d4765175a30a023652ec250c028
SHA1 2d210bcc0999fce743e11144cdb477435a4f2cf9
SHA512 825d1607a70ab455089792b62b656d8cc2b8c732f1f79d90ff648f6ed98199fab5acc279978eb1070ded88ed36c108726897678cdbf29ccce2aa9475c0d93308
SSDEEP 768:zx+WEbPFQa/XWPQDKIrETrAWRJCqZ2WFAeVPTbWjEdZFj0GAg3MBesLO1ERUTi:U/LFQa/mI7rEwW/2WFzrOEhnMBee3Rui
TLSH
T1C723F1C5A0B19819F8F97335A36AEBE9614D64C8876CF299C9C040F4756D23B358FCA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

360ipc.dat

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\en\ipc\360ipc.dat
Size 1KB
SHA256 0ba4355035fb69665598886cb35359ab4b07260032ba6651a9c1fcea2285726d
MD5 ea5fdb65ac0c5623205da135de97bc2a
SHA1 9ca553ad347c29b6bf909256046dd7ee0ecdfe37
SHA512 bb9123069670ac10d478ba3aed6b6587af0f077d38ca1e2f341742eaf642a6605862d3d4dbf687eb7cb261643cf8c95be3fba1bfa0ee691e8e1ed17cc487b11e
TLSH
T13441094DDE90EB20E7167FB1B3D0672799FC0190F01ABD19010368FA78A731BA023D68
MD5 SHA1 SHA512 TLSH

Submit Download

360netd.dat

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\en\ipc\360netd.dat
Size 43KB
SHA256 3b5837689b4339077ed90cfeb937d3765dda9bc8a6371d25c640dfcee296090a
MD5 d89ff5c92b29c77500f96b9490ea8367
SHA1 08dd1a3231f2d6396ba73c2c4438390d748ac098
SHA512 88206a195cd3098b46eec2c8368ddc1f90c86998d7f6a8d8ec1e57ae201bc5939b6fe6551b205647e20e9a2d144abd68f64b75edd721342861acb3e12450060d
SSDEEP 768:xW0IjxiegKAqfTtW7mYcQhirhlimzWk+MUKfiZw+5xpVRTtST1vUX:kDjsyt6mY5hirhlbzWk+JVZXxvR5SVa
TLSH
T13A13F1983607E5B4C5472B3896069F3853CAD5EBEA57A3D271023D59BCCB303D42D8B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

360netr.dat

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\en\ipc\360netr.dat
Size 1KB
SHA256 912102c07fcabe6d8a018de20b2ad97ea5f775dcb383cd3376168b7ebf8f9238
MD5 db5227079d3ca5b34f11649805faae4f
SHA1 de042c40919e4ae3ac905db6f105e1c3f352fb92
SHA512 519ab81d0c3391f88050e5d7a2e839913c45c68f26dabad34c06c461ddb84c781bf7224e4d093462c475700e706eef562d1210cee3dba00a985d8dadbf165c5c
TLSH
T18B21D8D2C30145CF64FCF89DFE3CE750C8C149BC598C8B3C5741AA8702A87041AC820E
MD5 SHA1 SHA512 TLSH

Submit Download

libdefa.dat

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\en\libdefa.dat
Size 319KB
SHA256 19fa3cbec353223c9e376b7e06f050cc27b3c12d255fdcb5c36342fa3febbec4
MD5 aeb5fab98799915b7e8a7ff244545ac9
SHA1 49df429015a7086b3fb6bb4a16c72531b13db45f
SHA512 2d98ed2e9c26a61eb2f1a7beb8bd005eb4d3d0dac297c93faaf61928a05fb1c6343bb7a6b2c073c6520c81befdb51c87383eab8e7ca49bb060b344f2cf08f4d9
SSDEEP 6144:A0YRCPOEtLsgNI9vVtZeIJNb4Zj9+kbdhPW:BYRC7p9NYvVbNb4ZJ++dhPW
TLSH
T1CA649E23C6A564B0C31D095D42C578628BBDF8D2D38B4D9D037392247BEFB1B059AA7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drvmon.dat

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\en\safemon\drvmon.dat
Size 5KB
SHA256 5ee31b5ada283f63ac19f79b3c3efc9f9e351182fcabf47ffccdd96060bfa2cf
MD5 c2a0ebc24b6df35aed305f680e48021f
SHA1 7542a9d0d47908636d893788f1e592e23bb23f47
SHA512 ea83e770ad03b8f9925654770c5fd7baf2592d6d0dd5b22970f38b0a690dfd7cb135988548547e62cca5f09cb737224bbb8f2c15fe3b9b02b996c319f6e271ed
SSDEEP 96:FDUwO22iZ3EYFzdsmNmW6kTSUhdNGfU5wpWuCZb9ncY+2qdS+DQg3XwS2ULWPSL5:F4wO6NdMfBUyuCdCZmRU+DQGXUgUGAro
TLSH
T10AB15C0DD99C8EF6E5AC133BEFB01FA7E0A37506D1950812682229654CFC94348AB869
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wd.ini

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\es\safemon\wd.ini
Size 8KB
SHA256 bb600e5ecd40b5b3fcbeef92910837391ca11c34bce4019a74b8997c7111a349
MD5 638b94a4675b4572e145c193cd222f89
SHA1 1016a257af80f5e123f59d54f4459addb08d8b4d
SHA512 f663031948d9cbbf6c8b98c052b1c830b4f3b5c108dda5bd01fc37fba196620477db4d442de15f1517fe6512b4068ff6b8faa1afa80ebfe09a6def03ecf49f5e
SSDEEP 96:ra9kZ7sqnvJDgTBiYK/y2lVlujNqWIajWwapG4Bj8n5t6WSbJ1J9Wa5sFWbmc:29+DgRgiz0G4Bj8n5uWfFWT
TLSH
T11A0231AF2AE95129F6F39B44FDB508B55B3A7C42682DCC9C01C216494CF2B006517BFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bp.dat

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\fr\safemon\bp.dat
Size 2KB
SHA256 d81e7765dacef70a07c2d77e3ab1c953abd4c8b0c74f53df04c3ee4adf192106
MD5 1b5647c53eadf0a73580d8a74d2c0cb7
SHA1 92fb45ae87f0c0965125bf124a5564e3c54e7adb
SHA512 439738f2cdd0024e4d4f0da9668714fd369fb939424e865a29fc78725459b98c3f8ac746c65e7d338073374ab695c58d52b86aea72865496cd4b20fcd1aa9295
TLSH
T198414B16BEA4C3DACF251D3AA063BC2E4418B9F084E4B4C24C5206837E8DB151E834C8
MD5 SHA1 SHA512 TLSH

Submit Download

dsconz.dat

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\hi\deepscan\dsconz.dat
Size 18KB
SHA256 7bdae07465d701ab2ae76fffcfcc56fb0836bdefddc7efa51011d548065245e5
MD5 1488190277dc5eee5664a9c595edbd4a
SHA1 3385a4b604f0324b73bd4f746bb35e82314b92f9
SHA512 79d4ad3032a8e9ec3c0db6dd914bc7e9459f6c17e7b7f256703d60fc657b17aafc1ff929a3ce0e0dc8b2726019614554651a2c10996fe51fc45064ee80f132f4
SSDEEP 384:LWC0cB9YzwkjGOHEr3/fd8Ktp8ivMO8OwXRSeW:LWGBKXjG7rndnzOOwQeW
TLSH
T16C82CF46E2F093BFD65A205355C28550E1F912725BE1AE3330452EEAC1E97DD4ABFCC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AntiAdwa.dll.locale

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\it\AntiAdwa.dll.locale
Size 126KB
SHA256 309d475fcbe0c3c24bfe3d22b4b3c41b1022ddb4eb8fe6e1ea38671f83573e70
MD5 1cea331f8db33799c0db1228bc0c4b0d
SHA1 44d98f8a3260dbf91f52ba61d519d2a63bb99302
SHA512 8f19436b697351278a91347695129d1fad0195ceb540a4f8acfdffc1d26589837c5fcbad9edbef43a7762782a0032badf0b0328359e229eba4e862210e666e33
SSDEEP 1536:umvblAch7hCRo8OK5v33b3vjXbtKvgVOga6CBPHKFXw2/md:ueCRooagVOga6cKe2/+
TLSH
T1C3C3955063F98229F6FB7F70AAB956644E7ABC92AD79C24C2241105E4E71F90DCB0733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetDefender.dll.locale

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\it\ipc\NetDefender.dll.locale
Size 24KB
SHA256 4d1a978e09c6dafdcf8d1d315191a9fb8c0d2695e75c7b8650817d027008d1c1
MD5 cd37f1dbeef509b8b716794a8381b4f3
SHA1 3c343b99ec5af396f3127d1c9d55fd5cfa099dcf
SHA512 178b73ed00bfd8241cc9191dbdd631ae28b5c7e76661863b326efde2dc2cb438716c0b70896ee313436ccd90f61db5226a3484169176f5a4b79ead1fb4451419
SSDEEP 384:7syVo1VK5ysI76eR3KJ1M81rDGPhCMov05MQ3d:nVAK5yTb9KvMcrDGroY
TLSH
T163B2C55287FC0512FAF36F34B9F995225E7ABD826EB8C05E0101409E6E61F919DB433B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sxin.dll.locale

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\it\ipc\Sxin.dll.locale
Size 48KB
SHA256 7e885136a20c3ab48cdead810381dccb10761336a62908ce78fe7f7d397cde0e
MD5 3e88c42c6e9fa317102c1f875f73d549
SHA1 156820d9f3bf6b24c7d24330eb6ef73fe33c7f72
SHA512 58341734fb0cf666dfe9032a52674a645306a93430ebb2c6e5ad987e66ce19c8a91f3feebf9bba54b981d62127613dec3c939ef4168054d124b855a511b6d59c
SSDEEP 768:5y2lF/WFLLpAEl6Zh7laV5tX01StY+6JWgdvmBV2M3:A2kLlARh7vPJWgdvmBV2m
TLSH
T1EB236D517A00D073C5465978A0AAC6618EBE7E112BF560477FFA076E9F623D0A73E30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sxin64.dll.locale

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\it\ipc\Sxin64.dll.locale
Size 46KB
SHA256 ee05002e64e561777ea43ac5b9857141dabb7c9eed007a0d57c30924f61af91e
MD5 dc4a1c5b62580028a908f63d712c4a99
SHA1 5856c971ad3febe92df52db7aadaad1438994671
SHA512 45da43ac5b0321ddc5ec599818287bd87b7b6822c8dd6d790b5bbf1232000092afa695774cd3d9c787919ad02ca9846f7200970e273a99bfbe2aa6bebfe7e8ed
SSDEEP 768:VXHGdBPASgYoH6dzSnq5TmtzG3TpMtaTV2J8lAovrtd1tnQr:0ASgRcSqNmtzG39Mk5NAOrtLtna
TLSH
T103235B86676000B5C8538775C9F79E52EA72F4162BF1538F1638C2AE6F233D0AA3E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appd.dll.locale

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\it\ipc\appd.dll.locale
Size 19KB
SHA256 cde2a0834cb8b6e4fabda07f611567a392b2e4dc23f2fc7921f8b13e774da940
MD5 f584efd5356e4a1be69209a6a90f8dca
SHA1 6af86c8fa9c4ea0f28eca735acad675cb32b7ec5
SHA512 97c02d900a05dbb2f5ba7cd33f53d4b5c67655d0dd11d6b1c374867570dd7cd5114deb138db277480fb45e608cccf7542d76c4cce7fb5c98356a5105b309beba
SSDEEP 384:7dIRqwp/JNxmSRxyE5nIUb6ki2cP0iwfLBKyS+ShjmM6IGBkSEOV:e7yE5922cPfwnS+ST6nk3a
TLSH
T1D892C4925BFD0202F2F76FB4E9FA55424DB9BC53ADB9C50E9110410E2C70B80ADA0B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

filemgr.dll.locale

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\it\ipc\filemgr.dll.locale
Size 18KB
SHA256 3ebfed2b2a10b33af330aff197905437ef3970e8c944b7970c097ac0cbb99671
MD5 507a7b4e028d292be4ededb6b3667e68
SHA1 752121fc2f4c4814a4c50bd6964c6237fbc69cd9
SHA512 0b1fb10521512426c448a85976afe9e2e9c356768a5d2e941de022c2194a487055c3c724c08dd4abf1d115f24f80248ccd90a3655544dc17491f0373c603cfb1
SSDEEP 384:78I3ZhT+9lexj6sLU6ki2cP0iwfLaAS+ShjmM6IGBkSN:w7Gxj6af2cPfwJS+ST6nki
TLSH
T1C792D3428BFD0206F6F31F39EAF654421DB8BC93ADB9C50FA201451E3D60B519EA4B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yhregd.dll.locale

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\it\ipc\yhregd.dll.locale
Size 16KB
SHA256 285b8717038589756ed43bbefec8d010fdfda1b9726606332c1e3601cf6e43ff
MD5 4f7febe3f590f61fba281d6d48063aec
SHA1 2a978cf218ee950728452e62a7e274f0f7b0f346
SHA512 55193636f87924a75e2eeecbce50b19e7d1320698cdc58fef62dce807c0d462429d6a3034c2eb9e297012e67adfb236db91d05edc4e3514a33017cd379ac3e15
SSDEEP 384:7p82Phneq2+m06ki2cP0iwfL46SIS+ShjmM6IGBkSvA:c+m/2cPfwHXS+ST6nkz
TLSH
T1EC7207424BFD0207F7F25E75E9F654861CB8BD436CF9D00EA201821D2DB0785AEA5B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

360SPTool.exe.locale

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\it\safemon\360SPTool.exe.locale
Size 31KB
SHA256 15164d3600abd6b8f36ac9f686e965cfb2868025a01cded4f7707b1ae5008964
MD5 9259b466481a1ad9feed18f6564a210b
SHA1 ceaaa84daeab6b488aad65112e0c07b58ab21c4c
SHA512 b7b06367ba9aa0c52ac5cfc49d66e220232d5482b085287c43de2ef8131f5ee703ffeb4d7bef0e5d9a430c0146bb2ab69c36174982184a0c06e6beda14e808b5
SSDEEP 384:7baacsultAgwBAP3Excizfb5pei1QcMCPHz7eMKw8n:at4B23ESYf1Mi1+Hn
TLSH
T1ADE20942DBB81081E5F25F39D6B386664D77BC279E71C24B82907E4E3D60F926A61333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

360procmon.dll.locale

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\it\safemon\360procmon.dll.locale
Size 106KB
SHA256 51475f2fa4cf26dfc0b6b27a42b324a109f95f33156618172544db97cbf4dddd
MD5 7bdac7623fb140e69d7a572859a06457
SHA1 e094b2fe3418d43179a475e948a4712b63dec75b
SHA512 fbed994a360ecff425728b1a465c14ffe056c9b227c2eb33f221e0614984fd21670eddb3681c20e31234a57bfe26bcf02c6a3b5e335d18610d09b4ed14aa5fb2
SSDEEP 1536:PORhlQF+MAfKrUB0FHg/S9VCJg/KJm4F9bfKJuw8AHu4+jSUMk8mA4Y8YE8RlE3e:POBrUC4jyUJGKzgSg+Yco46Fe
TLSH
T184B34A47AB61C986DA705F309863D4513E35FEB6FCB8D44F2085328F58B2B1192E6B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Safemon64.dll.locale

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\it\safemon\Safemon64.dll.locale
Size 52KB
SHA256 129a7ba4915d44a475ed953d62627726b9aa4048ffcc316c47f7f533b68af58b
MD5 a891bba335ebd828ff40942007fef970
SHA1 39350b39b74e3884f5d1a64f1c747936ad053d57
SHA512 91d1b04d550eda698b92d64f222ec59c29b5842115b3c3f1159313b620975bc8475b27151c23f21a78f60abd6c7fa9ce5cb1ea45f9349942338f9bf0c8cfc99f
SSDEEP 768:O3v+tnPKY4PWWYzpnD9UT1tFGHXjpjqdV9/rfroLoZeNMXN+6Ampc:9KJSpD9+1tFGHXt+PtrgINVni
TLSH
T11933294563E50079E5A34B35C9F39E52EA76F8072BB5938F0624C19E2F337909A39336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SelfProtectAPI2.dll.locale

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\it\safemon\SelfProtectAPI2.dll.locale
Size 21KB
SHA256 a71e57cafb118f29740cd80527b094813798e880de682eca33bfe97aaa20b509
MD5 9d8db959ff46a655a3cd9ccada611926
SHA1 99324fdc3e26e58e4f89c1c517bf3c3d3ec308e9
SHA512 9a2f2d88968470b49d9d13569263050b463570c3cce1b9821909e910a8a358e64ad428b86095a18f596d2b3ed77e0e21d40f9c24543e4a0872e6b35c5103bede
SSDEEP 192:7PEyLnAYEFPrQP8tVku+pdhh2eryHU8/7X8r9ZCspE+TM4rSEZsBHUckAwmTcViv:7iYsPVI70HVJeM3Hl7VLQKvrfpMQ3vmc
TLSH
T1CBA2B4468BBD0002FBF29F38E6F5D5675EB6BD827DB8C58F1111818D1D10BA02EA472B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

safemon.dll.locale

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\it\safemon\safemon.dll.locale
Size 53KB
SHA256 110914328d4bf85058efa99db13bfec2c73e3b175b91dfd6b41c6fa72ebaa103
MD5 770107232cb5200df2cf58cf278aa424
SHA1 2340135eef24d2d1c88f8ac2d9a2c2f5519fcb86
SHA512 0f8b98ded900d9421eb90cffd527d8218b14354d90b172d592c4945c482191d5e512f2678217c6214addb38da0b9bb9287f84963a50447cf232962bd99b0c3e8
SSDEEP 768:fCG11xWF7Lp/El6Eh7lKlI019+6JWaeNMXXbBA0bg:KGa7l/8h7I7JWpIXbBA0bg
TLSH
T15C333A4076D08033E1A75A38A5B5C6608E7E7D122FF4905E3FB5426E5E717E0AB3932B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spsafe.dll.locale

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\it\safemon\spsafe.dll.locale
Size 9KB
SHA256 61c130d1436efba0a4975bc3f1c5f9fdf094a097d8182119193b44150344940e
MD5 22a6711f3196ae889c93bd3ba9ad25a9
SHA1 90c701d24f9426f551fd3e93988c4a55a1af92c4
SHA512 33db4f9474df53ce434f6e22f6883da100473d1b819984171356eeef523ba534c4abaf2536596b8758358e755e5d9f3793d85be12d2d8d5284fc7d13f6c005cd
SSDEEP 192:7LyM4ZuyMrj1grjzR+vnr9ZCspE+TMAr3o7hu:7eVzM8z7eM97hu
TLSH
T10412E9834B555042F9910F70D2F3C2529EB8BA533EF6A1AF9B61809E3EC1B102B5577B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spsafe64.dll.locale

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\it\safemon\spsafe64.dll.locale
Size 9KB
SHA256 9327e539134100aa8f61947da7415750f131c4e03bbb7edb61b0fab53ea34075
MD5 5823e8466b97939f4e883a1c6bc7153a
SHA1 eb39e7c0134d4e58a3c5b437f493c70eae5ec284
SHA512 e4ea824314151115592b3b2ad8cd423dc2a7183292aa165f74f8e35da4f142d84d296d34506f503d448c7bd423be6bf04da2412b7daf474fbf4ef6a2af142bfc
SSDEEP 192:7VCMqB8x3yMrj1grjzR+vnr9ZCspE+TMAruNNNQkG:7cXyCM8z7eMlVG
TLSH
T1D912EA834B550043F9910F70D3F3C3529EB8BA537EB6A16F9A6080593EC5B502B5967B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wd.ini

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\it\safemon\wd.ini
Size 8KB
SHA256 b0a2dd51d75609b452a16fb26138fb95545212eb6efa274f2751eb74ccc5633f
MD5 47383c910beff66e8aef8a596359e068
SHA1 8ee1d273eca30e3fa84b8a39837e3a396d1b8289
SHA512 3d307569452ec6d80056a3a2e0225d559606deab9a6c3913c1fef7ed6aca476d7a00190b1bbfa3d032411c2f52427f3096fce7b7952479ad9b75aa3cef59d7b0
SSDEEP 96:ra9kZ7sqnvJDgTBiYK/y2lVl5ENqWIajuwapG4i8nc6WSbJ1J9Wd6AFWbmc:29+DgRgizMG4i8nxWHFWT
TLSH
T192022DAF2AE94125F6F39B45FEB508F55B3A7C42692CCC9C11C216494CF2A00A517BFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nptswp.dll.locale

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\it\safemon\webprotection_firefox\plugins\nptswp.dll.locale
Size 10KB
SHA256 09d58a2f0656a777a66288ac4068aa94a2d58d0534328862b8371709eab2003b
MD5 5efd82b0e517230c5fcbbb4f02936ed0
SHA1 9f3ea7c0778fedf87a6ed5345e6f45fb1bd173fb
SHA512 12775c718f24daa20ec8e4f3bdede4199c478900b12addcb068ae7b20806850fdc903e01c82e6b54e94363725dcff343aeac39c3512f5ea58d1ba8d46712ad33
SSDEEP 192:7jp0kvNyMrj6Pu7CrjzR+vnr9ZCspE+TMorCxu:7jpJMMCPHz7eMtu
TLSH
T1EA22F7834B985012F9D10F70E2F6C1539DB4BA537EF9A49F997080DE3E86B601B1672B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dumpuper.exe.locale

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\pl\Dumpuper.exe.locale
Size 1KB
SHA256 87c1dc55f5cd035c6d880d14158e0dbcd193d69cc331001ec456b5b8dfc1753f
MD5 880e5c62a78e5d11c9510f0a0482cb88
SHA1 e3b8b36176063545f3ece610851c4418bca6a55a
SHA512 30ca326a95a37873dcab2f15edf69fd80cb6d35fac4501b23e3c8593634eabd0851ab33cf23bc16dfbeb83047db30d9cacf57465af564dbd97eb37e7aca181b1
TLSH
T165314C1177FE1428F6B37B409EF685A4CA3B7CC69AB6C22F25A4421F0DB0D518562373
MD5 SHA1 SHA512 TLSH

Submit Download

LibSDI.dat

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\pl\LibSDI.dat
Size 113KB
SHA256 f511a0eea52cb982c60ec2a8758007a8d83f8a36bb4b23b27e320cd9441862f2
MD5 552dbf3af7b5615f2c7f5a0c64e03ca3
SHA1 a6773abc443d8ce49c88c1554bd7a4196189c614
SHA512 64fbe41e296ef5d94cd76496623cfa4f49f0bcf1da4f1a172320b81dc344dc94112d3465fcf1b4df2166746cec8484f2d2f1b2d238dc11eb82014b70ee31ce83
SSDEEP 3072:jHUDSlMiffBSae95WGeDZk1FNtQL5HDrL9Qbd:jHUDixp/eLW1MLtWjn98d
TLSH
T1EDB30246F00FDA1DA322EB37DC29ED2871C79A401F70A93AF257EB52A289D5DC35141E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaw.dat

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\pl\libaw.dat
Size 1.0MB
SHA256 3d1b69b19a8510d6176ceb011b71d79859c13d4c61541ec7174f344d3a77bb24
MD5 dde9f4e1fd3c706361cde23239baf8e6
SHA1 646f69dec3656fd19579606789d258fef5a45e96
SHA512 536baf039072c6e6fd1ecbece3291c9b1c5ec01d8e41837bf285cf59015b1212a3283fe85b5d52d7a4bc16bade883b6cca3a94ce40788159a6545a6880ce7609
SSDEEP 24576:LMMmJ6pODUATD23jo3sANYM9TWLrB8B3phpc0hbB:86EHD23asANYUTW5q
TLSH
T1E735695B3B1FE08CC02A2F7740370B1A632697942E204597666B5B38EEE51D42DB37DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libvi.dat

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\pl\libvi.dat
Size 790KB
SHA256 e00a185464266fdd988edb2f4bd130b4ebdce7e064fedb45806f577f1bb19291
MD5 e799b79b1fe826868265dce4c8a6ac28
SHA1 44af1a3fe155b4ac2da06371a351d056441f409a
SHA512 b740eb8c8b4a0b1d5d09da0b3e4d65ab2611bfa83cc97a8b38e419fb9ae975e974738fbf4fb73406c8b3e473d2c092c46126aa6d9aa1525baf41d632d5ae3e77
SSDEEP 12288:c/nCExkRpiJhfKNJhhD5PpS1t/PUTmuisxaA8F5f7:mCExkRgJhfKNJLhctnUTmuTaAQ
TLSH
T155059D93A798DC15C9480630C827CBF402379FA9FD94568B75B67E3B3E772822432676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pic_01.jpg

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\pl\safemon\CameraProtect\CameraGuard\bkg\pic_01.jpg
Size 109KB
SHA256 a66eb91ed6129682ad3b3a57f10a8abf45000062038abca73a78db34c6d66cae
MD5 95ed89bd379faa29fbed6cbb21006d65
SHA1 9ada158d9691b9702d064cfdbd9f352e51fc6180
SHA512 4e6743dff36966592f07a214d15afaeade02b31b7257f5829882ec00ed91dcf3fb2735c5c1515ce1192994a46d0e58b4e4260a965ed8d225b3bd47034289fc27
SSDEEP 3072:mFdSHSxhiAL3EUfbErphi7CkMmn7ciggsS:mFMyxhtjEEbEFOC0nsS
TLSH
T17BB3122981774CB404C32FA4BF9F99412418EF67FA5B397CB415F23977A0A5E9C3A025
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UDiskScanEngine.dll.locale

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\pl\safemon\UDiskScanEngine.dll.locale
Size 17KB
SHA256 649ca00ba71a5f725ce94baaa4996a8c202103b1821a3529e84c20a8d882d35f
MD5 045e32511a0e333477ffc2361c3b589b
SHA1 47eeacaa6381ba81e90a78dcf67c327b9f17814f
SHA512 3693769973d463664d5486a22ec42d8ea722abd3998ab5c6dec4a7656411bc90fa3b58a0c01e5117840c2e8025ad2ad9f81bc86b58635ef22cc267bb3781624e
SSDEEP 384:7v4B600ZdPYeBsI7nOSeM3bjhEoz2DDMQ37s:b4B600ZBYwTrv+ozk/s
TLSH
T177822CC70B3C1403FB828FB9D1E6E6135D74F6C16EFE848B602682543E557A13B9962E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

udisk.locale

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\pl\safemon\udisk.locale
Size 444B
SHA256 254161d567ed1ae96756809932715790f4bcc5851eba123bfa6942b2b2d1eb1f
MD5 2e58b2b687db6fb6cddd3bdf2a875ffa
SHA1 f4d700de450bde53877b824a1021dfd9b52f045a
SHA512 258f10fb5f61ad672edbf2d719e365e1dadd3854f8ae8abf4005b70324ddcc9cf2c5aa9156bbd9204326d72bdc1b203d2caf06970b177964fe248c2d90859154
TLSH
T126F06D3335EA005CB3736B919AF682AA8E2DB9E1051845AE009542231BE1E32CA53677
MD5 SHA1 SHA512 TLSH

Submit Download

wdk.ini

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\pl\safemon\wdk.ini
Size 2KB
SHA256 a7883c05518f9d1d2af9773f19f470b25ea94a865fb4d43b9e16518c3434424b
MD5 3997a6acd6764b3940c593b45bb45120
SHA1 16bd731772fef240ec000c38602c8fcc1b90dff7
SHA512 fcdc2f450f2771174a71acb49663f2de8cd02eb131c1a95dc83ed59d0dcbe676129e960d3fde5d1cbd9d45ff3f7299028827c8806d867fb51925e41a2c24a2d7
TLSH
T1405162C377E5A104FA770B59BAF424F64F7E7DC63818CD5C02D2068999F1A408A722BB
MD5 SHA1 SHA512 TLSH

Submit Download

appmon.dat

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\tr\ipc\appmon.dat
Size 30KB
SHA256 c308ee41e48cc498c396a2ccbc57b7d29d058dd145f9867887544cb74112d63f
MD5 ddda5be2e45d1c5229cd561a03825908
SHA1 d9207564dc229c9a05d9a7baf8c7e2d17c62072b
SHA512 b16a67086a9d435ca17e35c7effdb639cf934a8671cf9f99f4e8f6846ad7e71be71aed3bde77a63f3189c155391efe5287589cf6332dc8be02e52c90c924efb3
SSDEEP 768:drQ8ffdzS2KN1gQxCFeWTuIoR7HBssluEqd8Knq:e24N6QckWT1O4q
TLSH
T1C3E2E10A2CFAFA4ED8772276EA968FC0DF74775E2900C5748086654E847C39DDB8DE21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

filemon.dat

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\tr\ipc\filemon.dat
Size 17KB
SHA256 a3cfc3c8f95f0ed56306d28ac87408f10875c43bca7778c6e1cc18c7a3441183
MD5 bd29091ba65b3fc08c79654997b4c82b
SHA1 3b353ec41dcc96d898715f6474656f13931c1b61
SHA512 ae64dae0e4025968bfb14e57c2faab0c9da39943dae9c884cbbd940433b29613c090b98899db847c94b265f969a6ed3cfebff35af284ca9619e6e25937067650
SSDEEP 384:5vHP8qNfXOKM5VHblx1qhvmVqC7exscB3neUvESwTPprqWPQTUDnwENL1c:hHP8KX5M5VHRivmsCescReUsZPqid8
TLSH
T14F82D15BC80A1FECCCE34B71357ADA5D89AAA09197978351487C18733ECD4930D95DA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

regmon.dat

Path C:\Users\Admin\AppData\Local\Temp\360_install_20261027064846_240834984\temp_files\i18n\tr\ipc\regmon.dat
Size 32KB
SHA256 dab50e3c2787808beeb0b377ad7c3de2c518578b9f7a4ec4ac29063d59c00b3d
MD5 f507c8db8f8ec9361f36608408c9939e
SHA1 f3915edb67fc281dde5657b383e3a5aedfe96bb8
SHA512 cb09e4f033b873211bfa8b8b82fa207ea5c176d8d686487c2253214f5f965734d2a16a04ae41b849ffa20b3b03814714274b749f07dbc28a0a5676a86630feef
SSDEEP 768:mqPy0zBxmlBLCxBIZuPVOWdT0bQUu9d2+8Pc1fCrGrP:m90nmlBLSBjt/T0MUu2ofCrY
TLSH
T129E2F1618D06806EC782A3B4D74162F8FFFC6AFE4A68C5EE445E064AC85573ED0C0E52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YandexPackSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe
Size 10.1MB
SHA256 ead7a779cabae642d09be07283cc99e53c84ecf90349444e0d0ac4bf9901fe47
MD5 3fb846d3691f3d98a34e669e1b9b5bf6
SHA1 4c90c2912aae3b8da4c44a4faa0b8df20525285f
SHA512 e904ecfa7b1c9ba066272bf91b8341bf3877310613370defabee7db58ea825c52582353e97f9398d706d3f3890b3701a1c05fe202e8a87499fb9600f87176b3e
SSDEEP 196608:Ddad4T0xcsSB5orrcbSsi0s/lmPJ7N3VvXWrqufezvq:xadCoXrlAJ7N3pXW2uGzy
TLSH
T10AB6D001B752C0B1EAD101B116BE9BBA487D9E144B3189C797C43E3DD9322E2673BF69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS047D2109\installer.exe
Size 9.2MB
SHA256 fa1023f728eaaf0fa53b6b75813295bc376bc6a96c3ecf7829861bf4bc1dea59
MD5 9ea3b0ac1d0eb4cc9ae5d42fe1d2910c
SHA1 509e002093e5c9e1e2b57ae139276bc6463b98a7
SHA512 ffd7cec8387a520b8ad5acc1113c34819ec2f008e5369021fdad53ee667abd5f5f1ce6936f050ff25f1fe7227383b2da1e79ef871c3b0edc33f610d935c4d0dd
SSDEEP 98304:9vx2ngpeGjea4Lh2IRNJKpqDIDtdSiTcEzFBI3++wteEmM:Rx2ngMVaNuK3tT83+BqM
TLSH
T112A69D53F3A611E8D0AFCA748B7A563299357C464B34A3EF0A943A250E75FD45B3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YandexSearch00000.log

Path C:\Users\Admin\AppData\Local\Temp\YandexSearch00000.log
Size 133KB
SHA256 530c4d1e87cc689a770c6a5b892f2c995052396acb804f005b47a605b6a37179
MD5 749c8fb82b8613b0129d0e40f4e89422
SHA1 0633c5d5e4b2bf0289b09056a1c929a6f492b550
SHA512 2c38252d4bb749d5505049ee01427e9e8a4473cb274214390b13443b36136d2894c0f96de806a97ed8126e525bee24b83a54a9d098e6aa3157365fe05ba975ff
SSDEEP 1536:9LpXXHRoRDVaiRckrrD2aNql4xQr5OPh3Dun89bQGPfdbU2nIA5SRMJS9d80kxD6:9s3NVWXstQwjpqaI/D
TLSH
T11BD3392A6FF40016F2B3EB475FF348725A72B9696D35880D60C2870D45B1E049DA9BEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Roblox manager assist.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-I8ORH.tmp\Roblox manager assist.tmp
Size 3.6MB
SHA256 9bc4ba34c403ac68461d526f651476ca4275bfc52709df565dc7256a3c41fd51
MD5 57dd05677f60dc04dadcf6e516d0fa72
SHA1 90e9bdee76ed8921eea4720fcca642298fefc7f1
SHA512 ac13d0835035b0fe598cb6173d858810b8a780366ba367576d89d57d3064f72549d74fee51bf9adf2576b5c8ff80c45be44f2c1ded5ec03a8e5746ee0d3f94d3
SSDEEP 49152:Q44B+lNsHPWeelGdwSxQRw9CuL0wijepA8oGd9Tg70azpkfa333TDE9E:fIPp70wijepoGzgbAa333TB
TLSH
T180066D13F388613ED05B2A3B693F9254583F767039178C579AEC3A8C4E795802E3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63bdcfac001ad18626d4adad4ef7e863.exe

Path C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\63bdcfac001ad18626d4adad4ef7e863.exe
Size 839KB
SHA256 bfb34635f295df13ea1677c0d51d08fafd2da21a1c0bea252df6342d40e511a0
MD5 a5efe54df4f28f6d12adf840dc931b36
SHA1 dc9f5baecfc6cb27e8fd3ec56faafa1e007bf743
SHA512 274fe37ae37397efa5425759bc55d6dd53fcd1b76c1472d8d952ff4bb72f5c8ec0f0f28a712e350a2025292851e483f7334463cf2920388c81b238223c9e434a
SSDEEP 24576:fIgB4BNEPZ0m2uTH35dmvTAQkWUnNwjiKSYOojDuR1uwe:fIfBNM2uT5MM/xejJqe
TLSH
T19805AE127BE5D0BBD2420132CB1CABF591F993680B2148C767848F6D7B359D1DA3AA1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6633f7704b88b40f42e4d36111c74b98.exe

Path C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\6633f7704b88b40f42e4d36111c74b98.exe
Size 19KB
SHA256 a6967e7a3c2251812dd6b3fa0265fb7b61aadc568f562a98c50c345908c6e827
MD5 44b878919f79e365120f1c960434870b
SHA1 c8131976421b07782a1c913eb5996581a277e047
SHA512 e9fd65eb9e01ec40d67b558e3a4be4ae24766436ed8f60b62e75cef07f2f983b3df4d7963f23d23007acee12f151359d7d3861663348ef2b360e14a84bf3d2ee
SSDEEP 384:2nxXQUwHGV3NeGDVx9JB2zM2tTiB3pB8uRP:2nxXVwHwxD39JB2zyZ3d
TLSH
T1CA924B64A7A94921E5BA1E789951442383393944883A470F370CDEDF3FB3291ADA4F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7453d4a20ad5b3642727ed1abfdce372.zip

Path C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\7453d4a20ad5b3642727ed1abfdce372.zip
Size 203KB
SHA256 1a842c5f1b1dff48eafb7b3911046cb601d072cfbf570d40436f1d38a770f6ed
MD5 8debed9b0369b338d888ad43ff6e2f47
SHA1 93b67ff791af9119bd8899176527283925681a09
SHA512 12ee798f459f8dabdd2e4b698ec96ef802f7308cbe8022afa9fb0329ef7207a43c6d8c616ad00587c6dcc1a77a2648aef504f20780ffdd92472dfb3df481c1a4
SSDEEP 6144:SQdFOAmTd28AWGVpFXoicSSfWOYOBRxfFMx/1:VfmTF4uJWOBL9S1
TLSH
T1BC1422EB1D50C265651F69CE26B14DB256F0042E3B4F6BD723827B8AC3A6774EC82934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dly.exe

Path C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\dly.exe
Size 203KB
SHA256 c60c3a7d20b575fdeeb723e12a11c2602e73329dc413fc6d88f72e6f87e38b49
MD5 b9314504e592d42cb36534415a62b3af
SHA1 059d2776f68bcc4d074619a3614a163d37df8b62
SHA512 e50adb690e2f6767001031e83f40cc067c9351d466051e45a40a9e7ff49049e35609f1e70dd7bb4a4721a112479f79090decca6896deac2680e7d107e3355dae
SSDEEP 3072:IWF1Sss2XaOvu+v7QC2mCAbtoJOBW0rArwrkut57cIrDjy6Hy2BKbY64IrHLzMxI:IWF0+XaOvuyycWNrwrk6y2ZJIrrzr
TLSH
T1DF147C2175C0C432D1B3193059F5E2B02ABCBA700F758A8FA3985B3D5FB45C26626BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e715e691fa7ba4188c4e96a1456b99b9.exe

Path C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\e715e691fa7ba4188c4e96a1456b99b9.exe
Size 1.4MB
SHA256 14d1e6b291b6b191b7115580e40c25a3d32fcaa7f7782ff875ca75531a427c17
MD5 2bd69902e8200ae3faeded0a80b0b48f
SHA1 7fb1920f8c1c6c8a05229b8b8d45a2a2f8741308
SHA512 06b4b0116bb3716909da1bfdef388ebb234cd74228c3d93a5f7fef6e0ad75cbc895c4d764b72f2b55fe88e90c9c28cc9e58bbc345cedd4ed8990014d5f0e31aa
SSDEEP 24576:XL/7n6lbcC8oblp1zj1SqdAGFQZIxBC45UJoePh:36+C8o5HzjYq+ZIvL5UJoep
TLSH
T14765AF0ABBEA922ADA736574DF3582655E3BBD400711C7D7A2E03A094F34DD17D322A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eae9821fde6a3d3a15e070223c196a07.exe

Path C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\eae9821fde6a3d3a15e070223c196a07.exe
Size 4.0MB
SHA256 c160879b60fb9308052b9ce3358dd7baed523f9bdfbb622778f38c57b4ab6007
MD5 b0c86ee14d036af4daccb8c96b25ffe1
SHA1 956c3a2eac3f0348503d082492cfdf4cdb65ee1f
SHA512 33f49f712748c4e15e2522dcd21ce60091fbb16f55228bf056fdad52d2c8f0c4835a7b1f4fbdac07d38082087a8d0c09dcd68032869675341a78bf4bec8e0b4d
SSDEEP 98304:6A1K0gwkdLllHPT+rxB9c2mDkfTOKtZXYjPKXEaaHxG2PUmf9M4WI:ydrYxB9OkfT7jXY2XEaaHx59V
TLSH
T1221633257B858076D5A325324FA8FB6D9A3DBA741F62069B37C81E6FDF30181A530F42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gamesi.7z

Path C:\Users\Admin\AppData\Local\Temp\is-PV4AG.tmp\gamesi.7z
Size 41.8MB
SHA256 735dbe1656277125aeb4d19c458cf535a3c835452f16e405fcd478515f64bf06
MD5 0382be4c44561fb7f6c6c8135320b2e5
SHA1 d9e26b7c5d2efd98707c86c070e96c459480cf66
SHA512 bd6ede670a058d316e4e788c66db1bf2f3c7193027c5eab7c5cfe24fbbefc4ef0a805376551e8a138d93afe032c89a06c1427e00d90949ae7530d7b2060df615
SSDEEP 786432:iptZmFXJuwBJUozaOW3Ufv9hjNq7s5afqBvQNZiJ4pr9:ipzaXxJUoXdv9h5q7s5aSQ
TLSH
T18FA733825A00B05FDB707F358D36A56B34A27A50BBBFC149D70433F814AABB17A352B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 11KB
SHA256 39bc4689f2d74dfe4056c2ba7a132a9f66543b01b09c18666141d91d77422ace
MD5 3b8cf53be31c79f09e845e66aed2133e
SHA1 349e31803ab82fd863860867aff46b88b1e4329f
SHA512 26cdda353fa588b889b48be5074ea11e44eb384060580558dd742d250ba3f5fd25ccf789ef91dcfe5988e8cee3660454ddaa3cba13e908c1f2d39b4207d4a73c
SSDEEP 192:r/8vKqX+85911te8hI116qzhIKxzeYpJGkjtsfr3F9QMN4RERRRoR4lvyiO0D1fC:+KqX+85911E8hI116qzhIKxzeYpJGkjh
TLSH
T1FF32B0423A76F57936DDB2E8B07D2DE25C95349CA10859F6E6CD87A108FB2042C3F19E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 15KB
SHA256 7666ca04696dec4337437dd5b018fb920b03a64ea3b57c3787b426b1df0c49bb
MD5 dbce3ddd190dae1585137eb76a6bccac
SHA1 fe3d56b8a06cde3e30aa59f48db2775ef52e87c0
SHA512 6f930733c77ee5709e7ee9bcab745ed9345e52bd98481c545e52e21221982eae15baaa0ea271460a4b2a6f1bfb3d637e20ec45200997e495f58c1fab05614691
SSDEEP 384:+KqX+85911E8hI116qzhIKxzeYpJGkjtsfr3F9QMN4RERRRoR4lvyiO0D1fJTKLc:mu+lzh
TLSH
T10562D2413A76B57936DDB3E9B07D2DE24C953098A11C56F2A7CE83A118F72042C3F19E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

master_preferences

Path C:\Users\Admin\AppData\Local\Temp\master_preferences
Size 542B
SHA256 0325fd8be2634b3b8fd40c2d7900b7816bc4cc456ed1b708d9b1f0ca1af4853b
MD5 eab7dbafdb0a88e2963d969906f76a4f
SHA1 c048162b14ae21361e6e4c3d665f19ef1719c49b
SHA512 9179bef77b1b8bce884558481b3e711cc3c08f15f236306298649c3d5b9665e0c3f222ec96349325c13b029a1d97c0b44e6cde56f88feeb45e160f101be1d4e8
TLSH
T1A8F0E917C152BCAB04F6B7E078791696E94187734051AC353CFE102D1F3EB581285E6D
MD5 SHA1 SHA512 TLSH

Submit Download

omnija-20264727.zip

Path C:\Users\Admin\AppData\Local\Temp\omnija-20264727.zip
Size 45.1MB
SHA256 7d5072b7fa0880c245cb54a627474b67df7b4f3f33a7ae828b39417f9621eef0
MD5 e90fbef1ee0ca14a0e36139114dfdb03
SHA1 eb9ea0e98fd72b7b049b193fb94ee8d864101305
SHA512 eec962d4fdf6bdf8a236ef2bebc579e7815469b22e02d4362da865ce20c81b231e41d5d43b10c4f52f7d3d4651293f508d2babc6fea967cdee5dc5004fd27fa3
SSDEEP 98304:GsHE6AKr4JCwEnjKq3EOriDGAIGPEJUgCmubWaJEc3yQBT90oBXborXmtYOJ5vsr:d4JCwsuqUOrFAIGPEJUvyarOsXXbi
TLSH
T1E4A74B1AA3F6117185936079AF5F6041F635801B2419FC58BEDC83AC2F8D53D82FABE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vendor00000.xml

Path C:\Users\Admin\AppData\Local\Temp\vendor00000.xml
Size 510B
SHA256 1a855972dc308e47d30d567e1b37fdad349bf555b971bc14ead76e17a8accccc
MD5 a96e6071a17b74bbd309bf696496b8f7
SHA1 63c1ecf860504d390b6f3a32982ddd8946b042c5
SHA512 2c906e2f11d62d1336be482cc5ff784bf372cc7afb3263754e7810a1ae27e253aa9e22463456b62a25049d33ba1e69f129ed7e0a0273fe928dcaa216b7876449
TLSH
T134F06C01448CEA117FBB471DC23D5AF5E6D43E0607A02E8C7155E763F51223713183B0
MD5 SHA1 SHA512 TLSH

Submit Download

360P2SP.dll

Path C:\Users\Admin\AppData\Local\Temp\{0DE38D61-BB92-4fcf-B113-63C6E824ABC3}.tmp\360P2SP.dll
Size 824KB
SHA256 bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60
MD5 fc1796add9491ee757e74e65cedd6ae7
SHA1 603e87ab8cb45f62ecc7a9ef52d5dedd261ea812
SHA512 8fa2e4ff5cbc05034051261c778fec1f998ceb2d5e8dea16b26b91056a989fdc58f33767687b393f32a5aff7c2b8d6df300b386f608abd0ad193068aa9251e0d
SSDEEP 12288:HZcohgVGBmUpL8XOgh6LaISFP5FF6snXcscXt5KmR+M6Pt2H6qXco9TGUc:BYJUpL8sFXGmU7t2aq59Ts
TLSH
T1AA059E41E7CD8171E6AB26B5447AA31A9639BB55073087C7D380AE2ABC303D1DD3A35F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YandexSearch.msi

Path C:\Users\Admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msi
Size 9.8MB
SHA256 b2fda5fb2d8e65fc0448d308647d8afd1e4ecd7bff0103ec3700e0798a7db0a3
MD5 561f202d40eb1a21aa947b2b833f6928
SHA1 b48e2f49a416847aa9420ed4b360841e8c28f67b
SHA512 66d172f336ef0b4790e2141711f205682a0ba6ced8d03f26e33b54f6ea1e29be10d387e843df26d1110559888b09a3cdf9198ea40f17ca9d2ac1872c1da82063
SSDEEP 196608:Odad4T0xcsSB5orrcbSsi0s/lmPJ7N3VvXWrqufezvqm:CadCoXrlAJ7N3pXW2uGzym
TLSH
T1A5A6D101B752C1B1EAC101B116BE5BBE487D9E148B318DC797C42E7DD9322E2673BB68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbsv1.json.tmp

Path C:\Users\Admin\AppData\Local\Yandex\BrowserManager\data\SeederTasks\thumbsv1.json.tmp
Size 40KB
SHA256 05f084876ed64f4a2f461dc16b37b2a67eee3a0beab378e73ef213f59a96650a
MD5 f306c2ae34d5ddd7ba8a11a01263dc00
SHA1 4b861c15b876623a7b13b88d101ce71b5b01244e
SHA512 f51e134d7d23f44fb1c22402e7ec7e3d31f499fa43a6c7e840b6a5fcc35ff284093e59c9979253e1d597c204de1288b730bf1c8265a5a711d7e8562b630160d9
SSDEEP 768:kCrri6o1+waaEhjE+aDEQoAWMRzqcFf60sY4zAvtscbgxQ/JIFSOQAHxr/i:kgu69paEq+aDEFAWMpqcd60sY4zqtBgW
TLSH
T1B113D071B3B38E1D06454D83988B3AC3BC3529B7A7DC98F8751C19AB77D1C84CA39644
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Yandex.lnk

Path C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.lnk
Size 2KB
SHA256 a3e97a3b74ee5442a74d0447e1cd1853011f27a496db66ebab7b3814de7f1729
MD5 07d5110662759cd3438c2fbe7a12327f
SHA1 c917fc6459fd0221fc3ffc992330163062503421
SHA512 621612e3ca0958f9409c16836f0d96bc94ed9f69e16be1daaa8ae87e8cd35fff39b8fcfb8cda10fb07f7125b98dca8198bbb2cdecd76d8e98517923b35e367d9
TLSH
T16141B805BEC71320EBBBC276D9FF5A24967EBCD193411D1C028496890C66B856C44F2F
MD5 SHA1 SHA512 TLSH

Submit Download

YandexWorking.exe

Path C:\Users\Admin\AppData\Local\Yandex\YaPin\YandexWorking.exe
Size 397KB
SHA256 8c4be5f1bc4e2f73d4396af48a31bf10362006472e9b28f40aa91f73a3815f12
MD5 95828ee007d3586792d53ace50b2357e
SHA1 3501ccad7573fd467911f207155318db3a1a1554
SHA512 9896eccb178fd772fc92e5793340bdbc1bd6169465d9a739df06c1154edbce16f6db5dd50df426ccbc40d8410d4ef170c3fb0bc700e7778149ff2168409638e7
SSDEEP 6144:7QxmdQLSyrmXPU9ysfKTu9uf1aatAOE8l+1D3ra0npjdt32:cxmdQLSFsQQX9ktm8lkThnpjdtG
TLSH
T12D8439D1B591C171D1BE0531C4E8FBF245AEBD244B644ADB67843E2BBA303D1A931EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Яндекс.website

Path C:\Users\Admin\AppData\Local\Yandex\YaPin\Яндекс.website
Size 515B
SHA256 63f4464ae0f761014356cc2530546aa2cc43b69becedf73036766e1bb4984d36
MD5 c7a919a9a8420ce365db93714033ad27
SHA1 0d0a2b29188dfa6cc41c650ce0025cf1da4a80fb
SHA512 60dfdcdf00a3f9ab7bd9e2a2c11bfbe2587c9ed570d5d79fafaa7570dd95adb02709867fa1c66cddd9cb9f69510fd1b055369f8f46b94d930c6750e8df85eba0
TLSH
T1C7F00E14C0AE403DD095D1473A38FEC4880B34163EC5DA39829BC8ACFF890948808A11
MD5 SHA1 SHA512 TLSH

Submit Download

Roblox v2.4.0.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Roblox v2.4.0.lnk
Size 1KB
SHA256 48fec2d3057a4ac56c252ff5ce7dbac641e3e1afc0003cfeb57675cf51ecfacc
MD5 17662bed1633fe5e49288705db92da9a
SHA1 b256536aec86f80097a6c947b685accea3fdd844
SHA512 fb6cc8844d5581756db8104ad1e2d29f737f60065f1eda4ebc6eb3736b0f8920639a385fba6638b136a302f10a9f542941f9e8f4d5d887498e36361920dda28d
TLSH
T1AE21004C9EDB0B1AF2FB84392AB7B756A277F446F7060F4D4084638A1C6E641A454F4F
MD5 SHA1 SHA512 TLSH

Submit Download

search.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\search.json.mozlz4
Size 3KB
SHA256 13876de49757e17d901ffb034c0e29b9e4a35285ca1a4f1b9e4310dd5ce99c3e
MD5 cbf090d5cdffb66e07c0e883b95c164e
SHA1 f375f33a0416249b0905b08890b5d6609bdb9ec4
SHA512 de67644d3aedcc84e6d211070097ceb0686da8705d51e94aac3178606cbdf13bfead068ba55cf40d1daea5c91fd28db72286c26218c903d0f664cdabd7e52e94
TLSH
T1F2615A495E09FE335AB93B57B50B289DD521F8322D30ECD5E49EBC2036AC2A03B8405A
MD5 SHA1 SHA512 TLSH

Submit Download

places.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xlhu326a.Admin\places.sqlite
Size 68KB
SHA256 90592c149dd39964633c5efb0655489a60649d189f42f35a18adb5912df88092
MD5 f163a9e135f15473f668b18d3cda3647
SHA1 77dd1a97640f2180fe905cef1f138a519d25a43c
SHA512 b76006ff1d80f51048682d2fb83d8b3dded1fc7f391c3d649a07dea106d9230d88038dbb50c88fa62128ada8014a40736bb4f86c2b814b2e76f9b08f1deab83c
SSDEEP 48:TV6UcMtYJqqEgbEwq3hF+gBNxw2BAl7FdickdaxKvvGvo/6xNfzhlz+ULTF0LoVF:x6HkTBB2ljgv+wSx9zv+ULaLoS0
TLSH
T14C63219B1A342121D8EA91737EE2506E493DF13E8A6775913DB010B2DCA1D62A17C8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
Size 40B
SHA256 5fa694718fd8c36682c93fde5dd6623cd5aa62dadac89d8be6bce524a761f40b
MD5 5044e7abcef0e3cca38955c6b3ce5ed6
SHA1 dbb55f940d93b716c1af8a524c34e0856f04d3d3
SHA512 2484e31387862787cc09ddf71650d64907408af5202a36ef4c37f71d90f5f288e7c46b578bdaa0c4aa94430868e2ca1d02d06e5193cd0529bfde160701c2070b
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Code Cache\wasm\index-dir\temp-index
Size 48B
SHA256 aee2004d20bd783469ec13b07374089310ff11a19a9b836a97683299ac60f3b0
MD5 6c0c53ed4031f56b8eb2498f59dbafea
SHA1 3004db92a715689e698afb1f8999eb6dc5fb1a3f
SHA512 3b16c3cd546e2e8edeef9add6393d90bd119380dc617d955f28de5b7c0f87fcd5d45c30e6a4158194cb5c933270f6ec71969cf1a0edb606d7cfd59ccb8f7fa84
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Opera Custom Icon.icoe47cd23a-4149-4a36-a4e5-8764b65faa33.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Opera Custom Icon.icoe47cd23a-4149-4a36-a4e5-8764b65faa33.tmp
Size 162KB
SHA256 5903c920e584fc5f1e918bd641bf58fd56e8cb20bb68269892a4984ea7538621
MD5 6c07e783fb8030c2aae67919d45965f7
SHA1 46d2d931e5049884b4e4af1c247fbb1a25b6edea
SHA512 f93944f08885b666c7ad9ab5d7ea051280cd636286586fe1ed696ad67c3b43683fe87dac24bcb9410395acff59a5b0d12d4c12c2f44a0963af2cd93c939a9aa5
SSDEEP 1536:EEJFyMduylKOn7MU+AO8iKqqFG0urH6PtOE:RHKcuGjFhurHjE
TLSH
T1F6F364823BC1ACB7CE92A6B52F7CD4E9B372F5084746572B7FE1A2718B9D3180950139
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

VariationsSafeSeedV2077cccfd-5ec2-4719-a721-00dd35854641.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\VariationsSafeSeedV2077cccfd-5ec2-4719-a721-00dd35854641.tmp
Size 19B
SHA256 1560b22b2264f7cb6b7f6910164813f76c5e8a06fb1acf85b375e687ee49c1ad
MD5 0ba451e89bf7a6a0144344570515f79f
SHA1 76f1bb126b80b61ff6022a5691f39d75f42487c7
SHA512 3a0527494b10bdb2aec6280cdcecfe86dacbf02dd55cc8f6a1e0fa981327617a6fcf2543bd9788e7aa866fa397f57bbc1fbcf0d2f6aaa74a35c4d06970afa75f
MD5 SHA1 SHA512

Submit Download

Bookmarks

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Bookmarks
Size 2KB
SHA256 fc27ee16cd1b71bf3c2f6e4d822f4db4f046d3eae4112dacda1d1369ea4e8dca
MD5 9e9d3805048db0ac83107a31f6dd80c8
SHA1 615f20ddd1f477b6ca7a031e10d6885527634a0a
SHA512 81cb2c055c979df43cd567bc5f72b97198dcc1624607f8edbfd3ef58f18c34dff6c757d03eaf29b50e5bdfbde2eef8b069b17d18029206fc36638157c5d092d4
TLSH
T137419D65A9979CFE14EF70D305C8DF4A67CD263BE0DC0D9A60C8FE28818546B151BAA2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarksExtras

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\BookmarksExtras
Size 22KB
SHA256 4facecc7e5ea0eead20167127e4bf8f95b21f877ed5a37b32d6d6af66f18c5f2
MD5 beaa00befd3dbd7267edba94685ebe60
SHA1 47d8608d0b76a8485241adac183bf9282940bd15
SHA512 4c221a32e6c099374943294033ccb379cb305907c7792daf6afec8162ea73596b1364091c1278c3692c57db72fe1fc2f9e9fc602424fcd7b91cfbe232a7371ba
SSDEEP 384:gi62l1AnB37oc+19UDoLx3CrOT8DAWX6c+19UDoLx3CrOT8DAWXr0i62l1AnB3q:gi6o1+CUDoV3CFMUDoV3CFr0i6o1+a
TLSH
T121B2D1F7BC2F2C1C99845D8974DAACB62DB7D01A5EF427B4569B32872CC0D0C46B568C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Preferences
Size 318B
SHA256 0e2bf66aa7f9d275a910a880b0171f80fa1fc09223b469758207e1e89d702bca
MD5 db21e857d26fe8191f90082a19cbae80
SHA1 e51fa2dadc725e58df4bd4f8d715205a43620cbb
SHA512 4e65d3bbda6d79d0fcb1a42ebe01454acfa2e0fd495214da1e932169725297181eaccc924bf80e09d4adba137d9b2edff0f7224587f879789ba99998ffa329fa
TLSH
T1C2E07D17F0502EB50CAA42756294BF30615B4502A4BA619384FF7258427D1DCC1558A3
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences-20261027064725.151141.backup

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Preferences-20261027064725.151141.backup
Size 313B
SHA256 ed6a32e11cc99728771989b01f5ae813de80c46a59d3dc68c23a4671a343cb8c
MD5 af006f1bcc57b11c3478be8babc036a8
SHA1 c3bb4fa8c905565ca6a1f218e39fe7494910891e
SHA512 3d20689b0f39b414349c505be607e6bfc1f33ac401cf62a32f36f7114e4a486552f3e74661e90db29402bb85866944e9f8f31baba9605aa0c6def621511a26af
TLSH
T1ACE07227F8202FF309F1117D11AA3F9462380041E0AA24DB08DFF9A8022C0D8CABAC27
MD5 SHA1 SHA512 TLSH

Submit Download

ChatGPT.lnk

Path C:\Users\Admin\Desktop\ChatGPT.lnk
Size 1KB
SHA256 024f94c68961bf1d1fee636025e076280e7cf746ea84ee498f909ba549609e58
MD5 ed43c731f875302603c8384568634f71
SHA1 423b993eab5a80e21ceede0538639f8f05587415
SHA512 7010262bdd7a92a5cd98ae8eff6f7ba42849799209aa54df465f0c7a014ce85d91c9655430798518dfab7b2c8543bbb25dc7394df6c19eefdf6c5175f7ab9534
TLSH
T13D21F632B6F50746F3BB587A54F694C18CB4B032FB02AA0E014952DF1825F14DE62B0F
MD5 SHA1 SHA512 TLSH

Submit Download

Roblox v2.4.0.lnk

Path C:\Users\Admin\Desktop\Roblox v2.4.0.lnk
Size 1KB
SHA256 070b17eebb70115ad79d8be7d1fbee04c029ca374156c828df7940232f82b6a1
MD5 3805bba59c2ff0a11341ef1e81c91063
SHA1 ea9b74cfb6e347e10b066478855f25bc843e48e3
SHA512 4478b4c63500c7762df86e041b6c861de319981539ae8cec050e8c37ea33ab04b820abda718d9a96a9476a2c3828dead6cce8994838b5ab9e724308347228776
TLSH
T1FF21234D9EDB0719F1FF84392AF7B746A17AF046F7060E4D4084634A1C6E641A454F4F
MD5 SHA1 SHA512 TLSH

Submit Download

Warface.lnk

Path C:\Users\Admin\Desktop\Warface.lnk
Size 1KB
SHA256 9731a8ba9d91bb64e4098fbb4f0e402227b9bb51105020c0eb0caaf16e820bc5
MD5 ecb5c974be2a280301106473a3882dec
SHA1 89e8497fecf6d9a768acfddd6d05ada37ad741d2
SHA512 ab8c61748765ff6b18917aa49c7a875e4adc2d5d76328dcb2ccd9f0010e576069831315e09be3344ed00518419317bbfcef8fa60e4ed723588a1d90bda4343c2
TLSH
T16921463568F10221F3B7843E99DBA2468C75B620FE51820E005852DE0E25F20EFE1B0F
MD5 SHA1 SHA512 TLSH

Submit Download

ВПН.lnk

Path C:\Users\Admin\Desktop\ВПН.lnk
Size 1KB
SHA256 cd4cd6322d613937c34d8e3949c413542054ff4c4c51847db0c53e6fbf9c8f0e
MD5 76cd8fc50b9c62a418bd2fd50c7c80a3
SHA1 32fd077759fa9b3defe9edc4f893753861a6e404
SHA512 61f719e4f55ed3e29c2cc8d4ab3666bb18463540659001c0b6121422919120b358bb672eae51fb1ac4a092f6a6f3756399e4ae8622f95e0fdf96aafdc18c62bf
TLSH
T19821F635A9F50702F3BB883CA5FAA045C9B87421BF51864A004553DD4C66B04AEA2F5F
MD5 SHA1 SHA512 TLSH

Submit Download

ВарТандер.lnk

Path C:\Users\Admin\Desktop\ВарТандер.lnk
Size 1KB
SHA256 65d7301d19ace03075cd09cdbbaabb5e22c61d81cc8215d0f054241b86d555c7
MD5 1cd354bdf2e3339e0864e702a815cfa6
SHA1 49316b3b9b3a4cc5d5b84a5e80f212ddb671cc11
SHA512 e3b4fda565d6c913923060aaf5e46a42459ec3ea92340cf3a028515506279a722156de328f793db72cb801aff0c98a5e0e1a895a88e800e4af98cb69bd515dc3
TLSH
T1C52122159DF11225F7F7C8389AFAA286C478B420BF02830D004692D94A7A703EE21B4F
MD5 SHA1 SHA512 TLSH

Submit Download

Майнкрафт.lnk

Path C:\Users\Admin\Desktop\Майнкрафт.lnk
Size 1KB
SHA256 4009760e38f5a89b965d8f4caba71158a13d8ddeb9f921e91dc26aa93b52af1c
MD5 a559f5974a6aae6827cfb9010b0d22cc
SHA1 f9331f87c7cc0718f651f560ee6d75c2f8bfd7d8
SHA512 419bdaca908e66632b2ed83353a03f02e489f5eda8fb771f96faf3df04cce52eb75b163592e7b7c351a5b5a60532530c1a921e41a5dcbc49e49461700c323f11
TLSH
T1AE214C155EF40271F3F7493A58EAA4929C71B022BB428B4D100653DF0866E01AE61F8E
MD5 SHA1 SHA512 TLSH

Submit Download

Мир Кораблей.lnk

Path C:\Users\Admin\Desktop\Мир Кораблей.lnk
Size 1KB
SHA256 41f9d2d81688f6e914092248200a614db3f85cd2b254f87222838943ec3e32c9
MD5 44c3193303fd995ff43be4ec9d73884b
SHA1 329bb880b5c1bcdf77b3321b3a41e256d42b58f0
SHA512 282e0f43423415cc62bac363a5afe7d4166610e4e4c4b1f75b6d9d774ac61bce26501655cbeba385002fe8c1dc819a3bc8ca911a1368c39531ed8b3da7c6b07c
TLSH
T10321AC2C96F15640F2BBCD7999CAA48388757820BF40674D00C5838D1E39B50FD11B0F
MD5 SHA1 SHA512 TLSH

Submit Download

Мир Танков.lnk

Path C:\Users\Admin\Desktop\Мир Танков.lnk
Size 1KB
SHA256 6da7e3a2fad7cc09b551b0d1f343f423246b926c50d4fb1aa0c4eb64b3f6610f
MD5 ee0de679e03f76d7c4692dfdad49093c
SHA1 837d0e62ef1b90e48d17a7449d57e668f78a6af0
SHA512 033a7a4cf94f4527f7c4692a99fa5bca36272a4264580772dd525fe24ba1c4437a5547fef8e59707e499d36c52ba10dedcf8dc07d714eea21290fd33cc35c140
TLSH
T1A121422999FD0311F3B78C34A5E968C1DCB4B021BE019A0E104592DD056AF01BE5270F
MD5 SHA1 SHA512 TLSH

Submit Download

Яндекс.Игры.lnk

Path C:\Users\Admin\Desktop\Яндекс.Игры.lnk
Size 1KB
SHA256 27368c433744ac61e1f662fb8f876eba9c865d0107a1710f4df94221be6fa374
MD5 435cad6ce03ffd005ec7cab68a5c119e
SHA1 6cd65eb025d6dbc92dfe4e8b1eb529ca981d3ab2
SHA512 cafbfe96249543af3a5fdb17c23fb4017be5181b2f8d73802d46047ed237baf0275e2fa65de083901ce6147b532a028dd8eeb6fd048a159b04d9360c5f19e413
TLSH
T1B3214C25A9F60226F3B7887954E9A1529879F033FE41870D004553DC0939710F953F5E
MD5 SHA1 SHA512 TLSH

Submit Download

MSI8ECB.tmp

Path C:\Windows\Installer\MSI8ECB.tmp
Size 189KB
SHA256 669cc0aae068ced3154acaecb0c692c4c5e61bc2ca95b40395a3399e75fcb9b2
MD5 e6fd0e66cf3bfd3cc04a05647c3c7c54
SHA1 6a1b7f1a45fb578de6492af7e2fede15c866739f
SHA512 fc8613f31acaf6155852d3ad6130fc3b76674b463dcdcfcd08a3b367dfd9e5b991e3f0a26994bcaf42f9e863a46a81e2520e77b1d99f703bcb08800bdca4efcb
SSDEEP 3072:iAJayVkvIkE3fqPDgvlevYwlv57GqosaJlpJKzhY9A3w9FtGJ2EYJxZi5V2O2M:ickvIDvWgvlevYwFVaJlp8z++bnYsX2Y
TLSH
T1A1149E107881C13AE2BF093995BAA6724D7CB5301FB8C8DF63949D351E706C1AB39B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI8F0A.tmp

Path C:\Windows\Installer\MSI8F0A.tmp
Size 181KB
SHA256 a5dd2f97c6787c335b7807ff9b6966877e9dd811f9e26326837a7d2bd224de86
MD5 0c80a997d37d930e7317d6dac8bb7ae1
SHA1 018f13dfa43e103801a69a20b1fab0d609ace8a5
SHA512 fe1caef6d727344c60df52380a6e4ab90ae1a8eb5f96d6054eced1b7734357ce080d944fa518cf1366e14c4c0bd9a41db679738a860800430034a75bb90e51a5
SSDEEP 3072:LIgxsEwKIE4SaX1xQrlm4taQqPvvNCqv8bcDR0wYyMP3XrZ+bx0PWWX+xA6QpS:LIgxsEbIE45ArptaQqPtCG8SR0waB7Bo
TLSH
T1DE048D127180C075E6FB1A3C4578DAB65A3E79305B74C8DB63948E2B2E702C1AF35B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3248-650-0x0000000001060000-0x000000000106A000-memory.dmp

Download

memory/3248-546-0x00000000094F0000-0x00000000094FA000-memory.dmp

Download

memory/3248-651-0x0000000008D40000-0x0000000008D4A000-memory.dmp

Download

memory/3248-648-0x00000000094F0000-0x00000000094FA000-memory.dmp

Download

memory/3248-654-0x00000000094E0000-0x00000000094EA000-memory.dmp

Download

memory/3248-653-0x000000000B770000-0x000000000B77A000-memory.dmp

Download

memory/3248-652-0x0000000004AF0000-0x0000000004AFA000-memory.dmp

Download

memory/3248-541-0x0000000009370000-0x000000000937A000-memory.dmp

Download

memory/3248-649-0x0000000003130000-0x000000000313A000-memory.dmp

Download

memory/3248-543-0x0000000008D40000-0x0000000008D4A000-memory.dmp

Download

memory/3248-655-0x0000000009370000-0x000000000937A000-memory.dmp

Download

memory/3248-10716-0x0000000003140000-0x0000000003141000-memory.dmp

Download

memory/3248-519-0x0000000001060000-0x000000000106A000-memory.dmp

Download

memory/3248-538-0x0000000004AF0000-0x0000000004AFA000-memory.dmp

Download

memory/3248-527-0x0000000003130000-0x000000000313A000-memory.dmp

Download

memory/3248-567-0x000000000B770000-0x000000000B77A000-memory.dmp

Download

memory/3248-545-0x00000000094E0000-0x00000000094EA000-memory.dmp

Download

memory/4652-7-0x0000000000AF0000-0x0000000000BE1000-memory.dmp

Download

memory/4652-0-0x0000000000AF0000-0x0000000000BE1000-memory.dmp

Download

memory/5080-19-0x0000000000F70000-0x0000000001328000-memory.dmp

Download

memory/5080-9822-0x0000000000F70000-0x0000000001328000-memory.dmp

Download

memory/5080-5-0x0000000000F10000-0x0000000000F11000-memory.dmp

Download

memory/5080-9-0x0000000000F10000-0x0000000000F11000-memory.dmp

Download

memory/5080-10576-0x0000000000F70000-0x0000000001328000-memory.dmp

Download

memory/5080-8-0x0000000000F70000-0x0000000001328000-memory.dmp

Download

memory/5080-370-0x0000000000F70000-0x0000000001328000-memory.dmp

Download

memory/5080-11-0x0000000000F70000-0x0000000001328000-memory.dmp

Download

memory/7620-10711-0x00007FFDD07D0000-0x00007FFDD07D1000-memory.dmp

Download

memory/7620-10712-0x00007FFDD1050000-0x00007FFDD1051000-memory.dmp

Download

memory/15964-9908-0x000001A22FA70000-0x000001A22FA90000-memory.dmp

Download

memory/15964-9919-0x000001A22FE80000-0x000001A22FEA0000-memory.dmp

Download

memory/15964-9885-0x000001A22FAB0000-0x000001A22FAD0000-memory.dmp

Download

memory/15964-10251-0x0000019A2B770000-0x0000019A2B794000-memory.dmp

Download

memory/15964-10252-0x0000019A2CDB0000-0x0000019A2E6DF000-memory.dmp

Download

memory/18340-10681-0x0000000010380000-0x0000000010494000-memory.dmp

Download

memory/18436-10823-0x000001B452440000-0x000001B452460000-memory.dmp

Download

memory/18436-13935-0x000001B463C40000-0x000001B463C64000-memory.dmp

Download

memory/18436-13934-0x000001AC4F600000-0x000001AC50F2F000-memory.dmp

Download

memory/18436-10809-0x000001B452480000-0x000001B4524A0000-memory.dmp

Download

memory/18436-10838-0x000001B452850000-0x000001B452870000-memory.dmp

Download

memory/18436-10804-0x000001B451300000-0x000001B451400000-memory.dmp

Download