e4edc66c8f2f4ae03ee102a7fda40f98e4602fd9bdda57ceceea26c99765d789

Analysis

max time kernel
140s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
winrar-64-7.01-installer_SDS4-S8.exe
Size 5.2MB
Sample261102-pdzfxavy3l
SHA256 e4edc66c8f2f4ae03ee102a7fda40f98e4602fd9bdda57ceceea26c99765d789
MD5 eb47215fd2506ca26f451a18fd88082b
SHA1 c5e05d2f649e55cef10ab19364d2c61916e7eac8
SHA512 ff1fec935e101eb5a1010d8041542c5838f9e1a41d3f266da1cc2b07a4a99dd3cee7f7d34ac469bb09ebb9f2bc048766d800f7db06707c90b4eea182c350116a
SSDEEP 98304:g5OqMmrURINHAa2JiCdJ9YKzoFOqQtAwKLoa2r2Fr2A44D5kmy:k/MCURXNYKzogqQtAwKLD2a2r4jy
TLSH
T1D146023BA18BE53EE07A5A353972911058FB7F6D65124C069AE4F84CCF360B01D3E6B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit defense_evasion discovery installer persistence spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
22	5344	winrar-64-7.01-installer_SDS4-S8.tmp

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	winrar-64-7.01-installer_SDS4-S8.tmp

Executes dropped EXE 7 IoCs

pid	Process
5344	winrar-64-7.01-installer_SDS4-S8.tmp
3944	OperaSetup.exe
2808	cookie_mmm_irs_ppi_008_585.exe
5840	installer.exe
6060	installer.exe
3088	installer.exe
1476	installer.exe

Loads dropped DLL 1 IoCs

pid	Process
2808	cookie_mmm_irs_ppi_008_585.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks for any installed AV software in registry 1 TTPs 9 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	winrar-64-7.01-installer_SDS4-S8.tmp
Key opened	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\AVAST Software\Avast	winrar-64-7.01-installer_SDS4-S8.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avast Software\Avast	winrar-64-7.01-installer_SDS4-S8.tmp
Key opened	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Avast Software\Avast	winrar-64-7.01-installer_SDS4-S8.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir	winrar-64-7.01-installer_SDS4-S8.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	winrar-64-7.01-installer_SDS4-S8.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	winrar-64-7.01-installer_SDS4-S8.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir	winrar-64-7.01-installer_SDS4-S8.tmp
Key opened	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\AVG\AV\Dir	winrar-64-7.01-installer_SDS4-S8.tmp

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	installer.exe
File opened (read-only)	\??\F:	installer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	cookie_mmm_irs_ppi_008_585.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	cookie_mmm_irs_ppi_008_585.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	winrar-64-7.01-installer_SDS4-S8.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	winrar-64-7.01-installer_SDS4-S8.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cookie_mmm_irs_ppi_008_585.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cookie_mmm_irs_ppi_008_585.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	installer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	installer.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winrar-64-7.01-installer_SDS4-S8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winrar-64-7.01-installer_SDS4-S8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cookie_mmm_irs_ppi_008_585.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6076	opera.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/632-0-0x00000000006F0000-0x00000000007E9000-memory.dmp	innosetup
behavioral1/memory/632-7-0x00000000006F0000-0x00000000007E9000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	winrar-64-7.01-installer_SDS4-S8.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	winrar-64-7.01-installer_SDS4-S8.tmp

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F	cookie_mmm_irs_ppi_008_585.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\7CCD586D-2ABC-42FF-A23B-3731F4F183D9 = "0EC03442A4E93B807782D73BF46C389D"	cookie_mmm_irs_ppi_008_585.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\5E1D6A55-0134-486E-A166-38C2E4919BB1 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA7lQOFATaNU+C2CEt+R9mwwQAAAACAAAAAAAQZgAAAAEAACAAAACRYoeG4Hhhr2CmIn6t3XQ6OYG+5AfIFQ8s/roSoP1WEgAAAAAOgAAAAAIAACAAAAAA9/gfA/Ly45HvnhlFT8Tw4b6ive9vW/KdXZ3a2bTnQ4AAAADb7ROpmxW6Es8AyEYRc/RYrc7GuSFDBPoBUCH6PBGx1U5hVZh8LIu8urpi/Y0InfnTNXyYj+iGXS8I/IiqyrXzQ8KglRAi5wm5hHFDNuRhfX1RkFJpSm3KHXOZ05aJll+lhI/VnS0b0WlTzVF9P+eOgKLfcwHNIi4T5vXESvkyQkAAAAAF1RUCta68s7YaUrqpB+WATBP2Cp6v4QfsDgeVcKrp/XHQb+FgPXVVWV/69E2tr7Sn6CL1bWDvZRv1LgOuGQgw"	cookie_mmm_irs_ppi_008_585.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\56C7A9DA-4B11-406A-8B1A-EFF157C294D6 = "a040c988-9d40-4e74-9633-fe3a77e7f996"	cookie_mmm_irs_ppi_008_585.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	13	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
5344	winrar-64-7.01-installer_SDS4-S8.tmp
5344	winrar-64-7.01-installer_SDS4-S8.tmp
5344	winrar-64-7.01-installer_SDS4-S8.tmp
5344	winrar-64-7.01-installer_SDS4-S8.tmp
5344	winrar-64-7.01-installer_SDS4-S8.tmp
5344	winrar-64-7.01-installer_SDS4-S8.tmp
5344	winrar-64-7.01-installer_SDS4-S8.tmp
5344	winrar-64-7.01-installer_SDS4-S8.tmp
5344	winrar-64-7.01-installer_SDS4-S8.tmp
5344	winrar-64-7.01-installer_SDS4-S8.tmp
5344	winrar-64-7.01-installer_SDS4-S8.tmp
5344	winrar-64-7.01-installer_SDS4-S8.tmp
5344	winrar-64-7.01-installer_SDS4-S8.tmp
5344	winrar-64-7.01-installer_SDS4-S8.tmp
5344	winrar-64-7.01-installer_SDS4-S8.tmp
5344	winrar-64-7.01-installer_SDS4-S8.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5344	winrar-64-7.01-installer_SDS4-S8.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 5344	632	winrar-64-7.01-installer_SDS4-S8.exe	86
PID 5344 wrote to memory of 3944	5344	winrar-64-7.01-installer_SDS4-S8.tmp	98
PID 5344 wrote to memory of 2808	5344	winrar-64-7.01-installer_SDS4-S8.tmp	99
PID 3944 wrote to memory of 5840	3944	OperaSetup.exe	100
PID 5840 wrote to memory of 6060	5840	installer.exe	101
PID 5840 wrote to memory of 3088	5840	installer.exe	103
PID 5840 wrote to memory of 1476	5840	installer.exe	105

C:\Users\Admin\AppData\Local\Temp\winrar-64-7.01-installer_SDS4-S8.exe
"C:\Users\Admin\AppData\Local\Temp\winrar-64-7.01-installer_SDS4-S8.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:632
- C:\Users\Admin\AppData\Local\Temp\is-5P2KKEU4AA.tmp\winrar-64-7.01-installer_SDS4-S8.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-5P2KKEU4AA.tmp\winrar-64-7.01-installer_SDS4-S8.tmp" /SL5="$802F2,4171849,960512,C:\Users\Admin\AppData\Local\Temp\winrar-64-7.01-installer_SDS4-S8.exe"
  2⤵
  - Downloads MZ/PE file
  - Checks computer location settings
  - Executes dropped EXE
  - Checks for any installed AV software in registry
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5344
- - C:\Users\Admin\AppData\Local\Temp\is-UOI94ZDW0C.tmp\component0_extract\OperaSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\is-UOI94ZDW0C.tmp\component0_extract\OperaSetup.exe" --silent --allusers=0 --otd=utm.medium:apb,utm.source:ais,utm.campaign:a,utm.id:agiSfNgi01a2xeNcJwTG82RXxTyFBk2jRKY0LFCMkDz2dtTNBSbCadO6Rt97ohdv37kqg43JmBV9Fb7W98
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3944
  - - C:\Users\Admin\AppData\Local\Temp\7zS86F03869\installer.exe
      C:\Users\Admin\AppData\Local\Temp\7zS86F03869\installer.exe --silent --allusers=0 --otd=utm.medium:apb,utm.source:ais,utm.campaign:a,utm.id:agiSfNgi01a2xeNcJwTG82RXxTyFBk2jRKY0LFCMkDz2dtTNBSbCadO6Rt97ohdv37kqg43JmBV9Fb7W98 --server-tracking-blob=NDk0NzhhMWIzYjRiMDlhOThjZWFiZTNmYTJjNTI0NWYzMjdiMGQwODhkNTY4OWZjZjNlNDAwZWViZTc0ODU0ZDp7ImNvdW50cnkiOiJVUyIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cyIsInRpbWVzdGFtcCI6IjE3OTM0NDQ0MTQuMzc2MiIsInVzZXJhZ2VudCI6InB5dGhvbi1yZXF1ZXN0cy8yLjMyLjMiLCJ1dG0iOnt9LCJ1dWlkIjoiMGJkYWI5ZTgtMTQwYi00ZTY5LWIyMmQtMGZhNzU1N2M2ODYyIn0=
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Reads the TCP/IP host and domain name from the registry
      Enumerates system info in registry
      Suspicious use of WriteProcessMemory
      PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\7zS86F03869\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS86F03869\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=139.0.6053.22 --initial-client-data=0x250,0x280,0x284,0x254,0x288,0x7ff6d27d4258,0x7ff6d27d4268,0x7ff6d27d4278
        5⤵
        Executes dropped EXE
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\.opera\f03f564e-691d-4868-9877-1ab5ab63636e Opera Installer Temp\installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\f03f564e-691d-4868-9877-1ab5ab63636e Opera Installer Temp\installer.exe" --version
        5⤵
        Executes dropped EXE
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\7zS86F03869\installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS86F03869\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=5840 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\f03f564e-691d-4868-9877-1ab5ab63636e Opera Installer Temp\opera_package_20261102121408" --session-guid=4b37f1f4-f5d3-4379-95f5-854084c35bfd --server-tracking-blob=ZDg5ZDYzMTZlM2Y0OGQ5NmU1NGI2YzYzNGM5MWRiM2ZiNzdmYTIyNTJiYzJlNzMyN2Y0MjI4ODI5NjBmYjlmODp7ImNvdW50cnkiOiJVUyIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTc5MzQ0NDQxNC4zNzYyIiwidXNlcmFnZW50IjoicHl0aG9uLXJlcXVlc3RzLzIuMzIuMyIsInV0bSI6eyJjYW1wYWlnbiI6ImEiLCJpZCI6ImFnaVNmTmdpMDFhMnhlTmNKd1RHODJSWHhUeUZCazJqUktZMExGQ01rRHoyZHRUTkJTYkNhZE82UnQ5N29oZHYzN2txZzQzSm1CVjlGYjdXOTgiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJhaXMifSwidXVpZCI6IjBiZGFiOWU4LTE0MGItNGU2OS1iMjJkLTBmYTc1NTdjNjg2MiJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=7C08000000000000
        5⤵
        Executes dropped EXE
        
        PID:1476
      - C:\Users\Admin\AppData\Local\Temp\7zS86F03869\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS86F03869\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=139.0.6053.22 --initial-client-data=0x270,0x274,0x278,0x248,0x27c,0x7ff6d27d4258,0x7ff6d27d4268,0x7ff6d27d4278
        6⤵
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.22\installer.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.22\installer.exe" --backend --initial-pid=5840 --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --show-intro-overlay --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\f03f564e-691d-4868-9877-1ab5ab63636e Opera Installer Temp\opera_package_202611021214081" --session-guid=4b37f1f4-f5d3-4379-95f5-854084c35bfd --server-tracking-blob=ZDg5ZDYzMTZlM2Y0OGQ5NmU1NGI2YzYzNGM5MWRiM2ZiNzdmYTIyNTJiYzJlNzMyN2Y0MjI4ODI5NjBmYjlmODp7ImNvdW50cnkiOiJVUyIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTc5MzQ0NDQxNC4zNzYyIiwidXNlcmFnZW50IjoicHl0aG9uLXJlcXVlc3RzLzIuMzIuMyIsInV0bSI6eyJjYW1wYWlnbiI6ImEiLCJpZCI6ImFnaVNmTmdpMDFhMnhlTmNKd1RHODJSWHhUeUZCazJqUktZMExGQ01rRHoyZHRUTkJTYkNhZE82UnQ5N29oZHYzN2txZzQzSm1CVjlGYjdXOTgiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJhaXMifSwidXVpZCI6IjBiZGFiOWU4LTE0MGItNGU2OS1iMjJkLTBmYTc1NTdjNjg2MiJ9 --silent --desktopshortcut=1 --install-subfolder=139.0.6053.22
        6⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.22\installer.exe
        
        C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.22\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=139.0.6053.22 --initial-client-data=0x27c,0x280,0x284,0x258,0x288,0x7ff6f03d4258,0x7ff6f03d4268,0x7ff6f03d4278
        7⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\.opera\f03f564e-691d-4868-9877-1ab5ab63636e Opera Installer Temp\opera_package_202611021214081\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\f03f564e-691d-4868-9877-1ab5ab63636e Opera Installer Temp\opera_package_202611021214081\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera\assistant" --copyonly=0 --allusers=0
        7⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\.opera\f03f564e-691d-4868-9877-1ab5ab63636e Opera Installer Temp\opera_package_202611021214081\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\f03f564e-691d-4868-9877-1ab5ab63636e Opera Installer Temp\opera_package_202611021214081\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.52 --initial-client-data=0x220,0x224,0x228,0xb8,0x22c,0x57c9cc,0x57c9d8,0x57c9e4
        8⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera\assistant" --run-assistant --allusers=0
        8⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe
        
        C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.52 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x10bc9cc,0x10bc9d8,0x10bc9e4
        9⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe"
        9⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
        10⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.22\opera_crashreporter.exe
        
        C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.22\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=139.0.6053.22 --initial-client-data=0x238,0x23c,0x240,0x234,0x244,0x28e7865aa00,0x28e7865aa10,0x28e7865aa20
        11⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
        10⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.22\opera_crashreporter.exe
        
        C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.22\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=139.0.6053.22 --initial-client-data=0x238,0x23c,0x240,0x234,0x244,0x174cf0aaa00,0x174cf0aaa10,0x174cf0aaa20
        11⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe
        
        C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.52 --initial-client-data=0x26c,0x270,0x274,0x240,0x278,0x1257324,0x1257330,0x125733c
        10⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
        11⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.22\opera_crashreporter.exe
        
        C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.22\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=139.0.6053.22 --initial-client-data=0x238,0x23c,0x240,0x234,0x244,0x1bcd64aaa00,0x1bcd64aaa10,0x1bcd64aaa20
        12⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
        11⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.22\opera_crashreporter.exe
        
        C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.22\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=139.0.6053.22 --initial-client-data=0x238,0x23c,0x240,0x234,0x244,0x1db3588aa00,0x1db3588aa10,0x1db3588aa20
        12⤵
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
        11⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.22\opera_crashreporter.exe
        
        C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.22\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=139.0.6053.22 --initial-client-data=0x238,0x23c,0x240,0x234,0x244,0x293599daa00,0x293599daa10,0x293599daa20
        12⤵
        
        PID:1400
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --install-extension="C:\Users\Admin\AppData\Local\Temp\.opera\f03f564e-691d-4868-9877-1ab5ab63636e Opera Installer Temp\opera_package_202611021214081\de932af914ba00303d4a2778a383ac9c831101e2.crx"
        7⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.22\opera_crashreporter.exe
        
        C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.22\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=139.0.6053.22 --initial-client-data=0x234,0x238,0x23c,0x230,0x240,0x2f39ad7aa00,0x2f39ad7aa10,0x2f39ad7aa20
        8⤵
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --gpu-recent-crash-count=0 --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:auto-gaming-intent-suggestion=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-free-autoconnect=on --with-feature:vpn-pro-v4-support=on --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1740,i,18049266547323709138,454030970627272315,262144 --field-trial-handle=1944,i,8130917214743308905,2666180354704363305,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1948,i,17587577176218865280,8960945582250489019,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1940 /prefetch:2
        8⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:auto-gaming-intent-suggestion=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-free-autoconnect=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2124,i,4258277674406233890,18235622164723129232,524288 --field-trial-handle=1944,i,8130917214743308905,2666180354704363305,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1948,i,17587577176218865280,8960945582250489019,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2148 /prefetch:3
        8⤵
        System Time Discovery
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:auto-gaming-intent-suggestion=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-free-autoconnect=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2416,i,18155217649021016739,11823310732489912197,524288 --field-trial-handle=1944,i,8130917214743308905,2666180354704363305,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1948,i,17587577176218865280,8960945582250489019,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2444 /prefetch:8
        8⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:auto-gaming-intent-suggestion=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-free-autoconnect=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4108,i,117002042215147399,14403228580238817443,524288 --field-trial-handle=1944,i,8130917214743308905,2666180354704363305,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1948,i,17587577176218865280,8960945582250489019,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4076 /prefetch:8
        8⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:auto-gaming-intent-suggestion=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-free-autoconnect=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3684,i,8581657019329971563,14131028443734764491,1572864 --field-trial-handle=1944,i,8130917214743308905,2666180354704363305,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1948,i,17587577176218865280,8960945582250489019,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=4060 /prefetch:2
        8⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:auto-gaming-intent-suggestion=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-free-autoconnect=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4540,i,6706889512515663368,6863595678437683690,1572864 --field-trial-handle=1944,i,8130917214743308905,2666180354704363305,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1948,i,17587577176218865280,8960945582250489019,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4592 /prefetch:2
        8⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:auto-gaming-intent-suggestion=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-free-autoconnect=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4136,i,2724773509892724991,2450868578454081994,524288 --field-trial-handle=1944,i,8130917214743308905,2666180354704363305,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1948,i,17587577176218865280,8960945582250489019,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4020 /prefetch:8
        8⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:auto-gaming-intent-suggestion=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-free-autoconnect=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4908,i,11928007602387499705,10687807284667515228,524288 --field-trial-handle=1944,i,8130917214743308905,2666180354704363305,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1948,i,17587577176218865280,8960945582250489019,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4920 /prefetch:8
        8⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:auto-gaming-intent-suggestion=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-free-autoconnect=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4008,i,1873958697030645253,11619637477458716736,524288 --field-trial-handle=1944,i,8130917214743308905,2666180354704363305,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1948,i,17587577176218865280,8960945582250489019,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5000 /prefetch:8
        8⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:auto-gaming-intent-suggestion=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-free-autoconnect=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5136,i,9911477845889084481,12929928141828075657,1572864 --field-trial-handle=1944,i,8130917214743308905,2666180354704363305,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1948,i,17587577176218865280,8960945582250489019,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5188 /prefetch:1
        8⤵
        
        PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\.opera\f03f564e-691d-4868-9877-1ab5ab63636e Opera Installer Temp\opera_package_202611021214081\assistant\Assistant_136.0.6008.52_Setup.exe_sfx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\f03f564e-691d-4868-9877-1ab5ab63636e Opera Installer Temp\opera_package_202611021214081\assistant\Assistant_136.0.6008.52_Setup.exe_sfx.exe"
        5⤵
        
        PID:4996
    - - C:\Users\Admin\AppData\Local\Temp\.opera\f03f564e-691d-4868-9877-1ab5ab63636e Opera Installer Temp\opera_package_202611021214081\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\f03f564e-691d-4868-9877-1ab5ab63636e Opera Installer Temp\opera_package_202611021214081\assistant\assistant_installer.exe" --version
        5⤵
        
        PID:4012
      - C:\Users\Admin\AppData\Local\Temp\.opera\f03f564e-691d-4868-9877-1ab5ab63636e Opera Installer Temp\opera_package_202611021214081\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\f03f564e-691d-4868-9877-1ab5ab63636e Opera Installer Temp\opera_package_202611021214081\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.52 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x57c9cc,0x57c9d8,0x57c9e4
        6⤵
        
        PID:3044
- - C:\Users\Admin\AppData\Local\Temp\is-UOI94ZDW0C.tmp\component1_extract\cookie_mmm_irs_ppi_008_585.exe
    "C:\Users\Admin\AppData\Local\Temp\is-UOI94ZDW0C.tmp\component1_extract\cookie_mmm_irs_ppi_008_585.exe" /silent /ws /psh:agiSfNgi01a2xeNcJwTG6wXHTTQ4Pg36sq4iV9c3cyPZiNgHh4AZ18XmjKXjzftQ6DPYU83ipU8JjoaHiu /cookie:mmm_irs_ppi_008_585_a
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Writes to the Master Boot Record (MBR)
    - Direct Volume Access: Opens a physical disk for reading
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2808
  - - C:\Windows\Temp\asw-7437fed9-23ca-45e2-aaac-1e3d4dfadcb0\common\icarus.exe
      C:\Windows\Temp\asw-7437fed9-23ca-45e2-aaac-1e3d4dfadcb0\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-7437fed9-23ca-45e2-aaac-1e3d4dfadcb0\icarus-info.xml /install /silent /ws /psh:agiSfNgi01a2xeNcJwTG6wXHTTQ4Pg36sq4iV9c3cyPZiNgHh4AZ18XmjKXjzftQ6DPYU83ipU8JjoaHiu /cookie:mmm_irs_ppi_008_585_a
      4⤵
      PID:4892
    - - C:\Windows\Temp\asw-7437fed9-23ca-45e2-aaac-1e3d4dfadcb0\avast-suite\icarus.exe
        
        C:\Windows\Temp\asw-7437fed9-23ca-45e2-aaac-1e3d4dfadcb0\avast-suite\icarus.exe /silent /ws /psh:agiSfNgi01a2xeNcJwTG6wXHTTQ4Pg36sq4iV9c3cyPZiNgHh4AZ18XmjKXjzftQ6DPYU83ipU8JjoaHiu /cookie:mmm_irs_ppi_008_585_a /er_master:master_ep_5cb17f3e-f0bd-4085-a296-15c94148540b /er_slave:avast-suite_slave_ep_662652b3-63d5-46fe-800a-e8ff65076d00 /slave:avast-suite
        5⤵
        
        PID:1180
    - - C:\Windows\Temp\asw-7437fed9-23ca-45e2-aaac-1e3d4dfadcb0\avast-av-vps\icarus.exe
        
        C:\Windows\Temp\asw-7437fed9-23ca-45e2-aaac-1e3d4dfadcb0\avast-av-vps\icarus.exe /silent /ws /psh:agiSfNgi01a2xeNcJwTG6wXHTTQ4Pg36sq4iV9c3cyPZiNgHh4AZ18XmjKXjzftQ6DPYU83ipU8JjoaHiu /cookie:mmm_irs_ppi_008_585_a /er_master:master_ep_5cb17f3e-f0bd-4085-a296-15c94148540b /er_slave:avast-av-vps_slave_ep_823c0075-51fa-4ba5-a609-f59c29394d08 /slave:avast-av-vps
        5⤵
        
        PID:3344

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}
1⤵
PID:1664

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:5944

C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.22\opera_crashreporter.exe
C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.22\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=139.0.6053.22 --initial-client-data=0x234,0x238,0x23c,0x230,0x240,0x237b741aa00,0x237b741aa10,0x237b741aa20
1⤵
PID:8244

C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:auto-gaming-intent-suggestion=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-free-autoconnect=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4128,i,15842438124915959571,9553205433922982443,1572864 --field-trial-handle=2548,i,13970120925297353663,17433170665453856683,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2552,i,17831039944929907598,17950403296817467118,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=4336 /prefetch:1
1⤵
PID:9140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ic_detailed_ok.svg.ipending.82caa002

Path C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\icons\ic_detailed_ok.svg.ipending.82caa002
Size 806B
SHA256 21a1e92a73bd7279a341f01c988f5d888b3be62ddaaf987137e3be88fd3fc407
MD5 43280fcfa0fabc83c0c78f8ad41d3957
SHA1 c3e3ae37742733dd7f5c1707f6d7d679ab0cb5c3
SHA512 883d24f4a3f3fc5b8760f43c8087ecf8fb9bc650857b9c6a3ba743ec55b6aef09cf34fe2d61ed5be55b004df4e1769313f614c26a0d93b855b3cdd4055242f1d
TLSH
T189014EFCC6718585B40317ADCBB62C6454767FBFD18781199AF0E660F63806E8AB18C7
MD5 SHA1 SHA512 TLSH

Submit Download

ic_simple_product_av_free.svg

Path C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\icons\ic_simple_product_av_free.svg
Size 3KB
SHA256 5df3646f3b43b7f966f66dabacb6ce67174e7b5127534167e85ba021095ba400
MD5 1d4f3c6443c5c670a9f1140b8c606ff6
SHA1 0ee447cc3c747ef6b85536d2242478b5b6ba34ce
SHA512 2315714339318d78388b068194a2241846df1ba02364f4bfd55e391cef7f0b5b632d7cd86d54f307bbf6c40ac01abf1c7e933e4d4082d3662a917cb9caf0c07d
TLSH
T13D7122FFE3C8B1E0A98BE7F0E923587D255B21FA3936C35406A19A54FE014AC4D1EC14
MD5 SHA1 SHA512 TLSH

Submit Download

i-s-622.svg

Path C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\dark\i-s-622.svg
Size 6KB
SHA256 fd0d27e1e19c46b04776d93998e6a35e98b24758842e408b6758669fef86b253
MD5 d1382323b7d37fc1fda2470c5d4136bc
SHA1 beca1e5e987ed6f06ca975b64ec22f484a57f1dd
SHA512 35f7174e27eacf880aae66044aae2497ede52d27969737e7022646718d27bedda020aa6d28191b121148f883d40d2e21fa89521328a8a7c66b5bcedd73c8bfbb
SSDEEP 192:KpbLbt2+H+M+X5O4XEYYnVYn+MtxZMkSv9w3wt:gbt2ALI5O1yimgt
TLSH
T150D174FC23080AFEF52186C2D78A36BF312B50B6A6858164D73D392E19559ACDD37DC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i-s-645.svg

Path C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\dark\i-s-645.svg
Size 12KB
SHA256 82dd6e9b62f5e1e898bd17ea3d3d1a557ae01cdc33af7301a10a612c1e0f6911
MD5 a46bd36695e17dfb1dd539964dbba2e1
SHA1 cc8a26123b89255d373272a0f8b805436f5205ef
SHA512 3c239c518cac1be8d596cd4be7af6b86aca1c576589f86bcb2a7c8db9f5dd44efbeb934f737248f76584f2810196498030bbbbeafc6fc459d7582ea84ee18fad
SSDEEP 192:qxd7srrnJbwq493r4Vr/lnWWBTLUTSHTikH+r6VtItUt5bSpXrUN5HSY:qxd7g7Bwq493rmjlWwTwE3e8ItU82SY
TLSH
T16C5296ED370008BCFD4256FADB0D30BD211AD1EB2A812B64C56D2E3528165ADCD7BED6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i-s-647.svg

Path C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\dark\i-s-647.svg
Size 19KB
SHA256 1204d4bbaa32d8f3aed6f3477190e6b2bba0d1f10112d138f4d06dc894c09826
MD5 321f28b851daacdbb8f90aaaf09fa220
SHA1 dfd0a6c7279ec842e186f985d206fc8b44982b5f
SHA512 122a3aaa17cb24ca33d06ecf561645363c8d19ebaf3de5dc4a5199223fcfcd45280569a95705dd8b61a50dcb38e3069d6fadc84a82e0edcb36dae8ef8403bdf3
SSDEEP 384:9O5aWhlDVMbV1JKtUr72B0IFKCA3jh5zoLO5R7vpwyo:Q1lT0BCAz15vpwyo
TLSH
T12A92D5DD333897FCF802E3FACB1735BAA45E34EEB5454570C7A42D28644242DADA68C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i-s-726.svg

Path C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\dark\i-s-726.svg
Size 15KB
SHA256 c5df08482c1a43d5970f054b16ed62490b1dfde0fd084b630d58ffe81b9f75a9
MD5 4c5cb67efd6154480809766410311aee
SHA1 eba44de4c527b292df1879ec8a4dd95baaf2bce3
SHA512 7565268859a2e16a48c57918992b50aff62f5c70f973f324adaf79be1f89e4cdb9c79823216f25bde4763d4d1230d61404ad0133d56515a265fc9231080a49ba
SSDEEP 192:Ua/jDYmRIwyYkec7uBpKoY7HlkOndOZREnfKZhMAO00xOF/0nJCguEFqRSc83OVD:bSYLc4EoY7FkJ/xdaJCg1qx
TLSH
T18C72C463060FA2D64CB83FBB435ABC4EA904F1925E83C799E5EA5D94E19E7480701B2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i-s-728.svg

Path C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\dark\i-s-728.svg
Size 17KB
SHA256 8c0d8d77a64cc222714222f4709323dff5ac670eed29858a5818e306c31e88a1
MD5 a54dadb0aa9d5cbb47802dc3d2569fd4
SHA1 dd7a398db9440a6b9a6b9378e93206b8e032f799
SHA512 6fc90d9cc6dc908deedd4c73600ccc1e5a557c15a338cc5be666d73f69c803116986c9f503da8270db24fa7da951e4b4fec494700ce3f2fe9595f2ec3d1b480e
SSDEEP 384:srPJUfwb1bPYNgH7nLDHy1bSdFFT4gvCE68U8XS7o9Mz:y9RTTnLryQ3vny
TLSH
T1FD82C7571A0FB2968C243EFB96967D8AB514F1C34E93C7C8E4DE5DE8D09DA480E013AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i-s-730.svg

Path C:\Program Files\Avast Software\Suite\gui_resources\default_av\assets\illustrations\dark\i-s-730.svg
Size 13KB
SHA256 8ecc9a770222b0201e01065c8bc1bb0296f6c55c6474b2771ff9bae276819f6e
MD5 10fd42537b6b0a59170880975e2c8ed5
SHA1 ab3ec0c2d3effe7fa4b3f541d4c4f929e97e2e22
SHA512 7816678d15d92e91f34c047c50649edf2f8ede942879f21a66c7fe1ae21afdb90fb79aaff0b5acfa18e58a5624e53511d5a1fbc19d722845d2c3ea688a548569
SSDEEP 192:Ua/tBtutviqRDg16Z9z2ZqCYtFqRS/2sM3F+NRPwYdCT6chqR1x319ZEDd2UBEq9:duma9z2ZytL2aNVwYoEh13EcU7
TLSH
T10F52F903090FA36658343FFB9B96BC49A019F1E38D93C78CE0F9ADE4D1AAB48055576C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

openvino_auto_plugin.dll

Path C:\Program Files\Avast Software\Suite\openvino_auto_plugin.dll
Size 384KB
SHA256 8ec0ef2967baaab6bc600a5bf0799d245d6444edfcb506b579ab92fca7a8b076
MD5 0983294d1999a9a062ef0f2c14049722
SHA1 87ca2173c07c4cab7b49d5e5433ee257c4959b63
SHA512 a2b40b04b039ab4c808bb21034f87a0839f46bd85f95eb562d75947565163978771786b87c75a807935870c3dd499453f1e5a1195c0ce017df5b5ded81e3f8c3
SSDEEP 3072:N/OeZqQXaBic3+60H82shZj1BGHnJnPqtBH34yUVLzBkflUgarq9P4G/u3c0nvTi:g8PshR/GHxPA14pjCgG/uLq+y4Y
TLSH
T1DB84E857D2A8009DC5AED1AD8A0A9B07F6B1B80513319ACB43D0CAD75F67BF16C7E390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

templates.ori.ipending.82caa002

Path C:\ProgramData\Avast Software\Avast\fw\templates.ori.ipending.82caa002
Size 210KB
SHA256 af1c2077d4cf67f864b204290a35e51809c4d8c5349d4ac8ca90c92374a1d6b2
MD5 8a271a58bb01395479a3e2e8c1346b74
SHA1 14036c82ea01e9c657da7bb2d8723cf192a3d2cb
SHA512 7c89c91c9e18daaaf4922d25c27daae671ffe660ab1e0ac620f645e15607b7c8c26d971f871ec55ff68bdf9ae36191df7a25bce452e267410b5628c49ebcdad5
SSDEEP 768:fE+9lH9eMOxzgI6VJ4kFk4ZP34/O0XDiVORrJ2USzB/ubXdwidwPUcWPWsAC5yMc:PIsSz4Gl7DO6vMt
TLSH
T17A24C31727EE011671B7961CEEFA00A69D777C06253D8D2D009D2E4E8BA3E125853FEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

event_manager.log

Path C:\ProgramData\Avast Software\Icarus\Logs\event_manager.log
Size 142B
SHA256 feec6a1c3f52a4a6a2935851955a5f0dc5617b21907cb82185591d7b56ee77fe
MD5 79ef31fb916b82edd1f1d63dfd8ae00d
SHA1 fd823b6c0085f9de66293248e2e135cd170f1a7d
SHA512 e9cea42ab7a30f739c4944769b705e63866561325c531e4a13aa633163ec63361f4da8b3c8f1b34258b55fe2d3a689107c579147278485782d3f918403751734
TLSH
T1E7C02B02C54F7DB0823E0B30FA316C098C8051F3141C8E02344FCC4C735F90403801D0
MD5 SHA1 SHA512 TLSH

Submit Download

icarus.log

Path C:\ProgramData\Avast Software\Icarus\Logs\icarus.log
Size 195KB
SHA256 f20e765c5cc95aa7ba7ccd962eb9b5c589ac6e72cfe5ce9bd2f1efd7813578fc
MD5 c6dad2aeaea83ab9732cd2a0b31771bc
SHA1 1964f528b630bea110a32182840aee403abe2c07
SHA512 a4bb52cf102963a11633becfd56bae5d496d466240b716fe55686ec6496fa5495dec4a2610091118037cae868ce42f8b1e191ca9f7d81303325d3254563a2563
SSDEEP 3072:8p/wB9lkqPD0ENH1JBEIlwzGZxTnZjg5NsBCPO3SnozojyvHe0kqUS0eUiE/xDFK:iVs
TLSH
T106144693811FB0AA4337665495A92EE4DB7533E3275C089A3B9C9F8C3FFAD14074B618
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus.log

Path C:\ProgramData\Avast Software\Icarus\Logs\icarus.log
Size 127KB
SHA256 8cc6f5b5c4ac7761c1b8ac18986873eed65f3f58ccb9fd1b870a4d7320a64298
MD5 263824a93b57472f78ac04bd5df25681
SHA1 14f06e85068197094427754153d1c9de26eb9f9e
SHA512 43a39900efdea922ec2b65918783047937f97f8d2eb6b1ecb990b93df601217796085d6abd4bd894a3fe855c42e02c881242e2ac7a664b4d9d5b22c229a7d34a
SSDEEP 3072:8p/wB9lkqPD0ENH1JBEIlwzGZxTnZjg5NsBCPO3SnozojyvHe0kqUS0eUiE/xDm:iVq
TLSH
T1A3D36653851FB0AB4333564495B92EE4DF2533E7275C08AA769C9F8C3FFA819078B618
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus.log

Path C:\ProgramData\Avast Software\Icarus\Logs\icarus.log
Size 68KB
SHA256 bd9e9ea6315ebd9f1518c710f74020ff7d57aca46f694cdc67e4885eb91456aa
MD5 3fd886316e8fc2ec665ca2f171141c44
SHA1 335240cf97e5ceb10c68e3af0f04b4e81ba9f259
SHA512 be20bb37793d0ea0c685fc11508707ed6b9a372b04c6b9681f81f5c115648cde0427962e45e152ac0e4f48fcfd85a209f2ff8b640dbf047853fb15eefd0075dc
SSDEEP 1536:8qs/wB9lU7XTRxqPD0ENH1M1oDzHBEIlw9:8p/wB9lkqPD0ENH1JBEIlw9
TLSH
T1B4635452851FB0EB8733560492F96EE8DB287397165C48ED768CEB8C37BAC29078F514
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus.log

Path C:\ProgramData\Avast Software\Icarus\Logs\icarus.log
Size 147KB
SHA256 c276e3b875969be28e683ebff715ed776a8c1fb46bee50addc791b26bce9e685
MD5 af1f553ca0c6bea1e8e1c58150b6d938
SHA1 937751c15e33c5386cc42ef1b71dc248899d8e6a
SHA512 64e176da116925f34f3c01d2a8748ce816880a6b1bc52059d4874c1a69095dbaa569cc2436824225a710b908075c8e924a1c81f86bb48437a8729ba824f7f80b
SSDEEP 3072:8p/wB9lkqPD0ENH1JBEIlwzGZxTnZjg5NsBCPO3SnozojyvHe0kqUS0eUiE/xDFr:iVh
TLSH
T1E6E37653811FB0AB4337555495A92EE4DE3533E7275C08AA7B9C9F8C3FFA918078B608
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus.log

Path C:\ProgramData\Avast Software\Icarus\Logs\icarus.log
Size 2.1MB
SHA256 aaec62cae0a8ef0db54bdcdcb7ad2998c0c1e1376769cbd082786a301b74835e
MD5 eeb26d5b29d069343d7571c8f2ef4ad9
SHA1 a39da13c3268c0212e6e5e3273f3366730733bfa
SHA512 ba0105d2d2c52347d137110f239325065a679606a63310a3666681133b34b4d0c304b97e48214155bfb64f02956fc98163dd2888d923365497ef6b9408e80f0f
SSDEEP 12288:iVnlatBJdiAb0P8GkfNipiWxi6y8IEwCex/YtvIkYB5h:XDJdRb0+fNip/wEwCex/IvIkYB5h
TLSH
T1FCA57107790AB9FB02235189E2766DF85A222297D1588C47BB7DCB49FBF5D5003E23C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reporting.log

Path C:\ProgramData\Avast Software\Icarus\Logs\reporting.log
Size 2KB
SHA256 88483ec84013db201228b9545ec5c2959109fa42c2bf94279d4c903ec923731b
MD5 2965d4002e96da960bed29562863f23e
SHA1 3a90e38130fb1f1444c9fbbce9087a8fae50d972
SHA512 4f6a2b832b777ff49a3fe7dd5cb294d92cee83a20e5e926864dee0722438606a065133f7258ac515d72a1c80c7fc4fab937a152e806cda9f2eedbd5e24351036
TLSH
T1C851B46CE8212662CF245ADEEF323ED90D2679AD2360C588AF856748045CF16DBE00CA
MD5 SHA1 SHA512 TLSH

Submit Download

reporting.log

Path C:\ProgramData\Avast Software\Icarus\Logs\reporting.log
Size 8KB
SHA256 c62e98c5f13bef7aadcd53ffdf81a3d7a6202fcd9d629fc5018667c4c85bf4f9
MD5 a758b24ab9eb9cad562b52a45bc6f7ba
SHA1 9dbd8a71a2bcf4891cbeaf652979d5e0c40f2534
SHA512 e66d35de15b13f2f040f060698e681e57ae2529fae61f885d86c3b9e9afa41a5b6a225d2c5bdabf2edca45d53d2475488c3f31fe06740530ee68493ffae1bfda
SSDEEP 192:LqOWgWOI6PXCkubc97GE8Qkeb53J4lvng0PpWRagxVCvKEOrV:LqBgWO2kuoQgkel3SlvngqWogxGn0V
TLSH
T19702626DE41060518F2066CDEF36BEDA0C66BA8E7751D5849EC19B48087CB3FD7A11CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sfx.log

Path C:\ProgramData\Avast Software\Icarus\Logs\sfx.log
Size 11KB
SHA256 9b448504f9d4ad9a5d7a61ab26143b9f13d8f0fbeaad5e099516fbbf9a2fb2a5
MD5 0fe11b35fd96c5f414ef761dcef945ec
SHA1 f0e6ae541c1d4c3cbfbd1b378e2626ca911b8026
SHA512 cc405bf169f8289efe0ebff625e845905f04ae50eb271696abecc5b46c574462a99dfaf8ebb61225597bbab27a257b279897076326d1c9b9851d7fa409743d43
SSDEEP 192:HKWi1B4N5A2eN5g1gPGsn6ITt/KdP475AN482eN5G1oJtv6ssN5u:HAU92giPL6ITtYP417J2GaJtv+u
TLSH
T15A329726F52FB0F34A365641E1793BBCBA5CB3950ADC08593A5CF51C63B3931DE02916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sfx.log

Path C:\ProgramData\Avast Software\Icarus\Logs\sfx.log
Size 13KB
SHA256 bbfaa4dec498a6c0c199519664999f3c528172b92f37781af3b8ae87b28316a4
MD5 d040983e5505957a72020aa78d008937
SHA1 70a8711628aa0a1f61280ff745366cf053200079
SHA512 999686098c3ce8fdd7077c54c8165d86a6acf51816f436203fd69926ff6eb27f8a290db8ee9429fed54f09817ec6fd5e57a42a7705b942c28e8ae7927a98721f
SSDEEP 192:HKWi1B4N5A2eN5g1gPGsn6ITt/KdP475AN482eN5G1oJtv6ssN5f92eN5t1FB:HAU92giPL6ITtYP417J2GaJtv+fo2t/B
TLSH
T1DF52A776B52FB0F34A364245E1693BBCBF28B39506DC0869395CF61CA3B3521EF02916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sfx.log

Path C:\ProgramData\Avast Software\Icarus\Logs\sfx.log
Size 13KB
SHA256 c21e1153f54cfcadece87d8305dfb723e0ba88cac8ebe152b4fa32c00a958ea6
MD5 c6b686af28cac7a91843374bb067f6d9
SHA1 c7ce8ccf074577237ae356811a0cc658d0d1121e
SHA512 197b265419ea7fb9f9f2a9d0169a4bc7722166ceac8615fd867209c70f73a8125f04a748e3a20e5960178a735f3bbde8a2b137d92f2df7d2776b1c7085c15c68
SSDEEP 192:HKWi1B4N5A2eN5g1gPGsn6ITt/KdP475AN482eN5G1oJtv6ssN5f92eN5t1Fk:HAU92giPL6ITtYP417J2GaJtv+fo2t/k
TLSH
T1AC529776B52FB0F34A364245E1693BBCBF28B39506DC08A5395CF61CA3B3521EF06916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus.ini

Path C:\ProgramData\Avast Software\Icarus\avast-suite\icarus.ini
Size 781B
SHA256 4777a01f9d2414c75ce71a7228b4e30f58bdb369de5f1f034f32969f752b56fa
MD5 b692e16b9f6a28f8ff02f2ab958f0e8b
SHA1 dd5591b76b314f438034652703615af940a52cd6
SHA512 438996f2d1b54b364fb31dbea173adc34f2f3520a037b7868e0806ba608433565d69e7ecddd50216d97500f4044cedefb194656018e03891b3c46876793e416d
TLSH
T16E016D66F9A6C792443AC7B8D3244EF1B58D30135C1362C273CFB92971C6A283A5D05D
MD5 SHA1 SHA512 TLSH

Submit Download

temporary_proxy.ini

Path C:\ProgramData\Avast Software\Icarus\settings\temporary_proxy.ini
Size 278B
SHA256 8e511706c04e382e58153c274138e99a298e87e29e12548d39b7f3d3442878b9
MD5 b8853a8e6228549b5d3ad97752d173d4
SHA1 cd471a5d57e0946c19a694a6be8a3959cef30341
SHA512 cf4edd9ee238c1e621501f91a4c3338ec0cb07ca2c2df00aa7c44d3db7c4f3798bc4137c11c15379d0c71fab1c5c61f19be32ba3fc39dc242313d0947461a787
TLSH
T194D05E5307FA0008F1B74A58EBB898F2573378152F4DC02CC0C0121F84F2805892BBE3
MD5 SHA1 SHA512 TLSH

Submit Download

browser_assistant.exe

Path C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe
Size 5.3MB
SHA256 f399f3c94ce8b3d6666a8f19a0c33d1e3e0b09ceef4887d323e7c4a35cfbd686
MD5 1190287cf70a9c1f8d1419bb8a1578ab
SHA1 8f2157812920d792afda16b1635704382d7690e7
SHA512 5f18f396777ae25915d90854c4309800ffb8e17802aae9011d50d3c2c8af045f07d4dfbf6ff0d5e4e4babebe0643ae122e28d9a02a36e718bae9150a7e77def8
SSDEEP 98304:V6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwO:l1J1aqNY52B3EjP6Li9WyVjYr7GX
TLSH
T19046BF53B711207CC84B68B2643C6F7B8C291D63972187DB89E83CA25B749C26A3D75F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_prefs.json.backup

Path C:\Users\Admin\AppData\Local\Programs\Opera\installer_prefs.json.backup
Size 1KB
SHA256 c399ef65c668872c667bf053d15a1ff8af1be11cc3adb1fad9161a68ac3396b7
MD5 35ea874e4e949ce6dec29cb52018819e
SHA1 31f87adaccdcc4840cf75a52f942d5b49e120638
SHA512 a370f0b4de24b298510a445437b0394eb672b560b0496c0f434c0deef43c825570a59611a5cdbb4c6f7fa4213ef3038759227d33a467d1e92863af2ab7db2cbc
TLSH
T13031C670050150323F22D35FE6C7361E77035503E81920E52AFA0A1E68CFC9B672782B
MD5 SHA1 SHA512 TLSH

Submit Download

opera.exe

Path C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
Size 3.6MB
SHA256 dd170415a4f97821d9105524f6c200c480ea40aaef4749128a1653f01304f133
MD5 6eacddfa1b6e987a2534bc8b941ab7b4
SHA1 f9918ec093743c8ec3fdc99d5058bf7193301138
SHA512 6f5f67abe94f2f8451a2d9f572103bbfe12283491ca86ae5abd5fe8db6154bf4dc09be81aee9e8ff7197831bfeeef8388d127a9f2be38be13e74211f458dbe4a
SSDEEP 49152:y2LtAQXW9x4AvdA7mcuHqXuhJP0Uo0XMe2rhXTxDyPIUfRnsar8lG58:pA5GrMzj/92
TLSH
T148067C53F2D510D8D019D179879A9633EA72BC564B3166DF0690B7222FBBEE06B3D320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Opera Browser.lnk

Path C:\Users\Admin\AppData\Local\Temp\.opera\f03f564e-691d-4868-9877-1ab5ab63636e Opera Installer Temp\opera_package_202611021214081\Opera Browser.lnk
Size 1KB
SHA256 7f1c716eed27bd37f470d60f680de442529eaad6d33d5b6e91aaf2698409639b
MD5 bfe32cd05d489287169b9d0b788e8ec5
SHA1 56beb9178f9af9814ec80251594a5233bf52a612
SHA512 f296643425969af61226461549297287a6386f49de3f0f3a6db26675a100ed510650d2eb0f9611ae22fba292281f660de7514252c176aa138d4316587da378eb
TLSH
T108210F59ABCD2761F3BB843944BF672652B6F851FB074E0C0250425A2C7C2817958F5F
MD5 SHA1 SHA512 TLSH

Submit Download

additional_file0.tmp

Path C:\Users\Admin\AppData\Local\Temp\.opera\f03f564e-691d-4868-9877-1ab5ab63636e Opera Installer Temp\opera_package_202611021214081\additional_file0.tmp
Size 2.9MB
SHA256 30786977e61add36f7c641facfb7fce1b2ec7c2a0a7e055a172f127a68788556
MD5 cca6f6c0abc234866a5ea00e97d1745a
SHA1 6ebf31a5ea9b2d89a21fc565591185ee93493553
SHA512 01b9b870d6ac45f9908c6119d48bb82b2957aae2d4d72153da5efa81ca97a4f13136fdb24bbf1ac8ab2defa094a573e2137c1202f324fb9b6453c5c79fae6cb8
SSDEEP 49152:3kinowp5Tl8RRjPXnYcilTS8rmJ6e99FiHgfCNJwFdIKLpUCHSa2PNvVseb:3kio+UDil+smJ6es2I3PPpVLb
TLSH
T142D52330B9D48870C32756338DA1F7AE55BEB6B0473989D773980B8EDFB15C39A26406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

assistant_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\f03f564e-691d-4868-9877-1ab5ab63636e Opera Installer Temp\opera_package_202611021214081\assistant\assistant_installer.exe
Size 2.4MB
SHA256 e8dce277d6edb918499526fadba9902e317496c2af077219f263a7a643467824
MD5 81a58f8ff0989c0089e24dfa658dccfe
SHA1 7db84aa7d78ca19a25f5d2db30f169590af165c1
SHA512 e91f4faed65a043cfa7e350441d5c5849b81798951d574e8b42330e1d645b1e4cbbd33315fa1aac258e00b9883dfa8c3d865164c07d7d498e98f4c754c6779cf
SSDEEP 49152:4fuSIF/tZVHY1OADJCH/wmQ5ofRUwzcvz86eCkWI37aVU:4GSIF/fVHY1O2o/rhRzzcvzRetjGi
TLSH
T176C5AE02B99094B5DCA63032721CE77D9A355E114F364EC7AA90BCC17FB4AD2613B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbgcore.dll

Path C:\Users\Admin\AppData\Local\Temp\.opera\f03f564e-691d-4868-9877-1ab5ab63636e Opera Installer Temp\opera_package_202611021214081\assistant\dbgcore.dll
Size 196KB
SHA256 c16220edd3787da33dbd3ac2fcbec7de6a13e2baf14ae6105bba68d4efd83628
MD5 84d406838e3b80a2668c466ca5cc8e57
SHA1 bb60b9c299f28bc05eb7a29dd19ad64b37c612cb
SHA512 b5261aadb18743835bcba65b2f5aee0b888e8b7c6bff21deeeac546236ac892ac00722c2d486dbab969f8bef8957ca9576dc5301780ffe088fd5065b6c57a84e
SSDEEP 6144:zASh0NdOkBakZykbp/eyhr+SJors+k0L3nTI:WYIqFLnTI
TLSH
T1DE148D6296840833DD9F11B8B29F333795FEAFB0139194D362509AE4E5647C06E3A2DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbghelp.dll

Path C:\Users\Admin\AppData\Local\Temp\.opera\f03f564e-691d-4868-9877-1ab5ab63636e Opera Installer Temp\opera_package_202611021214081\assistant\dbghelp.dll
Size 1.8MB
SHA256 990b13e88b4a9985eb5c596078e2ec26a0edcc22169dd71f8a84c7943005306c
MD5 c903c1fd205157a96848017f1cc5f245
SHA1 1eefb8e49a4c663253e75e7a862d11524a88525b
SHA512 f9e5a1f03f18b226a9e3d694aac4220c806cc30dab0fe951dab1c62dabcf9c937efb79b4c4a469966a141b49aa358a492ada771d67426fbe025d59b25e51f705
SSDEEP 24576:zDOSE7VspFPxh+EqYbt6lyn2GyQWKACVOxHTdMgh9IVbMAQyvyXiuVKHeeKKwsfq:zqhRcFPxhHYCBRnyHO6W6NIyX/kQs2x
TLSH
T101856A20E784813CE4EA0177E67D7A79866DE134073440CBAAD45B69782D7C3AF386DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de932af914ba00303d4a2778a383ac9c831101e2.crx

Path C:\Users\Admin\AppData\Local\Temp\.opera\f03f564e-691d-4868-9877-1ab5ab63636e Opera Installer Temp\opera_package_202611021214081\de932af914ba00303d4a2778a383ac9c831101e2.crx
Size 3.7MB
SHA256 ddee330dfaf285dfb3e7e12600af030580ffd36042a37e1515dc030ceaebd245
MD5 dc949b486646dcfe52d0a2c2b5070ebb
SHA1 7bc1675d0ded9c941a1d7577a3d65ef8ff280953
SHA512 7442f6d22ed660571c6286b5d32d5dbe694a4bc69cc2b91c756b9ed16047992008f4dc92f31045ea9534406d676c50f2574adb54e0ef85647ed63c90f630afa7
SSDEEP 98304:dhkwNSNW7uUSKQExGB07RFq3iWXYm1Sd93TB:dWwNSNWSLP4GB0rVxm1wF
TLSH
T147063334DA3498A0CDA6D2F2C9222B891AC0825ED594F92F3B6556CB34F3DD4530AF7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_prefs_include.json

Path C:\Users\Admin\AppData\Local\Temp\.opera\f03f564e-691d-4868-9877-1ab5ab63636e Opera Installer Temp\opera_package_202611021214081\installer_prefs_include.json
Size 243B
SHA256 b94ddbd440a56a67d20b31014ac6f0c2c5194eef20f72430cc8a9f144b88642d
MD5 dac2d8baf4549e874cad8ac7e5e3da3f
SHA1 e5e37a536e1024c3558703d5431ad84ddb2ad05a
SHA512 1aa9c71264138df30aceb5b3d33967e5928401e6e4907921c03b5869a6297bc3c807e40ace05398fce996f78959482230d26dcb69947b019c5328221a8facd1f
TLSH
T12ED095514141D0D33775C14F3537334CA69157109C51744E59D14035801591335C7F3C
MD5 SHA1 SHA512 TLSH

Submit Download

installer_prefs_include.json34b6b28e-2b52-4f74-9c7f-2f44447e0209.tmp

Path C:\Users\Admin\AppData\Local\Temp\.opera\f03f564e-691d-4868-9877-1ab5ab63636e Opera Installer Temp\opera_package_202611021214081\installer_prefs_include.json34b6b28e-2b52-4f74-9c7f-2f44447e0209.tmp
Size 1KB
SHA256 7d8722e3fe69141f0974d7274794c610e79e3c6f670b45d9c0b5e0a6e5f7e07e
MD5 916615d27b5f0749d4d3703af95d4c92
SHA1 971f7360d1289a576084226aaaeb5d1529bbcbd8
SHA512 6514a686201e1f22bf8c66a484077384c7fa711a2f1babb5bcea82fe7eb443a4e74193f93e195fc5ec29705964e7bef59dd8c1c01db59015cf3d7a8739ce2fbe
TLSH
T19911B6B00880A0423F36D30EEADF270AF70347139D5434E620E1485E94DFC635B62D38
MD5 SHA1 SHA512 TLSH

Submit Download

installer_prefs_include.json81e65ec6-65f1-4779-b320-4219590f9b03.tmp

Path C:\Users\Admin\AppData\Local\Temp\.opera\f03f564e-691d-4868-9877-1ab5ab63636e Opera Installer Temp\opera_package_202611021214081\installer_prefs_include.json81e65ec6-65f1-4779-b320-4219590f9b03.tmp
Size 258B
SHA256 dc10e84428dd75daaede0194129ebb8ad8a9f6c2c2b77b0e5e7b688dbb8c487e
MD5 c36ac2bb1a636f9451f3e456e236157d
SHA1 771c7aad80be3361d92c59911a608efc4b69380f
SHA512 d792d8acc968d11a1bd22744df425514fc78a9c7eac45c3f3b78569cf4333b28261ec11628b7217eeccca87b8de462b2c4b30776fb5ab77d4bbe741ffed315fb
TLSH
T1B0D095554151D0D33B75C24F3537334CA6D257109D51788F69D25136801595335C7F3C
MD5 SHA1 SHA512 TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS86F03869\installer.exe
Size 8.6MB
SHA256 82e4b2505e5407908cb8b0209959a1a65875e9c4022fbc5ba413d01c744ee6bf
MD5 6d0b394b0f1481daeca60874aa4da83f
SHA1 5758d40148e9c668d43f61e465c1871fcd1cf435
SHA512 1f6e8c483ae0a3493f5ac6e6edeeacc8145d70db0771542ebd94577d9dada0fda51b3cb00285321a5dafbc596598a33700e2bccc50ed365af74f5249a0706787
SSDEEP 98304:o8m2lX/zPrtliPTLD3Qd4Oms4EDEho6mmKaQbizQdxYNY8AFW:PlX/zP7ib3Ad8zwXFW
TLSH
T100967C53F3A611E8D06ECA748B7A523299757C464B30A3DF0AE43A251EB5FD45B3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winrar-64-7.01-installer_SDS4-S8.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-5P2KKEU4AA.tmp\winrar-64-7.01-installer_SDS4-S8.tmp
Size 4.3MB
SHA256 dcbab07aa57abc62b3c90ba58cbaa0bfb77d0bbed023203f4f00702a69eba9ec
MD5 f14a0158a0a0e2ec8d0d996aed5f8cb5
SHA1 9c0191cff6abe73c0533d2fdcebcf1c47a072927
SHA512 5f604bb69e27d3c8634b1bfff19dfc763a4a2e0272764b80179351c656d6a4f010a8e36c78b610425bdbcf7f82e09fbf984059f254484b0aaae5600e3c401876
SSDEEP 98304:dYU5hnuOajWwMPdCpepI3GrwrA+J/333AMo:PxuHjWfZIzMMo
TLSH
T1CF266D03B248A53EE4771A3A583BA280983F7F213925CD4B6BF4395C8F395416D3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Avast_One.png

Path C:\Users\Admin\AppData\Local\Temp\is-UOI94ZDW0C.tmp\Avast_One.png
Size 42KB
SHA256 2ddd50ca3bb30387c309b0a627cc14f2820352679caa1d59f0dd35aed9540453
MD5 faff96fb8080a98bd1def3c4f9cce9c1
SHA1 466c66dfaed49d93dd7d8a1e42919a4f03613efa
SHA512 ad87ccc0bcb0115d5e7255935c5bd2b5eeb85b75f46206987d85f0f5e04afce054b0b3cee3d7577039db6ddbff1f0fdfdca657b7877376e4f97c80c5ed7514b7
SSDEEP 768:53E5YnNz2SLHvDYgWfGHV8L77Yy/oksC+x8+RfWpzrdYnsi2anUpMQb3HGJ2:536Ynl2SLrYHAWHDgEqCSskn0nqA
TLSH
T11613F1B8B8DE416DDDDED6B8FCE66FF564816437CC84D1EA800CB028518E784366636B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Opera_new.png

Path C:\Users\Admin\AppData\Local\Temp\is-UOI94ZDW0C.tmp\Opera_new.png
Size 51KB
SHA256 3f63f320e919830fb21fff8dbd82509ecc8330c89513163daedb1b7687a0a529
MD5 958233a25ac0c23fae9451963eca0de5
SHA1 8801e6dca9e4e4ad1f5b49caa097733877cf2e2e
SHA512 996177a1a878ca82c1ce02f8937f51285aa9b7c92471fe9c19b41892739e82aaaa7ebcb7f396d6d777da822578b1db1fea893ed55708521e4b8e31a81cacda0b
SSDEEP 1536:l7LeXprR91MWpD5Ko2ORwQWwyJUcbWb7H:ApzWTo2ORohKPH
TLSH
T1E33302A0B153C51FBA8B5211D2043975776E92F6F860FF4873CA016CAEE5D415B173CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

component0

Path C:\Users\Admin\AppData\Local\Temp\is-UOI94ZDW0C.tmp\component0
Size 3.2MB
SHA256 a4fc78b8c8fd816b94b463c572d69e91eebceb1d43359b3a963177416091a819
MD5 5d08cbfecd07f23148395e9a211e5641
SHA1 947a73c6efc59ec08cbdff74a71ac0d4a44336d5
SHA512 efa853a56f4bb2a12ec3acbe6276985fc49ac29a515c9282b4aa3382eec482048259fbd806923877abe1a2b01ad725d0d49ae2026dca5f0b955d2faf959f1ca2
SSDEEP 98304:6Ah1iO5GGPXNI59rdjXM/Ltn0pO1P3k7oOfE700z:pcG+rLI28falE7Jz
TLSH
T16FF52342B7C0D875C22311325F66EBBD967CBD610F359B8777881A3E9F702829626F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperaSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\is-UOI94ZDW0C.tmp\component0_extract\OperaSetup.exe
Size 3.2MB
SHA256 f3219d084ee11f5486a712c7c569dbb147a910db3288046ce49d3788151a52d5
MD5 a77ee64dfa0ca66101912f79366bfa29
SHA1 e5043bb28c2703c97dc1a4e93d04f7e395c5f778
SHA512 69109cd941dd7afae3ab622bed2b4dd8d99dab6857d82d009b5823efa25147cf8b74f2e40dab28643bcc9d18af7fdc141e59a1b80d0702defc091e14be7259fe
SSDEEP 98304:pAh1iO5GGPXNI59rdjXM/Ltn0pO1P3k7oOfE700D:acG+rLI28falE7JD
TLSH
T12CF52342B7C0D875C22311325F66EBBD967CBD610F359B8777881A3E9F702829626F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

component1

Path C:\Users\Admin\AppData\Local\Temp\is-UOI94ZDW0C.tmp\component1
Size 782KB
SHA256 4a59596213b8e401401fad6249213596400943f72f98d8810c48538374137f52
MD5 2c7be73f369c90ce32bbf5b6edcd9cd4
SHA1 aabd8f656ea80ea72dd17f2819fbee64e6f4b560
SHA512 312502f64439a7debfee5b47197e481eab490604803bd07eda5fa3d1a1e8e7de3e6e687693932ee5aee85e56ee059b790a7f47a3754f6818e14fa1cf6a0a7815
SSDEEP 12288:YV/ZeZ0C6U6lQzc2+KcqaYTmydhmdfLNz+g5WOcmpMi2VWmSKAf+4l:g/MZ0RTv2hnKydhEz0OcoMiCWNfj
TLSH
T1FA053380AE40F676EB81CA213FA7E5DF35538D923BC1797D61548088322DB6EF5CB258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookie_mmm_irs_ppi_008_585.exe

Path C:\Users\Admin\AppData\Local\Temp\is-UOI94ZDW0C.tmp\component1_extract\cookie_mmm_irs_ppi_008_585.exe
Size 1.7MB
SHA256 2ab4329fb77df9f5b70ac45d9fc005f019c8ef930eabf82e6a10052f9cbeec2d
MD5 11a225495371d91ef254a5c69c967ea6
SHA1 ab136cbac42cc54a6aa15f7eb43eec1c6647dc74
SHA512 5012d9fbc9401b5c5a377f100560c637adc98d319749bb599a0a0487417915f647032430ef027c69cf1a8fecc2d63a741f1aaec71611dcf292db109a35c45023
SSDEEP 24576:tuRu5fl3AFG8CWgd3jEDigqqP9WhavTXeS0h0lhSMXlOncOy9x6mWFI/RV:bJlQU8CJjqF0wuS5icLxxWe
TLSH
T198859E207B42C07AD49A01B1992CBBAAC16DAE744F6550DB73F03F2D6D711C22B35BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mainlogo.png

Path C:\Users\Admin\AppData\Local\Temp\is-UOI94ZDW0C.tmp\mainlogo.png
Size 171KB
SHA256 6dcc06642e538dc9a800fd95dbac995d5c436ba3c5349fbfe705aa693e4a91e8
MD5 36f590b00daadbff7cb341f891cf5362
SHA1 fa20d1d63521c27071d948b00b2fb5c7d098ba67
SHA512 0b6cc8a9883d3aafea76f7d49e4e3532fbd0852375ebe1fe2b61cd408aeb99c2e423aaa720f9cadeb689d1cffc656362a6fff6dfd8cec58c5a7e5c079f812082
SSDEEP 3072:sEfED5/i/YSLcgVRi3UgoXE7rfQEER9g/Llh+DQalQERxeHtHIPf8iYNMYTQdRn:56ZiA2Lz1E7ro7ULlh+VQEXmtHIH8Bh2
TLSH
T1FA04129DDDADAEA8496DE072707E8DD530C4E01A51C3E8B06BA2DC8B1ECC5C70D52F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yes.png

Path C:\Users\Admin\AppData\Local\Temp\is-UOI94ZDW0C.tmp\yes.png
Size 1KB
SHA256 618d2aa1e529c55347db75768807ef36f12e24694f035ba23bf5f2fcdeb26d66
MD5 c52f34811eb35546bb3fcc56ce9fe81b
SHA1 91ec23366f89d9a214d9f88a7813474454f92ecc
SHA512 03232f79bd4826e2790b020fe37884ce843b179becdd3e5c5e4b9cc655e530017e2bd0a15d32983fbe3b3c55d25d7d1d89750894ada6160da6976a54b155dee1
TLSH
T18D31B7A00DCAB564CD0E91A2C6FEA10C04F93DC993C5998AFA57D847A19007324F8659
MD5 SHA1 SHA512 TLSH

Submit Download

6173.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5800_2033727027\CRX_INSTALL\6173.js
Size 1.4MB
SHA256 9c151cf3b20cad6f5ff9f21d2792cbaf0822f42a31708904b95fdbacfa8478e2
MD5 83c7481e760ec14eaf178c5edadc110c
SHA1 86132743aeb5b89a0886cfdd74b0aee33645a19b
SHA512 98540e26b61e95f7ee5cad7e6d307b5ee24c30d900a04f930fbc98e3cf6f79fdc30dd2a7b4fdb69d099cbefc31827a2a63cb6a8d5883f77399de4b8db7d7bc93
SSDEEP 24576:rRZN6xh4/Ao9oLddty6LZf/d0GUiuCqbBAiY4aBi:dZN60Pwy6LEGUnY9i
TLSH
T19565AE327A567C3A87D7428B649F090275BC4476F60CC91CFAF9CC7928A844652BBB7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9901.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5800_2033727027\CRX_INSTALL\9901.js
Size 58KB
SHA256 f9b931ba7aca11be4548672df13626ea9b386eb9d2968548dac089a6bb6d4b0d
MD5 d5243bcf35b23eec4f591418a8798faa
SHA1 748353439dcafa1365ab870cead3d88be6c695f8
SHA512 6aa4696358df4cc5932da6657c8cdb0fb6b0234c1d21f903e3bdcf61bb4e184807b89f074e351e5d7c55e72855078689ccba8a9b5b566eb90d4b06731fd18545
SSDEEP 768:xka6zka6nSame21w0nq2EsIr6DeSDHeSmGBK/FTwMdQPfcNII9TDQncYVf/KgAeb:xka6zka6SamSymGSd0cfOcvVA2Y
TLSH
T1C343F806CD344DBB07A202D9BFDA6B07C1E8450583A4889BF95EC87C88DC7D9947BF5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aria.html

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5800_2033727027\CRX_INSTALL\aria.html
Size 531B
SHA256 4e06e363ec440e54c47825436157f4458572af415118f665a4159b934564fd16
MD5 b4db0d463c1186c132e0f0aeeff843de
SHA1 1d9e825ab12fd5370811b20672a257cc88036c23
SHA512 18b0035e0bd06ec2574df3b4620709a9ecbef2b759bd682019cc4b12dc0e8f38614ac87d216da0ff3a45530f033b900d6abd63703d52ab88851efc7f118dc1cc
TLSH
T193F09ECDCCA5955F52238DB49C31B61C08DCF746C7618E007EFC61B5AFC0F548992A85
MD5 SHA1 SHA512 TLSH

Submit Download

aria.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5800_2033727027\CRX_INSTALL\aria.js
Size 12KB
SHA256 b43a029e3e886fea3661174de0b8dad58c6f50d9218553fa5bef5717815cd943
MD5 059b3b2ed559f00b012a9d7e468d699a
SHA1 88f1fde10723e40793ad114a02c2032c7a477828
SHA512 697eef8eb6196a2c5266c1bf389f669bbdbcf5e23db80aedfc9aa8e7fb35b219f5797d7332cba889a10848381e2a1cc6e0f62ce0701b9b572db12d78d334b66e
SSDEEP 384:zka6Ska6mZame24XdsmdSpebJnIb6NOuCdML4JV:zka6Ska6mZame21mdyeNI2NOuCdS4JV
TLSH
T14642198C75CAFC354BB341AA847F1206B2AE1545247EE0D0FB22C4B4A8657CED227B76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2f4d0c616cea0666.svg

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5800_2033727027\CRX_INSTALL\assets\2f4d0c616cea0666.svg
Size 589B
SHA256 32499717ae28339dbbba06154107872c5769810f691d68db46d9409be5365127
MD5 3b451231fa25303dd9b84d110a9a157f
SHA1 aeadf763c4a3ccf22b16f0601a28842e98df0d3b
SHA512 f2008aca2e15c12a9d417b7df77a16efed5021f159dce4c5894c2c8b63cfbd3b6891943b6137178b25632193ab3d185c1ac432746c099ff700593d9a154e89cb
TLSH
T1B7F04677F3DCDF96A9E2CB35CB232471C0AE60A21408B2E8863AC120B3502A94816488
MD5 SHA1 SHA512 TLSH

Submit Download

c7c6749d23d7b7f6.svg

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5800_2033727027\CRX_INSTALL\assets\c7c6749d23d7b7f6.svg
Size 221B
SHA256 201cb9465adedd0fd56784d027ece0b539ba644ec0ed515de4b5a3c54cb5d112
MD5 e804f3197ce266495e04f590583ac9c5
SHA1 68f3eca5527bb166022369970c9b114344c23aa9
SHA512 9c8f152faa01047d21c63ac1eb6d3e593854224cdef64978ddc6e1eb30fcc0652f0be2df868a714c7e159d1d7aeda4e95b2d4b623aa13c28328f6d9be1538e8e
TLSH
T1CDD023755314CC3870214114E365342C75735453434F10C499312035B0595DF793F2FC
MD5 SHA1 SHA512 TLSH

Submit Download

ff8d935c2abdcdac.svg

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5800_2033727027\CRX_INSTALL\assets\ff8d935c2abdcdac.svg
Size 2KB
SHA256 2e62797f1b6c866bd2c2a5d27889bf0fb093bd8a25bab5f9dc2690861994b767
MD5 5bf5304ec1e3f6fece2ab5d8195bfe86
SHA1 81b2b4eecb1c8ef1cf8ed9c746c9f80c4b30d472
SHA512 750c6d8b9e6bfc81a2da1c3dddc28d46f5c5d33dbe8829a6017332bc38db0adaef1ed90fa74a6bfd4cc12910740e93769db37de97845f44c93a4e0849b923fa2
TLSH
T17B5178E465A4684C18C80775FFE945D62826E0D3F604079EE46E366A1157ED3FC2E3E4
MD5 SHA1 SHA512 TLSH

Submit Download

favicon_opera_one.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5800_2033727027\CRX_INSTALL\favicon_opera_one.png
Size 2KB
SHA256 44ee468b888578da502658d7f2b05b24d9034756701f49d762b00615f8da62f3
MD5 cd78c5defe6084243478de9874682e1f
SHA1 708c8c0649039ce9b3f8894d00b712d65d488ca2
SHA512 96744c72f623462f1c64c2e49e7a2387846ed65a78d94841adb3bb5b52f27d28f657ca3f2910b6b1b338a032a9b0e0ac47d23e7b25295d6841480b32268f4db2
TLSH
T163414D878974A4D5FA41D0215A037D9EF9BACDEF40970E5010D9043A427AF5573AB33F
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Size 40B
SHA256 5fc1681c76f47ed4d33a57f6265ea6acb087ed6ba8f0fefdb293e49abb2b398e
MD5 3dcb257a758db83d9caa1d0bcc216c88
SHA1 5898def0738e4fa46b56cff4a461e7cf8bd2f064
SHA512 9f1eaba174d1140b8678bd8645adb3a5eba42891a984c98c5580d8b9e26f75fa270afc030331413e3d33800168af0a34e73365a5c27799f4b8b95f6e043c92f5
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 6bb8ecd9110ed8d2d9147aa2d859b9e2e6fc06b778a0de0f9d81dcceecc8fb51
MD5 abbfcb196458a867fd73f7aa240b9a44
SHA1 51882ec346d6e4540a101118f1a22a6a29b8c358
SHA512 9583a337c51f12053063f2ac3c99af0241faa151ffe17ae6064de34fc8e07179e5135e7bc00508a47d355d9f26400e60d259d1ee060c6c1a80838dbbd4027b4b
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Code Cache\js\index-dir\temp-index
Size 336B
SHA256 4c6ae3d7919d19b11af0071bdd193bc96450d6cb889789a2ca7523e9c7a0a35f
MD5 a0888c4bb7fa278a0982d4ec17e63c5f
SHA1 e08b8bb3ad07cbfb03cb1b00ad93f720c3cc5343
SHA512 21438f3185f23214091f1b063a2937010ade7d264858c833c32fe2fe192663001cfedaa9d3dfc5be4918d74a1e752794a67ca63bed99c654a80e09957c9e4ed3
TLSH
T14FE0A9A004D82004CF0D02B812279EC0201B1C3300127B8B90A2C3B8A2ABEDF92AA32F
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences6fdd60a7-702a-4059-8216-0ef0a0905d6b.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Preferences6fdd60a7-702a-4059-8216-0ef0a0905d6b.tmp
Size 10KB
SHA256 d3a4b8c86b450a3b6933d1c154285c919c65bc136efa4c680266a6de95010ffa
MD5 c9390ae65ea22f1bd8e5ac22db60ce27
SHA1 7eca9d9b83216c2841a2da40370cf38bcc7104f3
SHA512 d7d5ff5dfb717859a78baa87ff50033705eb3bc0d17c3b7aa9b00a6db7ddbad3b347e216b70d654a5cff33b59fdbcd8e386b3294cc9619d8a9873246b6adc35a
SSDEEP 192:hb/y+yOwIj5tpXMZCiyl9KewNo6kC3zw+w2kghyzl36+WNOtcpDryIsngMgZ43:R3Xb0MeJZA
TLSH
T111328456A8751DBF1DD295A6FA11BB5BF3F40010A1967D98E7F9C82C28CF6CC3022987
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences.backup

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Secure Preferences.backup
Size 82KB
SHA256 7bab8d3929342b2bfd8bc451999de9bf10516eafedd366de2111b0d290f5692a
MD5 f902c6911e5403ad8b68863ebb7f02a1
SHA1 7d93311ddadbb419384ee1c65c1fc972a612e264
SHA512 f4bba21ad582d8d9086c296fead454e7f1b1f31cb25cc7b5f3e5b6d892bf5ca547d41b443b3247cbfb342bd9fb81e39abb57455a2a87cbd200bd9fb6293f29aa
SSDEEP 1536:y7q7Yeh7Sp7M4xX7bue76V7XI57z7baOC73CkvocXTG7EsOqHk6787m7Gw7x7A77:4e4SCSR4oh1+RV1gWvI
TLSH
T1A383D7E6CCCD9F758ED88BBCDC37AB2B959401059BDC9E14A7FA804C4386785213F686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

session_07a59944-5bc1-4dd0-9bed-4cc718421faa.raw

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_07a59944-5bc1-4dd0-9bed-4cc718421faa.raw
Size 445B
SHA256 2b7e5c1830b99cb495e072e35ff0a4810fae98db82046f250f6f2097c31438ad
MD5 277f4411da4ae5889d037c6cbe861c74
SHA1 a81b2e7f4f6a802dd613aec21fff1053ee2fe7f6
SHA512 85313c2d0151b1ae5f90ef00f19f720c431583747ac1e782da126f77cf6b1bd80874a2357d49aedd899506f67d4bd61d5f030a4b237719dee5485f30466081e3
TLSH
T1C9F0D42439E3514DE86DB1932D197F01A0935766D855A76100D1F601946592B4B81256
MD5 SHA1 SHA512 TLSH

Submit Download

session_07a59944-5bc1-4dd0-9bed-4cc718421faa.raw1c13c778-05b1-4849-ac22-edbd5bbbccec.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_07a59944-5bc1-4dd0-9bed-4cc718421faa.raw1c13c778-05b1-4849-ac22-edbd5bbbccec.tmp
Size 1KB
SHA256 ce9ad2f4fb912ef72f1236a7868f98b5e558adf085a89b8814c6a81dc4d95aaf
MD5 651a72ef107d1a64af2155c3f7c20c7a
SHA1 16b748edeaed773593079da048eca9cb670163f7
SHA512 0c1cbae4ef658e7874365b92c207f9cb6be6ff857102cac56d04a686eb5eb55c2626334edb293641bad0283b22cf537683e539573ede39d22cd8a7cdf5a12930
TLSH
T15F21BA108F58D7D1ECBA6453086BF72724514C1441C6D70D0B3D8DCA93B609A068D325
MD5 SHA1 SHA512 TLSH

Submit Download

session_07a59944-5bc1-4dd0-9bed-4cc718421faa.raw1d738635-1ed4-482e-b4fc-5c66ad23d6ac.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_07a59944-5bc1-4dd0-9bed-4cc718421faa.raw1d738635-1ed4-482e-b4fc-5c66ad23d6ac.tmp
Size 557B
SHA256 81b7648ab5157359aa141fa6ce1fa0f8ead62bba7826ad28437e80d109b0c712
MD5 a14021115e01be27c631e72c8fbaba7a
SHA1 f5cc59afc4d33de1c024770a9df13e3d2c9e7336
SHA512 5193161cbf0bf75fe9868b2aa7aa2c3b8638753943ea4d13fe7f86d781bf3642861f704671c7113cdc52b402700fdd66587c2039b4cd577638440e5391042b8d
TLSH
T1A4F0967E33B97402C2046051C50246CCFB80C481BC2BCD4B1A3DC25F83E357896013AC
MD5 SHA1 SHA512 TLSH

Submit Download

session_07a59944-5bc1-4dd0-9bed-4cc718421faa.raw38c2516a-bbd9-4bd4-8b9c-0d0fb1267b35.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_07a59944-5bc1-4dd0-9bed-4cc718421faa.raw38c2516a-bbd9-4bd4-8b9c-0d0fb1267b35.tmp
Size 1KB
SHA256 5ab036437e43b96646784f637cd666b64dbcfdb91c9e7ac574b4346d67ffbc6c
MD5 ab5c6c3d714515ab168e74e01f3f64df
SHA1 2b80903f3651c12fda607107f869a3dbdf5753f6
SHA512 50e86fb68f71c283d2cc8afe2c2b9770646eacfe931141b37da2f6720480821ca545d70be6b331bb17413b2bd1da96877dac476093269155c5aeda4b7144a1e7
TLSH
T17221E760282B0D48C78796067841845DB34E88735BE3FCD9AA5F103B3BB19013873F62
MD5 SHA1 SHA512 TLSH

Submit Download

session_07a59944-5bc1-4dd0-9bed-4cc718421faa.raw52f4537c-b501-4bd8-955d-dfdb77f9d3c6.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_07a59944-5bc1-4dd0-9bed-4cc718421faa.raw52f4537c-b501-4bd8-955d-dfdb77f9d3c6.tmp
Size 685B
SHA256 673be657a040d722eb9247291735d46d0ea32b6c224519e5aac23e9ec3ed6bde
MD5 03aa0cada8fce2ac3568a9e1b76807bd
SHA1 55a37360707f1bf2414001475c622db79e2fb340
SHA512 dd0c6db033d8db77c4a7d864dcc16525406afbcee528b86be1884df20a8dd56b4f700d22874c90ac0ff8a5d8e0cf1c5ae3c62e1c4adf1591ce5e0e445187a6a8
TLSH
T1B2018353302DC9EE7ADD4FD723F418120815002183AA2850B00EEBAAB96F8D610F34B4
MD5 SHA1 SHA512 TLSH

Submit Download

session_07a59944-5bc1-4dd0-9bed-4cc718421faa.raw5842b786-2aa8-4d5c-aea1-1873f9812eab.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_07a59944-5bc1-4dd0-9bed-4cc718421faa.raw5842b786-2aa8-4d5c-aea1-1873f9812eab.tmp
Size 1021B
SHA256 bbad4a436b426b577a4c86fd7e9779ab45beb23630699d8bb707f829cd2ee319
MD5 ad5fcbd6d68a90af0b3b059423a5c0e2
SHA1 57ef697a01de7dd53bcb244350e1a58b15a2ef38
SHA512 ae0bdf0cae4ee7b1f949061bb7103eb0d1c015f64f8a8b7a1d79b7406bf4d4d3d61553b43b641ee19b42c1aaaf9e1c3d079eb80e707c9cc075cf2d8efe7be907
TLSH
T13111D81288629B2089D013BA45749A1F00890DA44B21B708B437C7E93B3F18F289A1AF
MD5 SHA1 SHA512 TLSH

Submit Download

session_07a59944-5bc1-4dd0-9bed-4cc718421faa.raw7207d444-b630-4e9f-9206-8cf35efdcf08.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_07a59944-5bc1-4dd0-9bed-4cc718421faa.raw7207d444-b630-4e9f-9206-8cf35efdcf08.tmp
Size 1KB
SHA256 c9886e6d2dd0d3c1ac01987f58e98f571cb4459f031c233e705aa1c670edfee1
MD5 cf9d1d31135f87594ba00c8be0aa2606
SHA1 5261a03e04406cb292577b7d5b6799fc275f5c12
SHA512 d4545aa53f250210b942dbdc9c7b2e84426116a54a5dde72b8c9fa17a119dfee508fc4e4d81b03a344198bf346b0ac18424f7745ad260410c0df6d8008894531
TLSH
T10631D71B114B96ED17E2108BB3ABD5AD8C0405F4289FD4CC7C358DB14AB99D37332D8A
MD5 SHA1 SHA512 TLSH

Submit Download

session_07a59944-5bc1-4dd0-9bed-4cc718421faa.raw8d3f38b3-8bba-4454-8891-ec3d45b623c0.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_07a59944-5bc1-4dd0-9bed-4cc718421faa.raw8d3f38b3-8bba-4454-8891-ec3d45b623c0.tmp
Size 1KB
SHA256 69d29f3d79a12d88a1e2c77d8cd47c02b019cfa6d2b96f946545550beef388d7
MD5 06bb8d34e3ea992dc528a19b601d1d02
SHA1 d341960378f7ca45756116d3ed111794367dfe34
SHA512 c9101ea90a4238b5957c0fd692a7a7cf81961cdffb5ae32630b2d97c892e36a08f0fe94c9c188a569bf474bec43234e57fd0d1926cd104dfd272971a7cea6e5a
TLSH
T18C21DAA1A04404A307B6B0F415D16190A3AE2E4376BB37B696CCB3F9E301C6E87C7192
MD5 SHA1 SHA512 TLSH

Submit Download

session_07a59944-5bc1-4dd0-9bed-4cc718421faa.rawf8670252-b21b-47c8-891a-26be3f018730.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_07a59944-5bc1-4dd0-9bed-4cc718421faa.rawf8670252-b21b-47c8-891a-26be3f018730.tmp
Size 1KB
SHA256 a65888990ee51a05a81a5b40625fcfa0a6c25ad9461cac7da024d6bb632058a7
MD5 04ecefc7b96a43dec2d3a4b230a31463
SHA1 5870f7f5826f2861b416899678ed176e158f9fc1
SHA512 b082f3fdcbda1f4ef963efec79b4fddd75d0d5375c26eb1cff5e2dc8754be5dbf0c715cc2fb31ad8c3a660ab44452ca3eb28ee1d613f582e75144cc65aebabb7
TLSH
T1FB21D83A98C001A6A87379C6309EE085EF55C80E91A71E7EC85CA3D0DDE62608D9A380
MD5 SHA1 SHA512 TLSH

Submit Download

session_07a59944-5bc1-4dd0-9bed-4cc718421faa.rawffd8fc93-1c0e-4dd9-8359-80d6f85ec8c3.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_07a59944-5bc1-4dd0-9bed-4cc718421faa.rawffd8fc93-1c0e-4dd9-8359-80d6f85ec8c3.tmp
Size 845B
SHA256 86611d07a4f8398abe0633d66257bc4f75288b5c7d04d6001b2e987e8d356bc2
MD5 04917b5c7661711f83fc133d94c7bbb6
SHA1 dceb2152a1d86066ae6a49fcf5bc5db8abafee1a
SHA512 0f8c22bd17921aa6bc34477f83d7a0f768789ea995e1909e137db3ce0030ab7e148f9f1ac3789125b5feae2ad5d85b3ade4df6748d4049ebe9ae1133ba7934b0
TLSH
T18B0152BA6C4C6BB1143AB7824B6E931E021870EE862F76BA52CC70B544193DD18508D9
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

ssdfp5800.0.1600082120008bf7a7-61d1-4993-92f2-2171abac5b5e.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp5800.0.1600082120008bf7a7-61d1-4993-92f2-2171abac5b5e.tmp
Size 265B
SHA256 552ac5a2fda26695b17fc93d5ae1a15b7ad5b60a31063f12aa231e3ed4a43ceb
MD5 894a0b8b50a920b1e01d10239f10f1f7
SHA1 0b76ad5623b455bfd2b6276c92b36fd4757e565b
SHA512 1bccb1fb9c9dc02b30cf7ce1921634c0b79b77aeeff64692f8e7f7c22ac858339d825f7ad1088cdb7ad7d2c68ae169cda62f7c5875282f712324325db0254125
TLSH
T1E2D02B701506507072E5B73AC2307F77123C46210913187161ED536A81FD16C1311B39
MD5 SHA1 SHA512 TLSH

Submit Download

ssdfp5800.0.160008212041addc13-dd1f-47b6-930c-446afdecb375.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp5800.0.160008212041addc13-dd1f-47b6-930c-446afdecb375.tmp
Size 1KB
SHA256 910fb99a399d89891143c2277238086e9fa709952a8c976dfa3cf2b43c26a433
MD5 21d4a3c5925e6d57348a73bd3a28615d
SHA1 d2a3fd0bb4cc7e22cd8e4f1dbf7df925a64cf28b
SHA512 c39372c5512d4556d9c77934890e8da066d36394e87d16a22061710c777e6e1ae01e6222da733a007969d408c949d24f37b104df610c327ff2f52c6ea0f43fe6
TLSH
T12F1135556A0278B1AFABC73EB1F0366B077EC896611314B721CA000E1AEDB70950B52E
MD5 SHA1 SHA512 TLSH

Submit Download

ssdfp5800.0.160008212049bb7ed0-0b6b-4ff9-817b-bfb0f843477d.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp5800.0.160008212049bb7ed0-0b6b-4ff9-817b-bfb0f843477d.tmp
Size 1KB
SHA256 a97252369fd50ca4879291d1c1e77d3e72868ea03f035519162df929e9488c68
MD5 04ecd2ef4a610b5dfa540e5318489a8f
SHA1 be8d0a312689a500eff9d804f8db6cdf85a87a69
SHA512 fd4ecbcfbfc8af0333590b371adc8a1d2a1ea1c86a96d66c322f48dd449664b24aed0bca4602c5b3891c1211df2528c6e88111f6496f607e9085c532fda503d9
TLSH
T16E41E155960279B1EF6BC73EB1B03F660F7DC8A3211224A631CF000E2DAEBB29517117
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSafeSeedV26865dfa9-1b0c-4c04-8fae-861f061c1dbc.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\VariationsSafeSeedV26865dfa9-1b0c-4c04-8fae-861f061c1dbc.tmp
Size 19B
SHA256 1560b22b2264f7cb6b7f6910164813f76c5e8a06fb1acf85b375e687ee49c1ad
MD5 0ba451e89bf7a6a0144344570515f79f
SHA1 76f1bb126b80b61ff6022a5691f39d75f42487c7
SHA512 3a0527494b10bdb2aec6280cdcecfe86dacbf02dd55cc8f6a1e0fa981327617a6fcf2543bd9788e7aa866fa397f57bbc1fbcf0d2f6aaa74a35c4d06970afa75f
MD5 SHA1 SHA512

Submit Download

VariationsSeedV2abd9799c-7cef-4ea5-8af8-576560a37854.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\VariationsSeedV2abd9799c-7cef-4ea5-8af8-576560a37854.tmp
Size 11B
SHA256 b4cc4174735c28360b9081be3c3d0552d8a4b3cdb54431ac00ed0d622bab6296
MD5 78bb337b5e38a8a32331f18d8a2d3cda
SHA1 ad1ea4656ba8fcc889aaca9a88bd975de1e2beb3
SHA512 ec661136e4830c211c0eb418623f224423b681107cecefd18792799c25969688dc8585aa56f794bec55847fa47925c025f26e56c276228c20aecdd7b55b12710
MD5 SHA1 SHA512

Submit Download

winrar-64-7.01-installer.exe

Path C:\Users\Admin\Downloads\winrar-64-7.01-installer.exe
Size 1.6MB
SHA256 2891dba57abeaa9c2d59e256a2c7eb57474b5d0f76af5e825475112a7e93a209
MD5 4d295fa9eb15482ed21f9f36fae952c1
SHA1 f7f4eb4db2350be6756ae538d1265cbd409af972
SHA512 3d37c13c8f0fa76bb3937db878cbd04afdd6ae3a27d3415e0529d3dc221045f00fbe2a2e26ce5b898906fe07cb7966009bafcd971bf511e51b84c8e6bf778fe2
SSDEEP 24576:GI2WUQuU3ddVm9tSM/midFeAOtauy7IkJoc6WITIitkvAfc8sUsOIeaSI3s:GvWUQP7EnZF0TyckocGHtk9UGeahs
TLSH
T13D7523817AF904BDDA33D274CDB26D26E7757CB045F5A34F22B1890A5F2B7524C2A702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.def

Path C:\Windows\Temp\asw-7437fed9-23ca-45e2-aaac-1e3d4dfadcb0\avast-av-vps\config.def
Size 569B
SHA256 44147ee5b46642d032784136fc25dda139e5f94ff32982be0da0225cad7c1fdb
MD5 5d4241f42546d708d55041a220535459
SHA1 1c8fa08cb2eb8819cdd34a58a74a7fa0ff4bde5f
SHA512 df9fe5b4aeb6736e50974f241c89db98ca9d3f84ec33e3bc613601ed14198494e723ea9c5d939892ee468545fe2985b5a2c0823f8ae56f70ce4c10b48ee2b4d9
TLSH
T16AF0E1E75645A40F5E1684D2402651C0A0D003C84BC4D8619B516B4B9FC6A652DDF678
MD5 SHA1 SHA512 TLSH

Submit Download

dump_process.exe

Path C:\Windows\Temp\asw-7437fed9-23ca-45e2-aaac-1e3d4dfadcb0\avast-av-vps\dump_process.exe
Size 3.9MB
SHA256 0c4a891db19991cb4351e187c2d2b2163aa5ae2a6fa62da192d99bf189455d67
MD5 dbb383b15a96f67de8ad8bd18557ec9c
SHA1 0820e18c55d7d02ee55823b9bb34ccb5f0c3165d
SHA512 8ba1dcb2868285661975895e3ea317ab59f599226994208d0b922345fd940ba2968e48589f5b14336594f440b3ca45c0f3d5182bbd89f81ba76836bb64170983
SSDEEP 49152:dLTZYbKkDVuLu9eu/XGhP9ZzPrS4O1123cX3NKlhtPtMtk+VZ1FTyyFS6IZN8:hecoSzNNN
TLSH
T188167C1E7A1D00EAC1FEE17D8A86550BEA717CA1433557DB66E0AE190F23AF05E7E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus_product.dll

Path C:\Windows\Temp\asw-7437fed9-23ca-45e2-aaac-1e3d4dfadcb0\avast-av-vps\icarus_product.dll
Size 1.4MB
SHA256 8b51c1aece63f4918e04613aa39ed586f49d45afb5e0ca353f975547bcc40133
MD5 37b34b06963465e81a62c04fb7991781
SHA1 41b6daa76a52fa85143795bc78e39dffbf89363d
SHA512 508270d082fdc4d867449bdad72f38f1ca68a8fcb7e84f278c6fb2b22c47b77f8f630446a5b76e381594023197e0bc0b72ab257b1e270b0cb9c2039e6b87faa0
SSDEEP 24576:NETjdfcoLULC6KaznMbnWvz8D+EfoGdtwQUz1h0lhSMXlsXSRZaf:NSdfcoLCC6LznMbnWvz8D+EfoGdtwiQ6
TLSH
T191657B1A7A5C40F5C2BEC03989939A1EEAB1385543A197DB76EC8E191F17BF41E3E301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product-def.xml

Path C:\Windows\Temp\asw-7437fed9-23ca-45e2-aaac-1e3d4dfadcb0\avast-av-vps\product-def.xml
Size 66KB
SHA256 a1949c62ed549666899a348087e86851d6d77e477ef9505ed534fed19493c582
MD5 2a5507e8ca84fea158446f398e199cdd
SHA1 27740781a98c2930dd2023eea3a49a629ee3aa91
SHA512 f9b2752a9e8164d5a159b9dfbe7e0584c17a79769648a8fbd9aea9f7019f1cd6875e0089b73ce2b82816aca6ffe6ee5af2228415e4369de85eeeb32f85594e9e
SSDEEP 1536:fbtZqt7rI7Ih7p76IZtBb3M6mTb4UdlosPTHjJYfJaiMBBPDNwsporyJcPPSLDpV:zweNFUqA1h+r
TLSH
T1B963F169B7EFBD6B318650F7E440B884A3CFFC7849D80853B5337590991ADE29D68A30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product-info.xml

Path C:\Windows\Temp\asw-7437fed9-23ca-45e2-aaac-1e3d4dfadcb0\avast-av-vps\product-info.xml
Size 5KB
SHA256 40ecf2b01864d7977fae32cf4a24e9fec4869656cdf00d9947ecfb9bbcb98c79
MD5 bd152dd5ced8d2fb682b3e602cfdcf49
SHA1 7dd81df85147c26ced087bd70ba5b06b0dcfd8ca
SHA512 49244a694009d82218c4330093bf6d1b4e4918855263c17bdd81c2087981993430fe785036bb5ca9e9e65ff5fca00d59b62da6c166b14b9f2515d14b08449974
SSDEEP 96:hVt3vxf56zuC0f9QRU8wzOzQRjymj3EAfFLdfitUm/euXdGFf8PV5V+QVHM:hVt3vxgzuLlQRU8wzOURjyM3H9p6t7/W
TLSH
T12EC1FC32711EBF27B11F90E6F5D4B580229FFC8D8E8A4C2781033680A7AF8755A49974
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policy.def

Path C:\Windows\Temp\asw-7437fed9-23ca-45e2-aaac-1e3d4dfadcb0\avast-suite\brandingdata\av\licensing\policy.def
Size 3KB
SHA256 4a32ed196f5532592dd77f7606f0f57fb13bdb9f8f2b5ae29eb05ea33ad69ba3
MD5 f33ba357f62ae86f9029ace908fc0da2
SHA1 eee7368eb6331280e5b95bc2099d15634327d9f1
SHA512 db1c5358e89b8b61080d46c00cbac216c09cb4982280c796fbc81af6d6072def3b1a101922fa1a35ed83c487580d8f861318c452fbc6441db33f2cdd0e32d626
TLSH
T178714F5D2C16A6FF3A87A7B39E025FFA7DF984C18F2811A475AE5E0D11A498C05DC01B
MD5 SHA1 SHA512 TLSH

Submit Download

policy.def

Path C:\Windows\Temp\asw-7437fed9-23ca-45e2-aaac-1e3d4dfadcb0\avast-suite\brandingdata\bg\licensing\policy.def
Size 718B
SHA256 25cb063707d322d112c4f6d9b10dde10a8e381bcbf56f5e50ba853232c79d0dd
MD5 2f86ce9f00990bdd5574ba9c85651280
SHA1 042e0d369b4131dda69b79bd89139dc53db511ea
SHA512 4bc5873be7a70143735470b81bdcc38dc4a9ccb41444c55d01540bde92c9cb12b2864a66852f2a0251f64b3c32fd5b163b1a3437c33a83f6727dea64527d7987
TLSH
T19E01DB8C6C1696EF3A8BA3B3AA515BF77CF855859F285194309EAD08025998C41CC01F
MD5 SHA1 SHA512 TLSH

Submit Download

policy.def

Path C:\Windows\Temp\asw-7437fed9-23ca-45e2-aaac-1e3d4dfadcb0\avast-suite\brandingdata\tu\licensing\policy.def
Size 2KB
SHA256 2f12d0f88b2d4a0d70a546551141dd7506bc447b4abc0678b41390b2fe342fb8
MD5 595d1a68d7f5ad816de3ea02de202dab
SHA1 6aebf77cf237570b063c6bd7ad8707eeffea6dc9
SHA512 dea1d70d50da3f13a0731c62ea7e857437e6eb0ec5309bdd3d2e152da75504c4dc09ce84d44a68a1675fd3959c30d7448651dd5c9dc86cbdec5125317c98e547
TLSH
T17041675D2D16E6BF3A8BE7779E025FFA7CF984809F1851A0349EAE0D12D858C45DC00B
MD5 SHA1 SHA512 TLSH

Submit Download

config.def

Path C:\Windows\Temp\asw-7437fed9-23ca-45e2-aaac-1e3d4dfadcb0\avast-suite\config.def
Size 856B
SHA256 4d93ebef543212ce21eeb9faf4b826229fc84a09809a5cfbb6f94c8eee1d02a2
MD5 41d4988d021c600a899b3ae80b738625
SHA1 d70334fbc9bb2de2278092e851d0f7c40a771059
SHA512 7f8f2e7d42bc75e7c39d0bca0e480e024ea67dbad324b5952636f223c387a14ec59dacf6b69f4435c8056f9a4206ff775c5cc6a0ba12879f5bf11ca5c7165a66
TLSH
T19D11C263C558800E5E1086E55027E3C496A141C84DD6C8A69573570FEFD3A796CDE1FB
MD5 SHA1 SHA512 TLSH

Submit Download

icarus_product.dll

Path C:\Windows\Temp\asw-7437fed9-23ca-45e2-aaac-1e3d4dfadcb0\avast-suite\icarus_product.dll
Size 7.9MB
SHA256 49c2f38dd3aa6e6f837852114bdcc80bb68d0acdf4541050647ea8ec04366e5f
MD5 57bc56a1b269ca8ce2d5626e25e37e76
SHA1 3fb7f432c512fd11e66a9e7399162c7a2d004d79
SHA512 7fa3f1a4fd710f9ea077809177058a49f7485231ecab7e2afe4aa1168477ef20c043aad2cf5e8e8202f5973dea2b076236cbbcf5b8f3ef7065487d89ffc4bea4
SSDEEP 98304:058LO3axUPSzNf9HgYNapFowIyk2cEGD:0qLO3ai6vHpNapFowIyk2
TLSH
T11D866B1E7A6C00E9D1BFD178CA57950BEAB278950335A2DB5AE18E150F13BF49E3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus_rvrt.exe

Path C:\Windows\Temp\asw-7437fed9-23ca-45e2-aaac-1e3d4dfadcb0\avast-suite\icarus_rvrt.exe
Size 54KB
SHA256 097709779bf6e7a3f93b65510c1df2a6d28c2c8052874b39d560addfccc44493
MD5 9509e1083e6c87ed87fea572faf4707c
SHA1 d1edbd6a19219182d44daee650d7ccdb5f577073
SHA512 881d3ebc9da69fa08346a288b47381437c9325800b42f1034980fdd765cdb25a758f7985f4114bc9f6cf19eecff97834ec237fbf7b67d65d6adc16b5e7932fb1
SSDEEP 768:Skew5tXCQd8uLs7c9kyrHFLEPZqnF6AmbL/hamzxOW9zRrA:Sk75so8uLs7MDBEPZCF6VBamzUizZA
TLSH
T14F435B1323A850C0E67E8478A3F49923AEB236D617206A5F3164D46829A5FD1F73D36E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setupui.cont

Path C:\Windows\Temp\asw-7437fed9-23ca-45e2-aaac-1e3d4dfadcb0\avast-suite\setupui.cont
Size 673KB
SHA256 55cfb5d197bfb7e8674e1c3c13675bad0b5464733682017b93fc9dfef2a51144
MD5 ea46a13088440119ff5576529a138a04
SHA1 6355990d52c651ee7242747a5ed4447274492918
SHA512 949e249e465c0771e8d227d89d6c10959373d38f757e4337244ae78f4f60c45955a0f4387feca1a83aedc6c946829cca31dfe313bc27c22a6ead6f6297993e93
SSDEEP 12288:zh292mOjjO/6Hn/r0lBeBUNgVzA+87Ikx/viFQAd7Kmscr4ko8SKya:z829jA6H/r7P9ry/Ud7Km3r4krb
TLSH
T1DAE423F637812B05103AD5FA510DAFAF41326AC89F5D0B63BB24A36A945A0DE007DFF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bug_report.exe

Path C:\Windows\Temp\asw-7437fed9-23ca-45e2-aaac-1e3d4dfadcb0\common\bug_report.exe
Size 6.2MB
SHA256 ae8d7c5cc558990d169119110cab6e22d9c8ee63316deefa2ee4396b3a0bbd97
MD5 0f383f5696d0a73b85b11cd89c6ab44b
SHA1 7efa4a07ec88bd29911f41da4aef8b559e6497b7
SHA512 cdfd606ec2c996c0fce6826023bd8b8fc16ccfe9ebfeee26a5fbdeb7e6eda34e01f7831ef917ea9b9fcff9ee670cb14101a39ee62da21827192f5a29f292aeb2
SSDEEP 49152:V2duH/l4gyww7jmxPaDcZvlK7aMWaV+snHrE3ZaZpr3W4sPsmaKXgYP6IuQoLd34:pw7B5rRVVE9/87PQwVV/flyqggzSldN
TLSH
T148667C1E7A2E01E9C1BFE1788A87950BEAB17895433597CB66E18E550F13AF05F3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus.exe

Path C:\Windows\Temp\asw-7437fed9-23ca-45e2-aaac-1e3d4dfadcb0\common\icarus.exe
Size 9.4MB
SHA256 b4c91224c06fd252173e5ecf6ea1321af540b136eb996f82199ac496e7949655
MD5 f2c56e20d8b520afa895d0e34e9806f7
SHA1 48d8c6c366c1ccf75b875fb2842c292f031f6191
SHA512 1bc28bbc84a308e97dec6e61ed133f3790193ddc6d5417d194f2386d80a7ad57a5e50298e15cf5c2166a19342b01de06f698fe2b6ea541822b8aef40fcba7166
SSDEEP 98304:X7TG8ExXpT2xJPh9SD81OdvtrZyoU1h0k0X2:X7TG8ExXpKTM81OdvtrZyoaB
TLSH
T1A2A66C1EBA6D01E5C1FED1788647A51BEE717C95033996EB66E08D061F23AF09E3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus_mod.dll

Path C:\Windows\Temp\asw-7437fed9-23ca-45e2-aaac-1e3d4dfadcb0\common\icarus_mod.dll
Size 16KB
SHA256 452cf7f8e5f64bfae85aaf0f70150342b6e1d74f985e96313fc89fe945a85b8c
MD5 cf160d99e24fffb6081ac0cc5f0cc9c5
SHA1 4091408450f9f9475c54f62d694bb2368ef0ad85
SHA512 8d3d694aa1e506107b312237fd6d3e927225b8cd87b99c9de105474ea016aa2a72e7ed645800d2fd5d344392c65fb11668c219e469975bb8d2e16ac071678215
SSDEEP 384:3DkOhUy48pwKNsZqnP3AMwx7bLvxO1uoS:7WZqnUbL0
TLSH
T1B0725A833F203582EFC38D74A4D98BB3AD7173A27F5488DA45748198AC907E13A7816F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus_ui.exe

Path C:\Windows\Temp\asw-7437fed9-23ca-45e2-aaac-1e3d4dfadcb0\common\icarus_ui.exe
Size 12.4MB
SHA256 e3a4a3dae6db3ed8de3816673a94d73d05cab23a99aea6501956cf55df26a14d
MD5 e6237ebe1ecf906c8c5231d50aa75abe
SHA1 c135d123fc5a96d9a8f77880e13b05770828f2b9
SHA512 47e34ac48ef50d44df93c1342d914bf12be8809dd4588454eebcf260c70995f9931147e73ec4cf615d2d9e1ed5004da07d115bebb1bd94cae87151e99aee709b
SSDEEP 98304:TV9ZQCOW2tZ1fJeBez9FcI+GxHhmihGlmgoFA+aOeShArqNB5:TnazW2tZfeUz9FcI+eHhVyeaSArqNB5
TLSH
T1A3D68E6A76A440D5C1BEC039CA5B950BEBB27895133093CF16F15A5A1F27EF0AE7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product-def.xml

Path C:\Windows\Temp\asw-7437fed9-23ca-45e2-aaac-1e3d4dfadcb0\common\product-def.xml
Size 2.6MB
SHA256 9e89509eef82c39c86dd86786c07ee01128f506db2d7e556934702abc0bedfff
MD5 01c8e5b005b5f830f7514283b5136d8b
SHA1 086184ed1dc6a9ef2503329b6c0b505120f491ce
SHA512 1ff1a82da289659dfed3cef8a3800c83d6b35b2d7ca09762b997da5a4bea37a24b19a84394c9689fd8858143a7725a39ecf2b32af84a67d2120fabb8da902795
SSDEEP 24576:1oDAeRfUZFBCQbzogoFLdNokebqxdJpgPUwZcWuR1vBc0wLy4qXWIyp:1oke8tz4dGvqzPuxevEdEyp
TLSH
T1C9C540B5759E7C6B714B50E7B480BC81628FDD38C9E04C6BF1B33240A566E728EB1A74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product-info.xml

Path C:\Windows\Temp\asw-7437fed9-23ca-45e2-aaac-1e3d4dfadcb0\common\product-info.xml
Size 11KB
SHA256 261a738776da25e5857b469422cd7e50228f91fb2497403a4c79a3d9c541b690
MD5 13e3f1ceb057429c5468fbf619ee3b82
SHA1 d45a7a905b317281a840db01d65c2c23a0e80181
SHA512 05f4b8d8673b4df169dd7745b3e421c69fc0ed09411e08d6c1fc4d29e8d08ef4b3f1c9ffd6805c6046cc2d4c2c535490417e63fa6589baf25efbabd4119894a3
SSDEEP 192:kVtBvx38UMVmNmw5xKPB2eU8wIOzEjym3Hin6tJ/euNQHQBTNbrHWZxQu+Lyiguh:kVv+UWmNhSps8dZHNbzWZi4GDSj6
TLSH
T1A23252B5711CFF6B320FA093E0D5B580729FFC2C9FA81827F1233584A6AB564AA45974
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epps.edat

Path C:\Windows\Temp\asw-7437fed9-23ca-45e2-aaac-1e3d4dfadcb0\epps.edat
Size 80B
SHA256 c6528b50bbe1265eeb1beb88535e7f6257075daaa245ed693e9ac38511b297bf
MD5 5438e42d44c84deaf1c0d2ff11760e49
SHA1 87a6d26a9a158a169f2808ea1702daa188865498
SHA512 ff1f32e2379a4f6d0b642d31baaf558090dbe2ed6031f88f25438d0100f89651cea3af3690dbef151f3c3fce0582d0fbf5b85b7392ad7a885815d957cd8041a5
TLSH
T195A00188D40182F320A0D20073889187301A00C45E49318D79FAF94A2389B8B9AA84E0
MD5 SHA1 SHA512 TLSH

Submit Download

giet.edat

Path C:\Windows\Temp\asw-7437fed9-23ca-45e2-aaac-1e3d4dfadcb0\giet.edat
Size 8B
SHA256 c2cb92b00918d830aa68e4d5496ca412e3bc86f88444cb3de9d52e62a877b93f
MD5 faeee7fa0a7dd54b32eb730697448ac2
SHA1 85314fe3f7a2a838afb9b5ae64f00577cdaeb664
SHA512 1640cb35c92e0214808fe14ca3658549a927817195bb16b82f87bb3cf2e7e6e623bf04f42147ee97c66a52fbb11a55f253688d5a8363f3a836044e65b21d5b3a
MD5 SHA1 SHA512

Submit Download

icarus-info.xml

Path C:\Windows\Temp\asw-7437fed9-23ca-45e2-aaac-1e3d4dfadcb0\icarus-info.xml
Size 2KB
SHA256 092f363ff57dd9f4c1dde5097f3046324e3c520c4cfcac44d3810afe14fa4d80
MD5 ff493c06e749738446186b5c91ff0db8
SHA1 de042957da9de8e01fb3d55b58e732a23b73110d
SHA512 665ef4d7e59e12d06a4e2292b46b231f92f699aab0186a3dabe4238cd921508da50e77ec7de77166040301645edc2c584aab1148cc9ea45bc80316600fe9df2f
TLSH
T1375150B9A03D9E2B762AA5EFB188F8C077DFBD954B90096341077085D86B4F02982174
MD5 SHA1 SHA512 TLSH

Submit Download

memory/632-7-0x00000000006F0000-0x00000000007E9000-memory.dmp

Download

memory/632-0-0x00000000006F0000-0x00000000007E9000-memory.dmp

Download

memory/2492-5760-0x000001AC5F3C0000-0x000001AC603C0000-memory.dmp

Download

memory/3512-4985-0x000001DB250E0000-0x000001DB260E0000-memory.dmp

Download

memory/4172-4982-0x000001BCC5D00000-0x000001BCC6D00000-memory.dmp

Download

memory/4276-4734-0x0000028E67EB0000-0x0000028E68EB0000-memory.dmp

Download

memory/4436-7707-0x00000287D7080000-0x00000287D70B0000-memory.dmp

Download

memory/4604-5062-0x00007FFE53600000-0x00007FFE53601000-memory.dmp

Download

memory/4604-7708-0x00000208E6EF0000-0x00000208E6F20000-memory.dmp

Download

memory/4604-5063-0x00007FFE52D00000-0x00007FFE52D01000-memory.dmp

Download

memory/4892-307-0x000002CE4B8A0000-0x000002CE4B939000-memory.dmp

Download

memory/4892-443-0x000002CE4B8A0000-0x000002CE4B939000-memory.dmp

Download

memory/4892-902-0x000002CE4B8A0000-0x000002CE4B939000-memory.dmp

Download

memory/5112-7706-0x000001C8A4980000-0x000001C8A49B0000-memory.dmp

Download

memory/5160-5006-0x0000029349230000-0x000002934A230000-memory.dmp

Download

memory/5304-7709-0x000001C0CE770000-0x000001C0CF770000-memory.dmp

Download

memory/5344-38-0x0000000003B60000-0x0000000003CA0000-memory.dmp

Download

memory/5344-34-0x0000000003B60000-0x0000000003CA0000-memory.dmp

Download

memory/5344-40-0x0000000003B60000-0x0000000003CA0000-memory.dmp

Download

memory/5344-45-0x0000000000CF0000-0x0000000001143000-memory.dmp

Download

memory/5344-39-0x0000000003B60000-0x0000000003CA0000-memory.dmp

Download

memory/5344-5-0x0000000003870000-0x0000000003871000-memory.dmp

Download

memory/5344-80-0x0000000003B60000-0x0000000003CA0000-memory.dmp

Download

memory/5344-9-0x0000000003870000-0x0000000003871000-memory.dmp

Download

memory/5344-134-0x0000000003B60000-0x0000000003CA0000-memory.dmp

Download

memory/5344-201-0x0000000000CF0000-0x0000000001143000-memory.dmp

Download

memory/5344-306-0x0000000000CF0000-0x0000000001143000-memory.dmp

Download

memory/5344-8-0x0000000000CF0000-0x0000000001143000-memory.dmp

Download

memory/5344-33-0x0000000000CF0000-0x0000000001143000-memory.dmp

Download

memory/5344-31-0x0000000003B60000-0x0000000003CA0000-memory.dmp

Download

memory/5344-24-0x0000000003B60000-0x0000000003CA0000-memory.dmp

Download

memory/5344-30-0x0000000003B60000-0x0000000003CA0000-memory.dmp

Download

memory/5344-25-0x0000000003B60000-0x0000000003CA0000-memory.dmp

Download

memory/5800-5061-0x000002F38A5D0000-0x000002F38B5D0000-memory.dmp

Download

memory/5824-4949-0x00000174BE900000-0x00000174BF900000-memory.dmp

Download

memory/6076-5833-0x0000018667280000-0x0000018668280000-memory.dmp

Download

memory/6768-7640-0x000002B04C2D0000-0x000002B04C300000-memory.dmp

Download

memory/7388-11258-0x000001802C2F0000-0x000001802D2F0000-memory.dmp

Download