Overview

overview

8

Static

static

TLauncher-....1.exe

windows7-x64

8

TLauncher-....1.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    117s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    28/12/2022, 18:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    TLauncher-2.86-Installer-1.0.1.exe

  • Size

    21.7MB

  • MD5

    f643be370cc9763a17f7746b1b6a0243

  • SHA1

    c65391f59a6e1421d783eaf43eb9661cfd476f82

  • SHA256

    5ab5f39d143b6ff77df2fd5026ac8e4788edfd3de27a4e1fa4b420a7d2f61d38

  • SHA512

    5ce377dc1a4a59723cf2b969c0cadb3197e5bf61d0064e2e8c94a0be9d4fd1cd9b33e05078a17e89f54b763e180be32ce14b46949a58ff47e5df18183291142f

  • SSDEEP

    393216:WXYwVCtYto0fs/dQETVlOBbpFEj9GZdqV56HpkbGCST7yuk9sLx:WowVCWTHExiTTqqHpMsV

Score
8/10
discoverypersistencespywarestealerupx

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 27 IoCs
  • UPX packed file 41 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 59 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
    evasionspywaretrojan
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-2.86-Installer-1.0.1.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-2.86-Installer-1.0.1.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1908426 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.86-Installer-1.0.1.exe" "__IRCT:3" "__IRTSS:22693301" "__IRSID:S-1-5-21-4063495947-34355257-727531523-1000"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1680
      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
        "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1916
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1814730 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" "__IRCT:3" "__IRTSS:1839152" "__IRSID:S-1-5-21-4063495947-34355257-727531523-1000"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies system certificate store
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1564
          • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
            "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Enumerates connected drives
            • Modifies system certificate store
            • Suspicious use of WriteProcessMemory
            PID:1580
            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x1a4,0x1a8,0x1ac,0x178,0x1b0,0x71838658,0x71838668,0x71838674
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:456
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe" --version
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1556
            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --pin-additional-shortcuts=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=1580 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20221228182306" --session-guid=9b662790-fac5-4ac8-b402-bbd7204e8f14 --server-tracking-blob=MDMyZGRlMzNjZWQ0ZmNmYWJmN2NlM2UyMmExYzRiYWIyYjY5ZjAwNjFlMzBkNTlhMjA1OTNkYWE2ZDgzMTU3OTp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInRpbWVzdGFtcCI6IjE2NzIyNTE3ODYuMzM5MyIsInVzZXJhZ2VudCI6IlNldHVwIEZhY3RvcnkgOS4wIiwidXRtIjp7ImNhbXBhaWduIjoiT3BlcmFEZXNrdG9wIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiTVNUTCJ9LCJ1dWlkIjoiYmQyOWZjNTctNTY0Yy00MTBkLTk2OGEtYWVlZTI1Y2MwMTRiIn0= --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=5003000000000000
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Enumerates connected drives
              • Suspicious use of WriteProcessMemory
              PID:1460
              • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x1b0,0x1b4,0x1b8,0x178,0x1bc,0x70e48658,0x70e48668,0x70e48674
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:748
              • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\installer.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\installer.exe" --backend --initial-pid=1580 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --pin-additional-shortcuts=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212281823061" --session-guid=9b662790-fac5-4ac8-b402-bbd7204e8f14 --server-tracking-blob=MDMyZGRlMzNjZWQ0ZmNmYWJmN2NlM2UyMmExYzRiYWIyYjY5ZjAwNjFlMzBkNTlhMjA1OTNkYWE2ZDgzMTU3OTp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInRpbWVzdGFtcCI6IjE2NzIyNTE3ODYuMzM5MyIsInVzZXJhZ2VudCI6IlNldHVwIEZhY3RvcnkgOS4wIiwidXRtIjp7ImNhbXBhaWduIjoiT3BlcmFEZXNrdG9wIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiTVNUTCJ9LCJ1dWlkIjoiYmQyOWZjNTctNTY0Yy00MTBkLTk2OGEtYWVlZTI1Y2MwMTRiIn0= --silent --desktopshortcut=1 --install-subfolder=94.0.4606.38
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates connected drives
                • Modifies registry class
                PID:1716
                • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\installer.exe
                  C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\installer.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x174,0x178,0x17c,0x148,0x180,0x7fef6af2c98,0x7fef6af2ca8,0x7fef6af2cb8
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:744
                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212281823061\assistant\assistant_installer.exe
                  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212281823061\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera\assistant" --copyonly=0 --allusers=0
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Adds Run key to start application
                  • Modifies Internet Explorer settings
                  PID:464
                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212281823061\assistant\assistant_installer.exe
                    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212281823061\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x148,0x14c,0x150,0x11c,0x154,0x12d2dc0,0x12d2dd0,0x12d2ddc
                    9⤵
                    • Executes dropped EXE
                    PID:1112
                • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe" --start-maximized
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:2296
                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --start-maximized --ran-launcher
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:2404
                    • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_crashreporter.exe
                      C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_crashreporter.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x15c,0x160,0x164,0x130,0x168,0x7feeea6a490,0x7feeea6a4a0,0x7feeea6a4b0
                      10⤵
                        PID:2496
                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1096 --field-trial-handle=1212,i,4003817773769959697,4828452797175264535,131072 /prefetch:2
                        10⤵
                          PID:2752
                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212281823061\assistant\_sfx.exe
                  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212281823061\assistant\_sfx.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:1824
                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212281823061\assistant\assistant_installer.exe
                  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212281823061\assistant\assistant_installer.exe" --version
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:1292
                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212281823061\assistant\assistant_installer.exe
                    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212281823061\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x148,0x14c,0x150,0x11c,0x154,0x12d2dc0,0x12d2dd0,0x12d2ddc
                    7⤵
                    • Executes dropped EXE
                    PID:1728
          • C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
            "C:\Users\Admin\AppData\Local\Temp\jre-windows.exe" STATIC=1
            3⤵
            • Executes dropped EXE
            PID:1676
      • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe
        "C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera\assistant" --run-assistant --allusers=0
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2060
        • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe
          C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x12c,0x130,0x134,0x100,0x138,0xe02dc0,0xe02dd0,0xe02ddc
          2⤵
          • Executes dropped EXE
          PID:2076
        • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2120
          • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
            "C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe" --stream
            3⤵
            • Executes dropped EXE
            PID:2148
          • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe
            C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x150,0x154,0x158,0x124,0x15c,0x14f23f8,0x14f2408,0x14f2414
            3⤵
            • Executes dropped EXE
            PID:2180
            • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
              "C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe" --stream
              4⤵
              • Executes dropped EXE
              PID:2196
            • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
              "C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe" --stream
              4⤵
              • Executes dropped EXE
              PID:2220
            • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
              "C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe" --stream
              4⤵
              • Executes dropped EXE
              PID:2244
          • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
            "C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe" --stream
            3⤵
            • Executes dropped EXE
            PID:2308
      • C:\Windows\system32\wbem\unsecapp.exe
        C:\Windows\system32\wbem\unsecapp.exe -Embedding
        1⤵
          PID:2460
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --start-maximized --ran-launcher --flag-switches-begin --flag-switches-end --enable-quic --lowered-browser
          1⤵
            PID:2820
            • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_crashreporter.exe
              C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_crashreporter.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x15c,0x160,0x164,0x130,0x168,0x7feeea6a490,0x7feeea6a4a0,0x7feeea6a4b0
              2⤵
                PID:2848
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1104 --field-trial-handle=1200,i,3938219817154489135,4946728500667063499,131072 /prefetch:2
                2⤵
                  PID:3004
                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=1312 --field-trial-handle=1200,i,3938219817154489135,4946728500667063499,131072 /prefetch:8
                  2⤵
                    PID:584
                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=1400 --field-trial-handle=1200,i,3938219817154489135,4946728500667063499,131072 /prefetch:8
                    2⤵
                      PID:2052
                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=1916 --field-trial-handle=1200,i,3938219817154489135,4946728500667063499,131072 /prefetch:8
                      2⤵
                        PID:2580
                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=1928 --field-trial-handle=1200,i,3938219817154489135,4946728500667063499,131072 /prefetch:8
                        2⤵
                          PID:2700
                        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=1940 --field-trial-handle=1200,i,3938219817154489135,4946728500667063499,131072 /prefetch:8
                          2⤵
                            PID:1196
                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=1952 --field-trial-handle=1200,i,3938219817154489135,4946728500667063499,131072 /prefetch:8
                            2⤵
                              PID:2080
                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=1964 --field-trial-handle=1200,i,3938219817154489135,4946728500667063499,131072 /prefetch:8
                              2⤵
                                PID:1824
                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=1976 --field-trial-handle=1200,i,3938219817154489135,4946728500667063499,131072 /prefetch:8
                                2⤵
                                  PID:2740
                                • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_autoupdate.exe
                                  "C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_autoupdate.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" --pipeid=oauc_pipe2906202b27b41e4bd66c9238c4b575c1
                                  2⤵
                                    PID:1624
                                    • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_autoupdate.exe
                                      C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x138,0x13c,0x140,0x10c,0x144,0x1400c9b38,0x1400c9b48,0x1400c9b58
                                      3⤵
                                        PID:2088
                                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --mojo-platform-channel-handle=1996 --field-trial-handle=1200,i,3938219817154489135,4946728500667063499,131072 /prefetch:1
                                      2⤵
                                        PID:2676
                                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner-ref=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=2012 --field-trial-handle=1200,i,3938219817154489135,4946728500667063499,131072 /prefetch:1
                                        2⤵
                                          PID:1200
                                      • C:\Windows\system32\msiexec.exe
                                        C:\Windows\system32\msiexec.exe /V
                                        1⤵
                                          PID:1544
                                        • C:\Windows\system32\taskeng.exe
                                          taskeng.exe {37D2ABEA-3E9F-47E5-A60D-6DC475591798} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]
                                          1⤵
                                            PID:2200
                                            • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
                                              C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe --scheduledautoupdate --autoupdaterequesttype=automatic --autoupdateoperaversion=94.0.4606.38 --newautoupdaterlogic
                                              2⤵
                                                PID:852

                                            Network

                                            MITRE ATT&CK Enterprise v6

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                                              Filesize

                                              61KB

                                              MD5

                                              fc4666cbca561e864e7fdf883a9e6661

                                              SHA1

                                              2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

                                              SHA256

                                              10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

                                              SHA512

                                              c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

                                              Download Submit

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
                                              Filesize

                                              471B

                                              MD5

                                              3644127eb43499729c0f4e9cc43b9893

                                              SHA1

                                              678b8fd186a7529e87cfd16ac8416a5bd9618b57

                                              SHA256

                                              cf805d516e1dd8f2dcec66b01af1b1ae47b7c1175275b6ca0e6935842fa50f6a

                                              SHA512

                                              6c771c2c1f37979cd64c0a5576d730060940826d068cf5d284ee1a38d8257263116d3ab4254465f69d0759e99da007582d10272d526fd1e20af6b488622856ed

                                              Download Submit

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                              Filesize

                                              342B

                                              MD5

                                              321b0350ce77c5c6f171ea18d0023014

                                              SHA1

                                              ab8efce9ff7afae56fd03f7de84136a5c6449944

                                              SHA256

                                              9a8a3fcaf5e39eaf52aefa2e06ceb82cbb610219d894eaf9d2ed3acfac9d5be3

                                              SHA512

                                              ef10b59c78f67853078b72a1e56b41e00fac0a0e5de07c09dce27e586f03db245779cdeda2afdd6f481d6f3510f9783b9eaa3db669c0973acd727bf27e18dcf1

                                              Download Submit

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                              Filesize

                                              342B

                                              MD5

                                              20fc2058c22edd3492fea541268269f4

                                              SHA1

                                              dbb5405fae3709e0de91737f317c38fd71c7ce16

                                              SHA256

                                              099cd6ca0ef2cae3cd1c844c21692ad316dfe7ce0532c0cb0ca622bd216852c0

                                              SHA512

                                              083ff3d136e304d53fc4bce6df53fc6a99318c20a4aa9ee574ebfba33ad6dd02b72dde2a67753b2a1b232108ad6e486727dceec582cd4da67eacd96e13452ca7

                                              Download Submit

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
                                              Filesize

                                              404B

                                              MD5

                                              fccca5573f8f6c73b9bb8c012f42be6b

                                              SHA1

                                              cf3152b57e482c0cafd17f6c005e560454f193e9

                                              SHA256

                                              1dda8cddc03c502e45bb6250b966ee21b1692161da7a223923c9d51d095e3a3f

                                              SHA512

                                              2811bdce051f6f5756cd0f8166c05293e612d6c807495d6561f664879a4e2a9d3bec0ea276447e28b5801feb1a33f8e39917343e542a574decd02b257e0fc1d5

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
                                              Filesize

                                              2.7MB

                                              MD5

                                              94895cf23e29a65c11b350f4db4f3242

                                              SHA1

                                              e56104e8de9b61d37bf8ebad136ad8a983e4162a

                                              SHA256

                                              ac0cc61a08a6ad56dbda97fc6d22bb3e5a9130d2c3c834f501d69f07d21dd82a

                                              SHA512

                                              82660a009019c14dd09a9f7f074a85f121496afd47990abe17f690b4e1c84a207be6390e89c8f1d8ac21215138cb6a594ca49456b9a8b9605cf3d81c5f08ef7a

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212281823061\assistant\_sfx.exe
                                              Filesize

                                              1.7MB

                                              MD5

                                              0238df215bf6943892daf85de8ad433a

                                              SHA1

                                              3d905e4e2c0e9170df61b7a199321847691f945e

                                              SHA256

                                              a7818aca6acbe347df13d51d9750f6a852c5aa2a58580f7f2015113e0a3e06d7

                                              SHA512

                                              fc6c12e359b9a4ce84ef878f29648a4c97c38fd12ed80996c5e03829833220010fff9c751a99f399dad3529bda6438424194ed18236addfbe430343807aaad69

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212281823061\assistant\_sfx.exe
                                              Filesize

                                              1.7MB

                                              MD5

                                              0238df215bf6943892daf85de8ad433a

                                              SHA1

                                              3d905e4e2c0e9170df61b7a199321847691f945e

                                              SHA256

                                              a7818aca6acbe347df13d51d9750f6a852c5aa2a58580f7f2015113e0a3e06d7

                                              SHA512

                                              fc6c12e359b9a4ce84ef878f29648a4c97c38fd12ed80996c5e03829833220010fff9c751a99f399dad3529bda6438424194ed18236addfbe430343807aaad69

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212281823061\assistant\assistant_installer.exe
                                              Filesize

                                              2.1MB

                                              MD5

                                              9df6e2fbb7e38964f35016bf91ef7424

                                              SHA1

                                              d0c1266dc46814bc6165cf6a69e90581228989a7

                                              SHA256

                                              3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

                                              SHA512

                                              b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212281823061\assistant\assistant_installer.exe
                                              Filesize

                                              2.1MB

                                              MD5

                                              9df6e2fbb7e38964f35016bf91ef7424

                                              SHA1

                                              d0c1266dc46814bc6165cf6a69e90581228989a7

                                              SHA256

                                              3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

                                              SHA512

                                              b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212281823061\assistant\assistant_installer.exe
                                              Filesize

                                              2.1MB

                                              MD5

                                              9df6e2fbb7e38964f35016bf91ef7424

                                              SHA1

                                              d0c1266dc46814bc6165cf6a69e90581228989a7

                                              SHA256

                                              3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

                                              SHA512

                                              b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                                              Filesize

                                              1.8MB

                                              MD5

                                              f8996d2158a69a12b4bc99edd28100bc

                                              SHA1

                                              892887691df881fe432e09b618e90f50447340e6

                                              SHA256

                                              866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

                                              SHA512

                                              d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                                              Filesize

                                              1.8MB

                                              MD5

                                              f8996d2158a69a12b4bc99edd28100bc

                                              SHA1

                                              892887691df881fe432e09b618e90f50447340e6

                                              SHA256

                                              866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

                                              SHA512

                                              d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                              Filesize

                                              1.3MB

                                              MD5

                                              1313bb5df6c6e0d5c358735044fbebef

                                              SHA1

                                              cac3e2e3ed63dc147318e18f202a9da849830a91

                                              SHA256

                                              7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

                                              SHA512

                                              596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                              Filesize

                                              1.3MB

                                              MD5

                                              1313bb5df6c6e0d5c358735044fbebef

                                              SHA1

                                              cac3e2e3ed63dc147318e18f202a9da849830a91

                                              SHA256

                                              7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

                                              SHA512

                                              596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
                                              Filesize

                                              326KB

                                              MD5

                                              80d93d38badecdd2b134fe4699721223

                                              SHA1

                                              e829e58091bae93bc64e0c6f9f0bac999cfda23d

                                              SHA256

                                              c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                                              SHA512

                                              9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                                              Filesize

                                              1.3MB

                                              MD5

                                              e7bbc7b426cee4b8027a00b11f06ef34

                                              SHA1

                                              926fad387ede328d3cfd9da80d0b303a865cca98

                                              SHA256

                                              e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

                                              SHA512

                                              f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                                              Filesize

                                              1.3MB

                                              MD5

                                              e7bbc7b426cee4b8027a00b11f06ef34

                                              SHA1

                                              926fad387ede328d3cfd9da80d0b303a865cca98

                                              SHA256

                                              e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

                                              SHA512

                                              f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
                                              Filesize

                                              326KB

                                              MD5

                                              80d93d38badecdd2b134fe4699721223

                                              SHA1

                                              e829e58091bae93bc64e0c6f9f0bac999cfda23d

                                              SHA256

                                              c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                                              SHA512

                                              9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                              Filesize

                                              2.7MB

                                              MD5

                                              94895cf23e29a65c11b350f4db4f3242

                                              SHA1

                                              e56104e8de9b61d37bf8ebad136ad8a983e4162a

                                              SHA256

                                              ac0cc61a08a6ad56dbda97fc6d22bb3e5a9130d2c3c834f501d69f07d21dd82a

                                              SHA512

                                              82660a009019c14dd09a9f7f074a85f121496afd47990abe17f690b4e1c84a207be6390e89c8f1d8ac21215138cb6a594ca49456b9a8b9605cf3d81c5f08ef7a

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                              Filesize

                                              2.7MB

                                              MD5

                                              94895cf23e29a65c11b350f4db4f3242

                                              SHA1

                                              e56104e8de9b61d37bf8ebad136ad8a983e4162a

                                              SHA256

                                              ac0cc61a08a6ad56dbda97fc6d22bb3e5a9130d2c3c834f501d69f07d21dd82a

                                              SHA512

                                              82660a009019c14dd09a9f7f074a85f121496afd47990abe17f690b4e1c84a207be6390e89c8f1d8ac21215138cb6a594ca49456b9a8b9605cf3d81c5f08ef7a

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                              Filesize

                                              2.7MB

                                              MD5

                                              94895cf23e29a65c11b350f4db4f3242

                                              SHA1

                                              e56104e8de9b61d37bf8ebad136ad8a983e4162a

                                              SHA256

                                              ac0cc61a08a6ad56dbda97fc6d22bb3e5a9130d2c3c834f501d69f07d21dd82a

                                              SHA512

                                              82660a009019c14dd09a9f7f074a85f121496afd47990abe17f690b4e1c84a207be6390e89c8f1d8ac21215138cb6a594ca49456b9a8b9605cf3d81c5f08ef7a

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                              Filesize

                                              2.7MB

                                              MD5

                                              94895cf23e29a65c11b350f4db4f3242

                                              SHA1

                                              e56104e8de9b61d37bf8ebad136ad8a983e4162a

                                              SHA256

                                              ac0cc61a08a6ad56dbda97fc6d22bb3e5a9130d2c3c834f501d69f07d21dd82a

                                              SHA512

                                              82660a009019c14dd09a9f7f074a85f121496afd47990abe17f690b4e1c84a207be6390e89c8f1d8ac21215138cb6a594ca49456b9a8b9605cf3d81c5f08ef7a

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                              Filesize

                                              2.7MB

                                              MD5

                                              94895cf23e29a65c11b350f4db4f3242

                                              SHA1

                                              e56104e8de9b61d37bf8ebad136ad8a983e4162a

                                              SHA256

                                              ac0cc61a08a6ad56dbda97fc6d22bb3e5a9130d2c3c834f501d69f07d21dd82a

                                              SHA512

                                              82660a009019c14dd09a9f7f074a85f121496afd47990abe17f690b4e1c84a207be6390e89c8f1d8ac21215138cb6a594ca49456b9a8b9605cf3d81c5f08ef7a

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
                                              Filesize

                                              601B

                                              MD5

                                              0ea67e39f174c8ac08b5a15eb4b46fde

                                              SHA1

                                              07ab35b844ab05940382648dc1467f1ac8f967cd

                                              SHA256

                                              2ee4d852fd6ace8cc9f31fb85f6cd815dc3b3951b5be039d15b47193ac722b32

                                              SHA512

                                              bdfa77f71b47dc7b6d93b46f62bec5529d849c1024a610db75e9d508544eed5b7269aacbe3c842d7732fe6225fc9d4e1fd2312ae60cd5f528ba9fc3c5920d409

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
                                              Filesize

                                              40B

                                              MD5

                                              d540bbec4af808bd6bff39eb3c6ca35d

                                              SHA1

                                              aae33fe61a645386090f2c8dbdada528e4850869

                                              SHA256

                                              3885c910e5320582791d3f30417fc3cab828caed180094d06eb253b9098fcd15

                                              SHA512

                                              b56f51c265627bbff09a8a42969c3e91c04ff20fc4751c61b8334fa93c0a219ae9b9562d663df401e0ebaced91f02478fbd5dc7e053b951a6f088f7b7cae2e4d

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
                                              Filesize

                                              2.7MB

                                              MD5

                                              94895cf23e29a65c11b350f4db4f3242

                                              SHA1

                                              e56104e8de9b61d37bf8ebad136ad8a983e4162a

                                              SHA256

                                              ac0cc61a08a6ad56dbda97fc6d22bb3e5a9130d2c3c834f501d69f07d21dd82a

                                              SHA512

                                              82660a009019c14dd09a9f7f074a85f121496afd47990abe17f690b4e1c84a207be6390e89c8f1d8ac21215138cb6a594ca49456b9a8b9605cf3d81c5f08ef7a

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212281823061\assistant\_sfx.exe
                                              Filesize

                                              1.7MB

                                              MD5

                                              0238df215bf6943892daf85de8ad433a

                                              SHA1

                                              3d905e4e2c0e9170df61b7a199321847691f945e

                                              SHA256

                                              a7818aca6acbe347df13d51d9750f6a852c5aa2a58580f7f2015113e0a3e06d7

                                              SHA512

                                              fc6c12e359b9a4ce84ef878f29648a4c97c38fd12ed80996c5e03829833220010fff9c751a99f399dad3529bda6438424194ed18236addfbe430343807aaad69

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212281823061\assistant\assistant_installer.exe
                                              Filesize

                                              2.1MB

                                              MD5

                                              9df6e2fbb7e38964f35016bf91ef7424

                                              SHA1

                                              d0c1266dc46814bc6165cf6a69e90581228989a7

                                              SHA256

                                              3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

                                              SHA512

                                              b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212281823061\assistant\assistant_installer.exe
                                              Filesize

                                              2.1MB

                                              MD5

                                              9df6e2fbb7e38964f35016bf91ef7424

                                              SHA1

                                              d0c1266dc46814bc6165cf6a69e90581228989a7

                                              SHA256

                                              3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

                                              SHA512

                                              b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212281823061\opera_package
                                              Filesize

                                              86.7MB

                                              MD5

                                              31a143013d5b31bf0a19c39ebb26fd93

                                              SHA1

                                              8a9a106585b4de6587c2e5dca51c3e390764d0c4

                                              SHA256

                                              4a38cc4fb9f71279e966d17c64d3d8bf03d61922241d9bd69edf52baac7fad66

                                              SHA512

                                              c06ae3db4711eecc177c8eabf7c91c585224387f301c092558e1efad94dd1f42b80adb04e5b5c4280e9df512ab90e755afd16b9a6f6804834a492dea9b29a41d

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202212281823061\opera_package
                                              Filesize

                                              86.7MB

                                              MD5

                                              31a143013d5b31bf0a19c39ebb26fd93

                                              SHA1

                                              8a9a106585b4de6587c2e5dca51c3e390764d0c4

                                              SHA256

                                              4a38cc4fb9f71279e966d17c64d3d8bf03d61922241d9bd69edf52baac7fad66

                                              SHA512

                                              c06ae3db4711eecc177c8eabf7c91c585224387f301c092558e1efad94dd1f42b80adb04e5b5c4280e9df512ab90e755afd16b9a6f6804834a492dea9b29a41d

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\Opera_installer_2212281823046781580.dll
                                              Filesize

                                              4.3MB

                                              MD5

                                              09ce9fd443ba9fb4c7ac6cf5c2b1ae53

                                              SHA1

                                              029a9ab9c36da0756441d8346cbfece76e3820d5

                                              SHA256

                                              ceeb8dd897035807425e9d24d0d2b71d65dccf7d8f834b777a587ba697655581

                                              SHA512

                                              a3aafe2e6cf719b086759989229011ccc078c46bc456fb5a50c3b701cc5f4f8b16a4984b7dca6e51688d31a3ff40443cc80cce10a90a27c9eb5a40799900a893

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\Opera_installer_221228182304974456.dll
                                              Filesize

                                              4.3MB

                                              MD5

                                              09ce9fd443ba9fb4c7ac6cf5c2b1ae53

                                              SHA1

                                              029a9ab9c36da0756441d8346cbfece76e3820d5

                                              SHA256

                                              ceeb8dd897035807425e9d24d0d2b71d65dccf7d8f834b777a587ba697655581

                                              SHA512

                                              a3aafe2e6cf719b086759989229011ccc078c46bc456fb5a50c3b701cc5f4f8b16a4984b7dca6e51688d31a3ff40443cc80cce10a90a27c9eb5a40799900a893

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\Opera_installer_2212281823060981556.dll
                                              Filesize

                                              4.3MB

                                              MD5

                                              09ce9fd443ba9fb4c7ac6cf5c2b1ae53

                                              SHA1

                                              029a9ab9c36da0756441d8346cbfece76e3820d5

                                              SHA256

                                              ceeb8dd897035807425e9d24d0d2b71d65dccf7d8f834b777a587ba697655581

                                              SHA512

                                              a3aafe2e6cf719b086759989229011ccc078c46bc456fb5a50c3b701cc5f4f8b16a4984b7dca6e51688d31a3ff40443cc80cce10a90a27c9eb5a40799900a893

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\Opera_installer_2212281823068621460.dll
                                              Filesize

                                              4.3MB

                                              MD5

                                              09ce9fd443ba9fb4c7ac6cf5c2b1ae53

                                              SHA1

                                              029a9ab9c36da0756441d8346cbfece76e3820d5

                                              SHA256

                                              ceeb8dd897035807425e9d24d0d2b71d65dccf7d8f834b777a587ba697655581

                                              SHA512

                                              a3aafe2e6cf719b086759989229011ccc078c46bc456fb5a50c3b701cc5f4f8b16a4984b7dca6e51688d31a3ff40443cc80cce10a90a27c9eb5a40799900a893

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\Opera_installer_221228182307439748.dll
                                              Filesize

                                              4.3MB

                                              MD5

                                              09ce9fd443ba9fb4c7ac6cf5c2b1ae53

                                              SHA1

                                              029a9ab9c36da0756441d8346cbfece76e3820d5

                                              SHA256

                                              ceeb8dd897035807425e9d24d0d2b71d65dccf7d8f834b777a587ba697655581

                                              SHA512

                                              a3aafe2e6cf719b086759989229011ccc078c46bc456fb5a50c3b701cc5f4f8b16a4984b7dca6e51688d31a3ff40443cc80cce10a90a27c9eb5a40799900a893

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                                              Filesize

                                              1.8MB

                                              MD5

                                              f8996d2158a69a12b4bc99edd28100bc

                                              SHA1

                                              892887691df881fe432e09b618e90f50447340e6

                                              SHA256

                                              866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

                                              SHA512

                                              d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                                              Filesize

                                              1.8MB

                                              MD5

                                              f8996d2158a69a12b4bc99edd28100bc

                                              SHA1

                                              892887691df881fe432e09b618e90f50447340e6

                                              SHA256

                                              866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

                                              SHA512

                                              d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                                              Filesize

                                              1.8MB

                                              MD5

                                              f8996d2158a69a12b4bc99edd28100bc

                                              SHA1

                                              892887691df881fe432e09b618e90f50447340e6

                                              SHA256

                                              866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

                                              SHA512

                                              d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                                              Filesize

                                              1.8MB

                                              MD5

                                              f8996d2158a69a12b4bc99edd28100bc

                                              SHA1

                                              892887691df881fe432e09b618e90f50447340e6

                                              SHA256

                                              866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

                                              SHA512

                                              d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                                              Filesize

                                              1.8MB

                                              MD5

                                              f8996d2158a69a12b4bc99edd28100bc

                                              SHA1

                                              892887691df881fe432e09b618e90f50447340e6

                                              SHA256

                                              866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

                                              SHA512

                                              d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                                              Filesize

                                              1.8MB

                                              MD5

                                              f8996d2158a69a12b4bc99edd28100bc

                                              SHA1

                                              892887691df881fe432e09b618e90f50447340e6

                                              SHA256

                                              866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

                                              SHA512

                                              d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
                                              Filesize

                                              1.7MB

                                              MD5

                                              1bbf5dd0b6ca80e4c7c77495c3f33083

                                              SHA1

                                              e0520037e60eb641ec04d1e814394c9da0a6a862

                                              SHA256

                                              bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

                                              SHA512

                                              97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
                                              Filesize

                                              97KB

                                              MD5

                                              da1d0cd400e0b6ad6415fd4d90f69666

                                              SHA1

                                              de9083d2902906cacf57259cf581b1466400b799

                                              SHA256

                                              7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

                                              SHA512

                                              f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                              Filesize

                                              1.3MB

                                              MD5

                                              1313bb5df6c6e0d5c358735044fbebef

                                              SHA1

                                              cac3e2e3ed63dc147318e18f202a9da849830a91

                                              SHA256

                                              7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

                                              SHA512

                                              596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                              Filesize

                                              1.3MB

                                              MD5

                                              1313bb5df6c6e0d5c358735044fbebef

                                              SHA1

                                              cac3e2e3ed63dc147318e18f202a9da849830a91

                                              SHA256

                                              7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

                                              SHA512

                                              596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                              Filesize

                                              1.3MB

                                              MD5

                                              1313bb5df6c6e0d5c358735044fbebef

                                              SHA1

                                              cac3e2e3ed63dc147318e18f202a9da849830a91

                                              SHA256

                                              7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

                                              SHA512

                                              596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                              Filesize

                                              1.3MB

                                              MD5

                                              1313bb5df6c6e0d5c358735044fbebef

                                              SHA1

                                              cac3e2e3ed63dc147318e18f202a9da849830a91

                                              SHA256

                                              7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

                                              SHA512

                                              596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                              Filesize

                                              1.3MB

                                              MD5

                                              1313bb5df6c6e0d5c358735044fbebef

                                              SHA1

                                              cac3e2e3ed63dc147318e18f202a9da849830a91

                                              SHA256

                                              7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

                                              SHA512

                                              596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
                                              Filesize

                                              326KB

                                              MD5

                                              80d93d38badecdd2b134fe4699721223

                                              SHA1

                                              e829e58091bae93bc64e0c6f9f0bac999cfda23d

                                              SHA256

                                              c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                                              SHA512

                                              9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                                              Filesize

                                              1.3MB

                                              MD5

                                              e7bbc7b426cee4b8027a00b11f06ef34

                                              SHA1

                                              926fad387ede328d3cfd9da80d0b303a865cca98

                                              SHA256

                                              e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

                                              SHA512

                                              f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                                              Filesize

                                              1.3MB

                                              MD5

                                              e7bbc7b426cee4b8027a00b11f06ef34

                                              SHA1

                                              926fad387ede328d3cfd9da80d0b303a865cca98

                                              SHA256

                                              e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

                                              SHA512

                                              f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                                              Filesize

                                              1.3MB

                                              MD5

                                              e7bbc7b426cee4b8027a00b11f06ef34

                                              SHA1

                                              926fad387ede328d3cfd9da80d0b303a865cca98

                                              SHA256

                                              e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

                                              SHA512

                                              f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                                              Filesize

                                              1.3MB

                                              MD5

                                              e7bbc7b426cee4b8027a00b11f06ef34

                                              SHA1

                                              926fad387ede328d3cfd9da80d0b303a865cca98

                                              SHA256

                                              e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

                                              SHA512

                                              f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                                              Filesize

                                              1.3MB

                                              MD5

                                              e7bbc7b426cee4b8027a00b11f06ef34

                                              SHA1

                                              926fad387ede328d3cfd9da80d0b303a865cca98

                                              SHA256

                                              e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

                                              SHA512

                                              f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
                                              Filesize

                                              326KB

                                              MD5

                                              80d93d38badecdd2b134fe4699721223

                                              SHA1

                                              e829e58091bae93bc64e0c6f9f0bac999cfda23d

                                              SHA256

                                              c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                                              SHA512

                                              9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                              Filesize

                                              2.7MB

                                              MD5

                                              94895cf23e29a65c11b350f4db4f3242

                                              SHA1

                                              e56104e8de9b61d37bf8ebad136ad8a983e4162a

                                              SHA256

                                              ac0cc61a08a6ad56dbda97fc6d22bb3e5a9130d2c3c834f501d69f07d21dd82a

                                              SHA512

                                              82660a009019c14dd09a9f7f074a85f121496afd47990abe17f690b4e1c84a207be6390e89c8f1d8ac21215138cb6a594ca49456b9a8b9605cf3d81c5f08ef7a

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                              Filesize

                                              2.7MB

                                              MD5

                                              94895cf23e29a65c11b350f4db4f3242

                                              SHA1

                                              e56104e8de9b61d37bf8ebad136ad8a983e4162a

                                              SHA256

                                              ac0cc61a08a6ad56dbda97fc6d22bb3e5a9130d2c3c834f501d69f07d21dd82a

                                              SHA512

                                              82660a009019c14dd09a9f7f074a85f121496afd47990abe17f690b4e1c84a207be6390e89c8f1d8ac21215138cb6a594ca49456b9a8b9605cf3d81c5f08ef7a

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                              Filesize

                                              2.7MB

                                              MD5

                                              94895cf23e29a65c11b350f4db4f3242

                                              SHA1

                                              e56104e8de9b61d37bf8ebad136ad8a983e4162a

                                              SHA256

                                              ac0cc61a08a6ad56dbda97fc6d22bb3e5a9130d2c3c834f501d69f07d21dd82a

                                              SHA512

                                              82660a009019c14dd09a9f7f074a85f121496afd47990abe17f690b4e1c84a207be6390e89c8f1d8ac21215138cb6a594ca49456b9a8b9605cf3d81c5f08ef7a

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                              Filesize

                                              2.7MB

                                              MD5

                                              94895cf23e29a65c11b350f4db4f3242

                                              SHA1

                                              e56104e8de9b61d37bf8ebad136ad8a983e4162a

                                              SHA256

                                              ac0cc61a08a6ad56dbda97fc6d22bb3e5a9130d2c3c834f501d69f07d21dd82a

                                              SHA512

                                              82660a009019c14dd09a9f7f074a85f121496afd47990abe17f690b4e1c84a207be6390e89c8f1d8ac21215138cb6a594ca49456b9a8b9605cf3d81c5f08ef7a

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                              Filesize

                                              2.7MB

                                              MD5

                                              94895cf23e29a65c11b350f4db4f3242

                                              SHA1

                                              e56104e8de9b61d37bf8ebad136ad8a983e4162a

                                              SHA256

                                              ac0cc61a08a6ad56dbda97fc6d22bb3e5a9130d2c3c834f501d69f07d21dd82a

                                              SHA512

                                              82660a009019c14dd09a9f7f074a85f121496afd47990abe17f690b4e1c84a207be6390e89c8f1d8ac21215138cb6a594ca49456b9a8b9605cf3d81c5f08ef7a

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                              Filesize

                                              2.7MB

                                              MD5

                                              94895cf23e29a65c11b350f4db4f3242

                                              SHA1

                                              e56104e8de9b61d37bf8ebad136ad8a983e4162a

                                              SHA256

                                              ac0cc61a08a6ad56dbda97fc6d22bb3e5a9130d2c3c834f501d69f07d21dd82a

                                              SHA512

                                              82660a009019c14dd09a9f7f074a85f121496afd47990abe17f690b4e1c84a207be6390e89c8f1d8ac21215138cb6a594ca49456b9a8b9605cf3d81c5f08ef7a

                                              Download Submit

                                            • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                              Filesize

                                              2.7MB

                                              MD5

                                              94895cf23e29a65c11b350f4db4f3242

                                              SHA1

                                              e56104e8de9b61d37bf8ebad136ad8a983e4162a

                                              SHA256

                                              ac0cc61a08a6ad56dbda97fc6d22bb3e5a9130d2c3c834f501d69f07d21dd82a

                                              SHA512

                                              82660a009019c14dd09a9f7f074a85f121496afd47990abe17f690b4e1c84a207be6390e89c8f1d8ac21215138cb6a594ca49456b9a8b9605cf3d81c5f08ef7a

                                              Download Submit

                                            • memory/456-200-0x0000000000400000-0x000000000090C000-memory.dmp

                                              Filesize

                                              5.0MB

                                              Download

                                            • memory/456-126-0x0000000000400000-0x000000000090C000-memory.dmp

                                              Filesize

                                              5.0MB

                                              Download

                                            • memory/748-147-0x0000000000400000-0x000000000090C000-memory.dmp

                                              Filesize

                                              5.0MB

                                              Download

                                            • memory/748-196-0x0000000000400000-0x000000000090C000-memory.dmp

                                              Filesize

                                              5.0MB

                                              Download

                                            • memory/1460-144-0x0000000000400000-0x000000000090C000-memory.dmp

                                              Filesize

                                              5.0MB

                                              Download

                                            • memory/1460-145-0x00000000029D0000-0x0000000002EDC000-memory.dmp

                                              Filesize

                                              5.0MB

                                              Download

                                            • memory/1460-193-0x0000000000400000-0x000000000090C000-memory.dmp

                                              Filesize

                                              5.0MB

                                              Download

                                            • memory/1556-128-0x0000000000400000-0x000000000090C000-memory.dmp

                                              Filesize

                                              5.0MB

                                              Download

                                            • memory/1564-103-0x0000000000CB0000-0x0000000001098000-memory.dmp

                                              Filesize

                                              3.9MB

                                              Download

                                            • memory/1564-119-0x0000000000CB0000-0x0000000001098000-memory.dmp

                                              Filesize

                                              3.9MB

                                              Download

                                            • memory/1580-125-0x0000000002890000-0x0000000002D9C000-memory.dmp

                                              Filesize

                                              5.0MB

                                              Download

                                            • memory/1580-198-0x0000000000400000-0x000000000090C000-memory.dmp

                                              Filesize

                                              5.0MB

                                              Download

                                            • memory/1580-150-0x0000000002890000-0x0000000002D9C000-memory.dmp

                                              Filesize

                                              5.0MB

                                              Download

                                            • memory/1580-164-0x0000000003860000-0x0000000003D6C000-memory.dmp

                                              Filesize

                                              5.0MB

                                              Download

                                            • memory/1580-146-0x0000000003360000-0x000000000386C000-memory.dmp

                                              Filesize

                                              5.0MB

                                              Download

                                            • memory/1580-142-0x0000000003860000-0x0000000003D6C000-memory.dmp

                                              Filesize

                                              5.0MB

                                              Download

                                            • memory/1580-121-0x0000000000400000-0x000000000090C000-memory.dmp

                                              Filesize

                                              5.0MB

                                              Download

                                            • memory/1676-167-0x000007FEFC2F1000-0x000007FEFC2F3000-memory.dmp

                                              Filesize

                                              8KB

                                              Download

                                            • memory/1680-492-0x0000000010000000-0x0000000010051000-memory.dmp

                                              Filesize

                                              324KB

                                              Download

                                            • memory/1680-97-0x0000000003160000-0x0000000003170000-memory.dmp

                                              Filesize

                                              64KB

                                              Download

                                            • memory/1680-74-0x0000000001200000-0x00000000015E8000-memory.dmp

                                              Filesize

                                              3.9MB

                                              Download

                                            • memory/1680-68-0x0000000001200000-0x00000000015E8000-memory.dmp

                                              Filesize

                                              3.9MB

                                              Download

                                            • memory/1680-71-0x0000000010000000-0x0000000010051000-memory.dmp

                                              Filesize

                                              324KB

                                              Download

                                            • memory/1680-72-0x00000000004B0000-0x00000000004DC000-memory.dmp

                                              Filesize

                                              176KB

                                              Download

                                            • memory/1916-102-0x0000000002D80000-0x0000000003168000-memory.dmp

                                              Filesize

                                              3.9MB

                                              Download

                                            • memory/1916-98-0x0000000002D80000-0x0000000003168000-memory.dmp

                                              Filesize

                                              3.9MB

                                              Download

                                            • memory/1916-99-0x0000000002D80000-0x0000000003168000-memory.dmp

                                              Filesize

                                              3.9MB

                                              Download

                                            • memory/2016-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

                                              Filesize

                                              8KB

                                              Download

                                            • memory/2016-65-0x00000000029F0000-0x0000000002DD8000-memory.dmp

                                              Filesize

                                              3.9MB

                                              Download

                                            • memory/2016-73-0x00000000029F0000-0x0000000002DD8000-memory.dmp

                                              Filesize

                                              3.9MB

                                              Download

                                            • memory/2016-67-0x00000000029F0000-0x0000000002DD8000-memory.dmp

                                              Filesize

                                              3.9MB

                                              Download

                                            • memory/2016-66-0x00000000029F0000-0x0000000002DD8000-memory.dmp

                                              Filesize

                                              3.9MB

                                              Download

                                            • memory/2404-197-0x0000000002650000-0x0000000002660000-memory.dmp

                                              Filesize

                                              64KB

                                              Download