Overview

overview

8

Static

static

TLauncher-....1.exe

windows7-x64

8

TLauncher-....1.exe

windows10-2004-x64

8

Resubmissions

03/03/2024, 11:27

240303-nkmj9ahg51 7

02/03/2024, 09:29

240302-lf8wkscd47 7

02/03/2024, 09:24

240302-ldgdjscd26 7

02/03/2024, 09:19

240302-laarlacc93 7

Analysis

  • max time kernel
    232s
  • max time network
    650s
  • platform
    windows7_x64
  • resource
    win7-20220901-es
  • resource tags

    arch:x64arch:x86image:win7-20220901-eslocale:es-esos:windows7-x64systemwindows
  • submitted
    02/01/2023, 17:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    TLauncher-2.86-Installer-1.0.1.exe

  • Size

    21.7MB

  • MD5

    f643be370cc9763a17f7746b1b6a0243

  • SHA1

    c65391f59a6e1421d783eaf43eb9661cfd476f82

  • SHA256

    5ab5f39d143b6ff77df2fd5026ac8e4788edfd3de27a4e1fa4b420a7d2f61d38

  • SHA512

    5ce377dc1a4a59723cf2b969c0cadb3197e5bf61d0064e2e8c94a0be9d4fd1cd9b33e05078a17e89f54b763e180be32ce14b46949a58ff47e5df18183291142f

  • SSDEEP

    393216:WXYwVCtYto0fs/dQETVlOBbpFEj9GZdqV56HpkbGCST7yuk9sLx:WowVCWTHExiTTqqHpMsV

Score
8/10
adwarediscoverypersistencespywarestealerupx

Malware Config

Signatures

  • Blocklisted process makes network request 3 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 45 IoCs
  • Registers COM server for autorun 1 TTPs 64 IoCs
    persistence
  • UPX packed file 45 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 27 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 6 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-2.86-Installer-1.0.1.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-2.86-Installer-1.0.1.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1324
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1908426 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.86-Installer-1.0.1.exe" "__IRCT:3" "__IRTSS:22693301" "__IRSID:S-1-5-21-4063495947-34355257-727531523-1000"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:976
      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
        "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1576
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1814730 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" "__IRCT:3" "__IRTSS:1839152" "__IRSID:S-1-5-21-4063495947-34355257-727531523-1000"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies system certificate store
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1116
          • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
            "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Enumerates connected drives
            • Modifies system certificate store
            • Suspicious use of WriteProcessMemory
            PID:1632
            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x1a4,0x1a8,0x1ac,0x178,0x1b0,0x717d8658,0x717d8668,0x717d8674
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1864
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe" --version
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1984
            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=es --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --pin-additional-shortcuts=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=1632 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20230102175414" --session-guid=2e3a5314-972b-4586-a477-b622119c7adf --server-tracking-blob=ODkxMzVmYzE3ZTE5YWJhOTNhYmMxODI5MzVkNmU1M2U1NjRhYjA4MThlNTY2Y2E3ZTFlY2I0MDg3ZjM5Mjc0NDp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInRpbWVzdGFtcCI6IjE2NzI2ODIwNTAuNTc4MCIsInVzZXJhZ2VudCI6IlNldHVwIEZhY3RvcnkgOS4wIiwidXRtIjp7ImNhbXBhaWduIjoiT3BlcmFEZXNrdG9wIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiTVNUTCJ9LCJ1dWlkIjoiYWJhZGNiYTYtYzc5NC00ZTFkLWJjNzMtMmU4ZTdkNmViZDlmIn0= --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=3C03000000000000
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Enumerates connected drives
              • Suspicious use of WriteProcessMemory
              PID:1960
              • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x1b0,0x1b4,0x1b8,0x178,0x1bc,0x70db8658,0x70db8668,0x70db8674
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:684
              • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\installer.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\installer.exe" --backend --initial-pid=1632 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=es --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --pin-additional-shortcuts=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301021754141" --session-guid=2e3a5314-972b-4586-a477-b622119c7adf --server-tracking-blob=ODkxMzVmYzE3ZTE5YWJhOTNhYmMxODI5MzVkNmU1M2U1NjRhYjA4MThlNTY2Y2E3ZTFlY2I0MDg3ZjM5Mjc0NDp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInRpbWVzdGFtcCI6IjE2NzI2ODIwNTAuNTc4MCIsInVzZXJhZ2VudCI6IlNldHVwIEZhY3RvcnkgOS4wIiwidXRtIjp7ImNhbXBhaWduIjoiT3BlcmFEZXNrdG9wIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiTVNUTCJ9LCJ1dWlkIjoiYWJhZGNiYTYtYzc5NC00ZTFkLWJjNzMtMmU4ZTdkNmViZDlmIn0= --silent --desktopshortcut=1 --install-subfolder=94.0.4606.38
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates connected drives
                • Modifies registry class
                PID:944
                • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\installer.exe
                  C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\installer.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x174,0x178,0x17c,0x148,0x180,0x7fef69a2c98,0x7fef69a2ca8,0x7fef69a2cb8
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:1160
                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301021754141\assistant\assistant_installer.exe
                  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301021754141\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera\assistant" --copyonly=0 --allusers=0
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Adds Run key to start application
                  • Modifies Internet Explorer settings
                  PID:1612
                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301021754141\assistant\assistant_installer.exe
                    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301021754141\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x148,0x14c,0x150,0x11c,0x154,0x1322dc0,0x1322dd0,0x1322ddc
                    9⤵
                    • Executes dropped EXE
                    PID:1068
                • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe" --start-maximized
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:2256
                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --start-maximized --ran-launcher
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Enumerates system info in registry
                    PID:2348
                    • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_crashreporter.exe
                      C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_crashreporter.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x15c,0x160,0x164,0x130,0x168,0x7feef41a490,0x7feef41a4a0,0x7feef41a4b0
                      10⤵
                      • Executes dropped EXE
                      PID:2440
                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1004 --field-trial-handle=1200,i,6513378506827934659,13276285294572357340,131072 /prefetch:2
                      10⤵
                        PID:2684
              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301021754141\assistant\_sfx.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301021754141\assistant\_sfx.exe"
                6⤵
                • Executes dropped EXE
                PID:640
              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301021754141\assistant\assistant_installer.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301021754141\assistant\assistant_installer.exe" --version
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:1744
                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301021754141\assistant\assistant_installer.exe
                  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301021754141\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x148,0x14c,0x150,0x11c,0x154,0xda2dc0,0xda2dd0,0xda2ddc
                  7⤵
                  • Executes dropped EXE
                  PID:1128
        • C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
          "C:\Users\Admin\AppData\Local\Temp\jre-windows.exe" STATIC=1
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:548
    • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera\assistant" --run-assistant --allusers=0
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2060
      • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe
        C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x12c,0x130,0x134,0x100,0x138,0xdf2dc0,0xdf2dd0,0xdf2ddc
        2⤵
        • Executes dropped EXE
        PID:2076
      • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe
        "C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2124
        • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe" --stream
          3⤵
          • Executes dropped EXE
          PID:2144
        • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe
          C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x150,0x154,0x158,0x124,0x15c,0x17623f8,0x1762408,0x1762414
          3⤵
          • Executes dropped EXE
          PID:2180
          • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
            "C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe" --stream
            4⤵
            • Executes dropped EXE
            PID:2196
          • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
            "C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe" --stream
            4⤵
            • Executes dropped EXE
            PID:2220
          • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
            "C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe" --stream
            4⤵
            • Executes dropped EXE
            PID:2244
        • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe" --stream
          3⤵
          • Executes dropped EXE
          PID:2324
    • C:\Windows\system32\wbem\unsecapp.exe
      C:\Windows\system32\wbem\unsecapp.exe -Embedding
      1⤵
        PID:2428
      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --start-maximized --ran-launcher --flag-switches-begin --flag-switches-end --enable-quic --lowered-browser
        1⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Adds Run key to start application
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2788
        • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_crashreporter.exe
          C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_crashreporter.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x15c,0x160,0x164,0x130,0x168,0x7feef41a490,0x7feef41a4a0,0x7feef41a4b0
          2⤵
          • Executes dropped EXE
          PID:2812
        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:cashback=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1160 --field-trial-handle=1228,i,11132858150205084526,6118468727254298761,131072 /prefetch:2
          2⤵
            PID:3016
          • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_autoupdate.exe
            "C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_autoupdate.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" --pipeid=oauc_pipe2906202b27b41e4bd66c9238c4b575c1
            2⤵
            • Executes dropped EXE
            PID:2292
            • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_autoupdate.exe
              C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x138,0x13c,0x140,0x10c,0x144,0x13f6c9b38,0x13f6c9b48,0x13f6c9b58
              3⤵
              • Executes dropped EXE
              PID:2364
        • C:\Windows\system32\taskeng.exe
          taskeng.exe {1A8DC5E9-8406-4A3D-9EE5-195422C745FD} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]
          1⤵
            PID:1836
            • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
              C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe --scheduledautoupdate --autoupdaterequesttype=automatic --autoupdateoperaversion=94.0.4606.38 --newautoupdaterlogic
              2⤵
              • Executes dropped EXE
              PID:2692
              • C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe" --version
                3⤵
                • Executes dropped EXE
                PID:1452
              • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_autoupdate.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_autoupdate.exe" --pipeid=oauc_task_pipedcbb8f53eff625f232ff45d764476217 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015" --scheduledtask
                3⤵
                  PID:828
                  • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_autoupdate.exe
                    C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.38\opera_autoupdate.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\Crash Reports" --crash-count-file=C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\crash_count.txt --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x138,0x13c,0x140,0x10c,0x144,0x13f9c9b38,0x13f9c9b48,0x13f9c9b58
                    4⤵
                      PID:2196
              • C:\Windows\system32\msiexec.exe
                C:\Windows\system32\msiexec.exe /V
                1⤵
                • Blocklisted process makes network request
                • Enumerates connected drives
                • Drops file in Windows directory
                • Checks processor information in registry
                • Suspicious use of AdjustPrivilegeToken
                PID:1332
                • C:\Program Files\Java\jre1.8.0_51\installer.exe
                  "C:\Program Files\Java\jre1.8.0_51\installer.exe" /s INSTALLDIR="C:\Program Files\Java\jre1.8.0_51\\" STATIC=1 REPAIRMODE=0
                  2⤵
                  • Executes dropped EXE
                  • Registers COM server for autorun
                  • Installs/modifies Browser Helper Object
                  • Drops file in Program Files directory
                  • Modifies Internet Explorer settings
                  • Modifies registry class
                  PID:1972
                  • C:\ProgramData\Oracle\Java\installcache_x64\bspatch.exe
                    "bspatch.exe" baseimagefam8 newimage diff
                    3⤵
                    • Executes dropped EXE
                    PID:2144
                  • C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
                    "C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\deploy.pack" "C:\Program Files\Java\jre1.8.0_51\lib\deploy.jar"
                    3⤵
                    • Executes dropped EXE
                    PID:2244
                  • C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
                    "C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\javaws.pack" "C:\Program Files\Java\jre1.8.0_51\lib\javaws.jar"
                    3⤵
                    • Executes dropped EXE
                    PID:536
                  • C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
                    "C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\plugin.pack" "C:\Program Files\Java\jre1.8.0_51\lib\plugin.jar"
                    3⤵
                    • Executes dropped EXE
                    PID:748
                  • C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
                    "C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\rt.pack" "C:\Program Files\Java\jre1.8.0_51\lib\rt.jar"
                    3⤵
                    • Executes dropped EXE
                    PID:2708
                  • C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
                    "C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\charsets.pack" "C:\Program Files\Java\jre1.8.0_51\lib\charsets.jar"
                    3⤵
                    • Executes dropped EXE
                    PID:2528
                  • C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
                    "C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\jsse.pack" "C:\Program Files\Java\jre1.8.0_51\lib\jsse.jar"
                    3⤵
                    • Executes dropped EXE
                    PID:2828
                  • C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
                    "C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\ext\localedata.pack" "C:\Program Files\Java\jre1.8.0_51\lib\ext\localedata.jar"
                    3⤵
                    • Executes dropped EXE
                    PID:2192
                  • C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
                    "C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\ext\jfxrt.pack" "C:\Program Files\Java\jre1.8.0_51\lib\ext\jfxrt.jar"
                    3⤵
                    • Executes dropped EXE
                    PID:668
                  • C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe
                    "C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe" -Xshare:dump
                    3⤵
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    PID:1892
                  • C:\Program Files\Java\jre1.8.0_51\bin\javaws.exe
                    "C:\Program Files\Java\jre1.8.0_51\bin\javaws.exe" -wait -fix -permissions -silent
                    3⤵
                      PID:1864
                      • C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe
                        "C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe" -classpath "C:\Program Files\Java\jre1.8.0_51\lib\deploy.jar" com.sun.deploy.panel.JreLocator
                        4⤵
                          PID:1908
                  • C:\Windows\system32\AUDIODG.EXE
                    C:\Windows\system32\AUDIODG.EXE 0x210
                    1⤵
                      PID:2960
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe"
                      1⤵
                        PID:328
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6a74f50,0x7fef6a74f60,0x7fef6a74f70
                          2⤵
                            PID:2672
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1196,6431269171576162427,8457687548993604043,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1208 /prefetch:8
                            2⤵
                              PID:2000
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe"
                            1⤵
                              PID:896
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6a74f50,0x7fef6a74f60,0x7fef6a74f70
                                2⤵
                                  PID:2332
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1044,11688206947514569163,12260153672145931068,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1300 /prefetch:8
                                  2⤵
                                    PID:1336
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1044,11688206947514569163,12260153672145931068,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1052 /prefetch:2
                                    2⤵
                                      PID:1884
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1044,11688206947514569163,12260153672145931068,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1228 /prefetch:8
                                      2⤵
                                        PID:2260
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1044,11688206947514569163,12260153672145931068,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1104 /prefetch:8
                                        2⤵
                                          PID:360
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,11688206947514569163,12260153672145931068,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1892 /prefetch:1
                                          2⤵
                                            PID:2064
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,11688206947514569163,12260153672145931068,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1876 /prefetch:1
                                            2⤵
                                              PID:1732

                                          Network

                                          MITRE ATT&CK Enterprise v6

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                                            Filesize

                                            61KB

                                            MD5

                                            fc4666cbca561e864e7fdf883a9e6661

                                            SHA1

                                            2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

                                            SHA256

                                            10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

                                            SHA512

                                            c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

                                            Download Submit

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
                                            Filesize

                                            471B

                                            MD5

                                            1becf6041afc206b8b55286097408126

                                            SHA1

                                            5c86d75790abdb247189d952101d221dcf168094

                                            SHA256

                                            c956e46f6d763dd3771c01933e3df56ef98f5af7c333079b013d05c248b710a3

                                            SHA512

                                            8ce7a6a362838d708f7cf51ce5e0a830a5ae0d49170e12fb1f32176a857775559ac59e8093e68b58050cdb01bc381db4ff6b652545b31dbd0ba37c7363f0534b

                                            Download Submit

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                            Filesize

                                            342B

                                            MD5

                                            65faa8e2738c02e9b50d6b913b19c64f

                                            SHA1

                                            da77d6ef464cef0c012172e8cf7e21657e7b1f29

                                            SHA256

                                            5e3c808ef4cf1dbd1d7d7353e6747788a16fdbf03c5ea2841883928faae159ce

                                            SHA512

                                            89442c0244d7d4297ce86141f484e451f2a8dd9479845746fbcea8538d32275b08d58d4048a8452f9f87f180ba1e43e21f455d89ca2d020df91720a6fa862326

                                            Download Submit

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                            Filesize

                                            342B

                                            MD5

                                            5af1026dce2fedd35fbb071f1d08c491

                                            SHA1

                                            d0083153de35efcbd1e1ff6080a0d43bb62b7b56

                                            SHA256

                                            507e43ee0a9f93b4cc4d2a0b6f38e2b568ac450d33ec0beadcf21720ff241180

                                            SHA512

                                            9662d58e0b5a851ec71419e8d94315279c25a0ac1825b73a5a187085832c644a46fb8db31b8fe43c9cba74578158485d8f2322bd07a9aefc4dc81f5b58e2c122

                                            Download Submit

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                            Filesize

                                            342B

                                            MD5

                                            4cabc29c923c9c587ed4a0cb3961490f

                                            SHA1

                                            c4970e124c649fe8b497d97e9b2146b7af24c0ff

                                            SHA256

                                            8a33eae1315587ad4778cd33f5fac16e8340c53c408e0a6f7908bd202bdb78bf

                                            SHA512

                                            ad224a9efd4f0362f7c57d4dd743be27e2ad1c988d0ef0a26d8586fea9b4b8ef37414c3871805daa0bf190a2da096e5120604859451bf7d2ee2219c10800aece

                                            Download Submit

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
                                            Filesize

                                            434B

                                            MD5

                                            6a59032044db0fa9e8d28a621ca16bd9

                                            SHA1

                                            809aef458aa6bfa74612f8155f5d717117920fca

                                            SHA256

                                            511ca204a6b0de02a98d9d66f8117ca19095a3c95a06dd2908ba205ec26af3ba

                                            SHA512

                                            1e3ec6ecccbb5ab280ef5dbc0f14ca0a1784e6719e67cb09670f52c3271438f93e761b23cce86dbff166e7e460ff41182fabc3d454b92651214a5434124e2a2a

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
                                            Filesize

                                            2.7MB

                                            MD5

                                            30070a0e309e538d91d80f7d6507506d

                                            SHA1

                                            b9102c24f48a1c1b8b16c68dec483d460807dd50

                                            SHA256

                                            a0490daf8bac2ba991d5f4fe4a3744a847bfe5a4651f9edf1747163a8f6e2e92

                                            SHA512

                                            7227d7f5d8e5df53990a8ac7bbd9f4c7cd72885ff024642ab38f407f0491b0520d0414497e529c3d7d233d8fa3f6b9678a7db3ae4e307d7e2f27cd0432fef654

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301021754141\assistant\_sfx.exe
                                            Filesize

                                            1.7MB

                                            MD5

                                            0238df215bf6943892daf85de8ad433a

                                            SHA1

                                            3d905e4e2c0e9170df61b7a199321847691f945e

                                            SHA256

                                            a7818aca6acbe347df13d51d9750f6a852c5aa2a58580f7f2015113e0a3e06d7

                                            SHA512

                                            fc6c12e359b9a4ce84ef878f29648a4c97c38fd12ed80996c5e03829833220010fff9c751a99f399dad3529bda6438424194ed18236addfbe430343807aaad69

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301021754141\assistant\_sfx.exe
                                            Filesize

                                            1.7MB

                                            MD5

                                            0238df215bf6943892daf85de8ad433a

                                            SHA1

                                            3d905e4e2c0e9170df61b7a199321847691f945e

                                            SHA256

                                            a7818aca6acbe347df13d51d9750f6a852c5aa2a58580f7f2015113e0a3e06d7

                                            SHA512

                                            fc6c12e359b9a4ce84ef878f29648a4c97c38fd12ed80996c5e03829833220010fff9c751a99f399dad3529bda6438424194ed18236addfbe430343807aaad69

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301021754141\assistant\assistant_installer.exe
                                            Filesize

                                            2.1MB

                                            MD5

                                            9df6e2fbb7e38964f35016bf91ef7424

                                            SHA1

                                            d0c1266dc46814bc6165cf6a69e90581228989a7

                                            SHA256

                                            3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

                                            SHA512

                                            b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301021754141\assistant\assistant_installer.exe
                                            Filesize

                                            2.1MB

                                            MD5

                                            9df6e2fbb7e38964f35016bf91ef7424

                                            SHA1

                                            d0c1266dc46814bc6165cf6a69e90581228989a7

                                            SHA256

                                            3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

                                            SHA512

                                            b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                                            Filesize

                                            1.8MB

                                            MD5

                                            f8996d2158a69a12b4bc99edd28100bc

                                            SHA1

                                            892887691df881fe432e09b618e90f50447340e6

                                            SHA256

                                            866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

                                            SHA512

                                            d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                                            Filesize

                                            1.8MB

                                            MD5

                                            f8996d2158a69a12b4bc99edd28100bc

                                            SHA1

                                            892887691df881fe432e09b618e90f50447340e6

                                            SHA256

                                            866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

                                            SHA512

                                            d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                            Filesize

                                            1.3MB

                                            MD5

                                            1313bb5df6c6e0d5c358735044fbebef

                                            SHA1

                                            cac3e2e3ed63dc147318e18f202a9da849830a91

                                            SHA256

                                            7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

                                            SHA512

                                            596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                            Filesize

                                            1.3MB

                                            MD5

                                            1313bb5df6c6e0d5c358735044fbebef

                                            SHA1

                                            cac3e2e3ed63dc147318e18f202a9da849830a91

                                            SHA256

                                            7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

                                            SHA512

                                            596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
                                            Filesize

                                            326KB

                                            MD5

                                            80d93d38badecdd2b134fe4699721223

                                            SHA1

                                            e829e58091bae93bc64e0c6f9f0bac999cfda23d

                                            SHA256

                                            c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                                            SHA512

                                            9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                                            Filesize

                                            1.3MB

                                            MD5

                                            e7bbc7b426cee4b8027a00b11f06ef34

                                            SHA1

                                            926fad387ede328d3cfd9da80d0b303a865cca98

                                            SHA256

                                            e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

                                            SHA512

                                            f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                                            Filesize

                                            1.3MB

                                            MD5

                                            e7bbc7b426cee4b8027a00b11f06ef34

                                            SHA1

                                            926fad387ede328d3cfd9da80d0b303a865cca98

                                            SHA256

                                            e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

                                            SHA512

                                            f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
                                            Filesize

                                            326KB

                                            MD5

                                            80d93d38badecdd2b134fe4699721223

                                            SHA1

                                            e829e58091bae93bc64e0c6f9f0bac999cfda23d

                                            SHA256

                                            c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                                            SHA512

                                            9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                            Filesize

                                            2.7MB

                                            MD5

                                            30070a0e309e538d91d80f7d6507506d

                                            SHA1

                                            b9102c24f48a1c1b8b16c68dec483d460807dd50

                                            SHA256

                                            a0490daf8bac2ba991d5f4fe4a3744a847bfe5a4651f9edf1747163a8f6e2e92

                                            SHA512

                                            7227d7f5d8e5df53990a8ac7bbd9f4c7cd72885ff024642ab38f407f0491b0520d0414497e529c3d7d233d8fa3f6b9678a7db3ae4e307d7e2f27cd0432fef654

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                            Filesize

                                            2.7MB

                                            MD5

                                            30070a0e309e538d91d80f7d6507506d

                                            SHA1

                                            b9102c24f48a1c1b8b16c68dec483d460807dd50

                                            SHA256

                                            a0490daf8bac2ba991d5f4fe4a3744a847bfe5a4651f9edf1747163a8f6e2e92

                                            SHA512

                                            7227d7f5d8e5df53990a8ac7bbd9f4c7cd72885ff024642ab38f407f0491b0520d0414497e529c3d7d233d8fa3f6b9678a7db3ae4e307d7e2f27cd0432fef654

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                            Filesize

                                            2.7MB

                                            MD5

                                            30070a0e309e538d91d80f7d6507506d

                                            SHA1

                                            b9102c24f48a1c1b8b16c68dec483d460807dd50

                                            SHA256

                                            a0490daf8bac2ba991d5f4fe4a3744a847bfe5a4651f9edf1747163a8f6e2e92

                                            SHA512

                                            7227d7f5d8e5df53990a8ac7bbd9f4c7cd72885ff024642ab38f407f0491b0520d0414497e529c3d7d233d8fa3f6b9678a7db3ae4e307d7e2f27cd0432fef654

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                            Filesize

                                            2.7MB

                                            MD5

                                            30070a0e309e538d91d80f7d6507506d

                                            SHA1

                                            b9102c24f48a1c1b8b16c68dec483d460807dd50

                                            SHA256

                                            a0490daf8bac2ba991d5f4fe4a3744a847bfe5a4651f9edf1747163a8f6e2e92

                                            SHA512

                                            7227d7f5d8e5df53990a8ac7bbd9f4c7cd72885ff024642ab38f407f0491b0520d0414497e529c3d7d233d8fa3f6b9678a7db3ae4e307d7e2f27cd0432fef654

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                            Filesize

                                            2.7MB

                                            MD5

                                            30070a0e309e538d91d80f7d6507506d

                                            SHA1

                                            b9102c24f48a1c1b8b16c68dec483d460807dd50

                                            SHA256

                                            a0490daf8bac2ba991d5f4fe4a3744a847bfe5a4651f9edf1747163a8f6e2e92

                                            SHA512

                                            7227d7f5d8e5df53990a8ac7bbd9f4c7cd72885ff024642ab38f407f0491b0520d0414497e529c3d7d233d8fa3f6b9678a7db3ae4e307d7e2f27cd0432fef654

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
                                            Filesize

                                            601B

                                            MD5

                                            995f07ec2a91b3ef3fd92dbf5a3cc9bf

                                            SHA1

                                            ddb011ec98c2bb5c09e0819948fb8853f73851f7

                                            SHA256

                                            e9ae97ec84f25e2d5804ac3ed9110510d6829cb9c7204ae28743fee3c5b5a416

                                            SHA512

                                            d55dd9ef1d71baf04d7905ea8135b5aa5024816b8a6e64cc2590f6f4cd8f011a9cf4b042c77a8124a8f1ce2a9c6a32ba06c3e89f3013d2a099033bb356af96c8

                                            Download Submit

                                          • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
                                            Filesize

                                            40B

                                            MD5

                                            cdbf35ba67cf72f462a1ec2ea109445e

                                            SHA1

                                            fbd265d454e5020121c3918dd8f5153da878881d

                                            SHA256

                                            96c00fb7ad1585af4314d919776f56bae0131add858e712a82e98675a679ff72

                                            SHA512

                                            6a1da267eb1bd5ac0b27887f9885b0a40ee3d238f446bcb86ef9794942c04925acf77531356ae9d623bb5c9905bfbb8b7a82b3b258806fa489aeb730949c91f8

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
                                            Filesize

                                            2.7MB

                                            MD5

                                            30070a0e309e538d91d80f7d6507506d

                                            SHA1

                                            b9102c24f48a1c1b8b16c68dec483d460807dd50

                                            SHA256

                                            a0490daf8bac2ba991d5f4fe4a3744a847bfe5a4651f9edf1747163a8f6e2e92

                                            SHA512

                                            7227d7f5d8e5df53990a8ac7bbd9f4c7cd72885ff024642ab38f407f0491b0520d0414497e529c3d7d233d8fa3f6b9678a7db3ae4e307d7e2f27cd0432fef654

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301021754141\assistant\_sfx.exe
                                            Filesize

                                            1.7MB

                                            MD5

                                            0238df215bf6943892daf85de8ad433a

                                            SHA1

                                            3d905e4e2c0e9170df61b7a199321847691f945e

                                            SHA256

                                            a7818aca6acbe347df13d51d9750f6a852c5aa2a58580f7f2015113e0a3e06d7

                                            SHA512

                                            fc6c12e359b9a4ce84ef878f29648a4c97c38fd12ed80996c5e03829833220010fff9c751a99f399dad3529bda6438424194ed18236addfbe430343807aaad69

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301021754141\assistant\assistant_installer.exe
                                            Filesize

                                            2.1MB

                                            MD5

                                            9df6e2fbb7e38964f35016bf91ef7424

                                            SHA1

                                            d0c1266dc46814bc6165cf6a69e90581228989a7

                                            SHA256

                                            3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

                                            SHA512

                                            b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301021754141\opera_package
                                            Filesize

                                            86.7MB

                                            MD5

                                            31a143013d5b31bf0a19c39ebb26fd93

                                            SHA1

                                            8a9a106585b4de6587c2e5dca51c3e390764d0c4

                                            SHA256

                                            4a38cc4fb9f71279e966d17c64d3d8bf03d61922241d9bd69edf52baac7fad66

                                            SHA512

                                            c06ae3db4711eecc177c8eabf7c91c585224387f301c092558e1efad94dd1f42b80adb04e5b5c4280e9df512ab90e755afd16b9a6f6804834a492dea9b29a41d

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301021754141\opera_package
                                            Filesize

                                            86.7MB

                                            MD5

                                            31a143013d5b31bf0a19c39ebb26fd93

                                            SHA1

                                            8a9a106585b4de6587c2e5dca51c3e390764d0c4

                                            SHA256

                                            4a38cc4fb9f71279e966d17c64d3d8bf03d61922241d9bd69edf52baac7fad66

                                            SHA512

                                            c06ae3db4711eecc177c8eabf7c91c585224387f301c092558e1efad94dd1f42b80adb04e5b5c4280e9df512ab90e755afd16b9a6f6804834a492dea9b29a41d

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\Opera_installer_2301021754103421632.dll
                                            Filesize

                                            4.3MB

                                            MD5

                                            09ce9fd443ba9fb4c7ac6cf5c2b1ae53

                                            SHA1

                                            029a9ab9c36da0756441d8346cbfece76e3820d5

                                            SHA256

                                            ceeb8dd897035807425e9d24d0d2b71d65dccf7d8f834b777a587ba697655581

                                            SHA512

                                            a3aafe2e6cf719b086759989229011ccc078c46bc456fb5a50c3b701cc5f4f8b16a4984b7dca6e51688d31a3ff40443cc80cce10a90a27c9eb5a40799900a893

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\Opera_installer_2301021754111851864.dll
                                            Filesize

                                            4.3MB

                                            MD5

                                            09ce9fd443ba9fb4c7ac6cf5c2b1ae53

                                            SHA1

                                            029a9ab9c36da0756441d8346cbfece76e3820d5

                                            SHA256

                                            ceeb8dd897035807425e9d24d0d2b71d65dccf7d8f834b777a587ba697655581

                                            SHA512

                                            a3aafe2e6cf719b086759989229011ccc078c46bc456fb5a50c3b701cc5f4f8b16a4984b7dca6e51688d31a3ff40443cc80cce10a90a27c9eb5a40799900a893

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\Opera_installer_2301021754130571984.dll
                                            Filesize

                                            4.3MB

                                            MD5

                                            09ce9fd443ba9fb4c7ac6cf5c2b1ae53

                                            SHA1

                                            029a9ab9c36da0756441d8346cbfece76e3820d5

                                            SHA256

                                            ceeb8dd897035807425e9d24d0d2b71d65dccf7d8f834b777a587ba697655581

                                            SHA512

                                            a3aafe2e6cf719b086759989229011ccc078c46bc456fb5a50c3b701cc5f4f8b16a4984b7dca6e51688d31a3ff40443cc80cce10a90a27c9eb5a40799900a893

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\Opera_installer_2301021754149601960.dll
                                            Filesize

                                            4.3MB

                                            MD5

                                            09ce9fd443ba9fb4c7ac6cf5c2b1ae53

                                            SHA1

                                            029a9ab9c36da0756441d8346cbfece76e3820d5

                                            SHA256

                                            ceeb8dd897035807425e9d24d0d2b71d65dccf7d8f834b777a587ba697655581

                                            SHA512

                                            a3aafe2e6cf719b086759989229011ccc078c46bc456fb5a50c3b701cc5f4f8b16a4984b7dca6e51688d31a3ff40443cc80cce10a90a27c9eb5a40799900a893

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\Opera_installer_230102175416925684.dll
                                            Filesize

                                            4.3MB

                                            MD5

                                            09ce9fd443ba9fb4c7ac6cf5c2b1ae53

                                            SHA1

                                            029a9ab9c36da0756441d8346cbfece76e3820d5

                                            SHA256

                                            ceeb8dd897035807425e9d24d0d2b71d65dccf7d8f834b777a587ba697655581

                                            SHA512

                                            a3aafe2e6cf719b086759989229011ccc078c46bc456fb5a50c3b701cc5f4f8b16a4984b7dca6e51688d31a3ff40443cc80cce10a90a27c9eb5a40799900a893

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                                            Filesize

                                            1.8MB

                                            MD5

                                            f8996d2158a69a12b4bc99edd28100bc

                                            SHA1

                                            892887691df881fe432e09b618e90f50447340e6

                                            SHA256

                                            866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

                                            SHA512

                                            d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                                            Filesize

                                            1.8MB

                                            MD5

                                            f8996d2158a69a12b4bc99edd28100bc

                                            SHA1

                                            892887691df881fe432e09b618e90f50447340e6

                                            SHA256

                                            866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

                                            SHA512

                                            d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                                            Filesize

                                            1.8MB

                                            MD5

                                            f8996d2158a69a12b4bc99edd28100bc

                                            SHA1

                                            892887691df881fe432e09b618e90f50447340e6

                                            SHA256

                                            866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

                                            SHA512

                                            d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                                            Filesize

                                            1.8MB

                                            MD5

                                            f8996d2158a69a12b4bc99edd28100bc

                                            SHA1

                                            892887691df881fe432e09b618e90f50447340e6

                                            SHA256

                                            866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

                                            SHA512

                                            d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                                            Filesize

                                            1.8MB

                                            MD5

                                            f8996d2158a69a12b4bc99edd28100bc

                                            SHA1

                                            892887691df881fe432e09b618e90f50447340e6

                                            SHA256

                                            866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

                                            SHA512

                                            d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                                            Filesize

                                            1.8MB

                                            MD5

                                            f8996d2158a69a12b4bc99edd28100bc

                                            SHA1

                                            892887691df881fe432e09b618e90f50447340e6

                                            SHA256

                                            866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

                                            SHA512

                                            d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
                                            Filesize

                                            1.7MB

                                            MD5

                                            1bbf5dd0b6ca80e4c7c77495c3f33083

                                            SHA1

                                            e0520037e60eb641ec04d1e814394c9da0a6a862

                                            SHA256

                                            bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

                                            SHA512

                                            97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
                                            Filesize

                                            97KB

                                            MD5

                                            da1d0cd400e0b6ad6415fd4d90f69666

                                            SHA1

                                            de9083d2902906cacf57259cf581b1466400b799

                                            SHA256

                                            7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

                                            SHA512

                                            f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                            Filesize

                                            1.3MB

                                            MD5

                                            1313bb5df6c6e0d5c358735044fbebef

                                            SHA1

                                            cac3e2e3ed63dc147318e18f202a9da849830a91

                                            SHA256

                                            7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

                                            SHA512

                                            596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                            Filesize

                                            1.3MB

                                            MD5

                                            1313bb5df6c6e0d5c358735044fbebef

                                            SHA1

                                            cac3e2e3ed63dc147318e18f202a9da849830a91

                                            SHA256

                                            7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

                                            SHA512

                                            596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                            Filesize

                                            1.3MB

                                            MD5

                                            1313bb5df6c6e0d5c358735044fbebef

                                            SHA1

                                            cac3e2e3ed63dc147318e18f202a9da849830a91

                                            SHA256

                                            7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

                                            SHA512

                                            596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                            Filesize

                                            1.3MB

                                            MD5

                                            1313bb5df6c6e0d5c358735044fbebef

                                            SHA1

                                            cac3e2e3ed63dc147318e18f202a9da849830a91

                                            SHA256

                                            7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

                                            SHA512

                                            596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                            Filesize

                                            1.3MB

                                            MD5

                                            1313bb5df6c6e0d5c358735044fbebef

                                            SHA1

                                            cac3e2e3ed63dc147318e18f202a9da849830a91

                                            SHA256

                                            7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

                                            SHA512

                                            596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
                                            Filesize

                                            326KB

                                            MD5

                                            80d93d38badecdd2b134fe4699721223

                                            SHA1

                                            e829e58091bae93bc64e0c6f9f0bac999cfda23d

                                            SHA256

                                            c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                                            SHA512

                                            9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                                            Filesize

                                            1.3MB

                                            MD5

                                            e7bbc7b426cee4b8027a00b11f06ef34

                                            SHA1

                                            926fad387ede328d3cfd9da80d0b303a865cca98

                                            SHA256

                                            e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

                                            SHA512

                                            f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                                            Filesize

                                            1.3MB

                                            MD5

                                            e7bbc7b426cee4b8027a00b11f06ef34

                                            SHA1

                                            926fad387ede328d3cfd9da80d0b303a865cca98

                                            SHA256

                                            e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

                                            SHA512

                                            f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                                            Filesize

                                            1.3MB

                                            MD5

                                            e7bbc7b426cee4b8027a00b11f06ef34

                                            SHA1

                                            926fad387ede328d3cfd9da80d0b303a865cca98

                                            SHA256

                                            e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

                                            SHA512

                                            f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                                            Filesize

                                            1.3MB

                                            MD5

                                            e7bbc7b426cee4b8027a00b11f06ef34

                                            SHA1

                                            926fad387ede328d3cfd9da80d0b303a865cca98

                                            SHA256

                                            e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

                                            SHA512

                                            f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                                            Filesize

                                            1.3MB

                                            MD5

                                            e7bbc7b426cee4b8027a00b11f06ef34

                                            SHA1

                                            926fad387ede328d3cfd9da80d0b303a865cca98

                                            SHA256

                                            e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

                                            SHA512

                                            f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
                                            Filesize

                                            326KB

                                            MD5

                                            80d93d38badecdd2b134fe4699721223

                                            SHA1

                                            e829e58091bae93bc64e0c6f9f0bac999cfda23d

                                            SHA256

                                            c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                                            SHA512

                                            9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\jre-windows.exe
                                            Filesize

                                            41.2MB

                                            MD5

                                            b9919195f61824f980f4a088d7447a11

                                            SHA1

                                            447fd1f59219282ec5d2f7a179ac12cc072171c3

                                            SHA256

                                            3895872bc4cdfb7693c227a435cf6740f968e4fa6ce0f7449e6a074e3e3a0f01

                                            SHA512

                                            d9f4e268531bd48f6b6aa4325024921bca30ebfff3ae6af5c069146a3fc401c411bdeceb306ba01fbf3bcdc48e39a367e78a1f355dc3dd5f1df75a0d585a10c6

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                            Filesize

                                            2.7MB

                                            MD5

                                            30070a0e309e538d91d80f7d6507506d

                                            SHA1

                                            b9102c24f48a1c1b8b16c68dec483d460807dd50

                                            SHA256

                                            a0490daf8bac2ba991d5f4fe4a3744a847bfe5a4651f9edf1747163a8f6e2e92

                                            SHA512

                                            7227d7f5d8e5df53990a8ac7bbd9f4c7cd72885ff024642ab38f407f0491b0520d0414497e529c3d7d233d8fa3f6b9678a7db3ae4e307d7e2f27cd0432fef654

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                            Filesize

                                            2.7MB

                                            MD5

                                            30070a0e309e538d91d80f7d6507506d

                                            SHA1

                                            b9102c24f48a1c1b8b16c68dec483d460807dd50

                                            SHA256

                                            a0490daf8bac2ba991d5f4fe4a3744a847bfe5a4651f9edf1747163a8f6e2e92

                                            SHA512

                                            7227d7f5d8e5df53990a8ac7bbd9f4c7cd72885ff024642ab38f407f0491b0520d0414497e529c3d7d233d8fa3f6b9678a7db3ae4e307d7e2f27cd0432fef654

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                            Filesize

                                            2.7MB

                                            MD5

                                            30070a0e309e538d91d80f7d6507506d

                                            SHA1

                                            b9102c24f48a1c1b8b16c68dec483d460807dd50

                                            SHA256

                                            a0490daf8bac2ba991d5f4fe4a3744a847bfe5a4651f9edf1747163a8f6e2e92

                                            SHA512

                                            7227d7f5d8e5df53990a8ac7bbd9f4c7cd72885ff024642ab38f407f0491b0520d0414497e529c3d7d233d8fa3f6b9678a7db3ae4e307d7e2f27cd0432fef654

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                            Filesize

                                            2.7MB

                                            MD5

                                            30070a0e309e538d91d80f7d6507506d

                                            SHA1

                                            b9102c24f48a1c1b8b16c68dec483d460807dd50

                                            SHA256

                                            a0490daf8bac2ba991d5f4fe4a3744a847bfe5a4651f9edf1747163a8f6e2e92

                                            SHA512

                                            7227d7f5d8e5df53990a8ac7bbd9f4c7cd72885ff024642ab38f407f0491b0520d0414497e529c3d7d233d8fa3f6b9678a7db3ae4e307d7e2f27cd0432fef654

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                            Filesize

                                            2.7MB

                                            MD5

                                            30070a0e309e538d91d80f7d6507506d

                                            SHA1

                                            b9102c24f48a1c1b8b16c68dec483d460807dd50

                                            SHA256

                                            a0490daf8bac2ba991d5f4fe4a3744a847bfe5a4651f9edf1747163a8f6e2e92

                                            SHA512

                                            7227d7f5d8e5df53990a8ac7bbd9f4c7cd72885ff024642ab38f407f0491b0520d0414497e529c3d7d233d8fa3f6b9678a7db3ae4e307d7e2f27cd0432fef654

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                            Filesize

                                            2.7MB

                                            MD5

                                            30070a0e309e538d91d80f7d6507506d

                                            SHA1

                                            b9102c24f48a1c1b8b16c68dec483d460807dd50

                                            SHA256

                                            a0490daf8bac2ba991d5f4fe4a3744a847bfe5a4651f9edf1747163a8f6e2e92

                                            SHA512

                                            7227d7f5d8e5df53990a8ac7bbd9f4c7cd72885ff024642ab38f407f0491b0520d0414497e529c3d7d233d8fa3f6b9678a7db3ae4e307d7e2f27cd0432fef654

                                            Download Submit

                                          • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                            Filesize

                                            2.7MB

                                            MD5

                                            30070a0e309e538d91d80f7d6507506d

                                            SHA1

                                            b9102c24f48a1c1b8b16c68dec483d460807dd50

                                            SHA256

                                            a0490daf8bac2ba991d5f4fe4a3744a847bfe5a4651f9edf1747163a8f6e2e92

                                            SHA512

                                            7227d7f5d8e5df53990a8ac7bbd9f4c7cd72885ff024642ab38f407f0491b0520d0414497e529c3d7d233d8fa3f6b9678a7db3ae4e307d7e2f27cd0432fef654

                                            Download Submit

                                          • memory/548-170-0x000007FEFC3E1000-0x000007FEFC3E3000-memory.dmp

                                            Filesize

                                            8KB

                                            Download

                                          • memory/684-207-0x0000000000400000-0x000000000090C000-memory.dmp

                                            Filesize

                                            5.0MB

                                            Download

                                          • memory/684-161-0x0000000000400000-0x000000000090C000-memory.dmp

                                            Filesize

                                            5.0MB

                                            Download

                                          • memory/684-145-0x0000000000400000-0x000000000090C000-memory.dmp

                                            Filesize

                                            5.0MB

                                            Download

                                          • memory/976-67-0x0000000000360000-0x0000000000748000-memory.dmp

                                            Filesize

                                            3.9MB

                                            Download

                                          • memory/976-151-0x00000000030E0000-0x00000000030F0000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/976-72-0x0000000000360000-0x0000000000748000-memory.dmp

                                            Filesize

                                            3.9MB

                                            Download

                                          • memory/976-71-0x00000000011A0000-0x00000000011CC000-memory.dmp

                                            Filesize

                                            176KB

                                            Download

                                          • memory/976-70-0x0000000010000000-0x0000000010051000-memory.dmp

                                            Filesize

                                            324KB

                                            Download

                                          • memory/976-234-0x0000000010000000-0x0000000010051000-memory.dmp

                                            Filesize

                                            324KB

                                            Download

                                          • memory/976-81-0x00000000030E0000-0x00000000030F0000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/1116-105-0x0000000002680000-0x0000000002690000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/1116-100-0x0000000000CC0000-0x00000000010A8000-memory.dmp

                                            Filesize

                                            3.9MB

                                            Download

                                          • memory/1116-115-0x0000000000CC0000-0x00000000010A8000-memory.dmp

                                            Filesize

                                            3.9MB

                                            Download

                                          • memory/1116-109-0x0000000005620000-0x0000000005B2C000-memory.dmp

                                            Filesize

                                            5.0MB

                                            Download

                                          • memory/1116-111-0x0000000005620000-0x0000000005B2C000-memory.dmp

                                            Filesize

                                            5.0MB

                                            Download

                                          • memory/1116-112-0x0000000005620000-0x0000000005B2C000-memory.dmp

                                            Filesize

                                            5.0MB

                                            Download

                                          • memory/1324-54-0x0000000076B51000-0x0000000076B53000-memory.dmp

                                            Filesize

                                            8KB

                                            Download

                                          • memory/1324-66-0x0000000002B20000-0x0000000002F08000-memory.dmp

                                            Filesize

                                            3.9MB

                                            Download

                                          • memory/1324-65-0x0000000002B20000-0x0000000002F08000-memory.dmp

                                            Filesize

                                            3.9MB

                                            Download

                                          • memory/1576-96-0x0000000002D70000-0x0000000003158000-memory.dmp

                                            Filesize

                                            3.9MB

                                            Download

                                          • memory/1576-97-0x0000000002D70000-0x0000000003158000-memory.dmp

                                            Filesize

                                            3.9MB

                                            Download

                                          • memory/1576-98-0x0000000002D70000-0x0000000003158000-memory.dmp

                                            Filesize

                                            3.9MB

                                            Download

                                          • memory/1576-99-0x0000000002D70000-0x0000000003158000-memory.dmp

                                            Filesize

                                            3.9MB

                                            Download

                                          • memory/1632-122-0x0000000002990000-0x0000000002E9C000-memory.dmp

                                            Filesize

                                            5.0MB

                                            Download

                                          • memory/1632-131-0x0000000003460000-0x000000000396C000-memory.dmp

                                            Filesize

                                            5.0MB

                                            Download

                                          • memory/1632-214-0x0000000000400000-0x000000000090C000-memory.dmp

                                            Filesize

                                            5.0MB

                                            Download

                                          • memory/1632-213-0x0000000003860000-0x0000000003862000-memory.dmp

                                            Filesize

                                            8KB

                                            Download

                                          • memory/1632-124-0x0000000000400000-0x000000000090C000-memory.dmp

                                            Filesize

                                            5.0MB

                                            Download

                                          • memory/1632-152-0x0000000002990000-0x0000000002E9C000-memory.dmp

                                            Filesize

                                            5.0MB

                                            Download

                                          • memory/1632-156-0x0000000003860000-0x0000000003D6C000-memory.dmp

                                            Filesize

                                            5.0MB

                                            Download

                                          • memory/1864-123-0x0000000000400000-0x000000000090C000-memory.dmp

                                            Filesize

                                            5.0MB

                                            Download

                                          • memory/1864-216-0x0000000000400000-0x000000000090C000-memory.dmp

                                            Filesize

                                            5.0MB

                                            Download

                                          • memory/1892-259-0x0000000002440000-0x0000000003440000-memory.dmp

                                            Filesize

                                            16.0MB

                                            Download

                                          • memory/1892-257-0x0000000002440000-0x0000000003440000-memory.dmp

                                            Filesize

                                            16.0MB

                                            Download

                                          • memory/1908-276-0x0000000002300000-0x0000000003300000-memory.dmp

                                            Filesize

                                            16.0MB

                                            Download

                                          • memory/1908-275-0x0000000002300000-0x0000000003300000-memory.dmp

                                            Filesize

                                            16.0MB

                                            Download

                                          • memory/1960-202-0x0000000000400000-0x000000000090C000-memory.dmp

                                            Filesize

                                            5.0MB

                                            Download

                                          • memory/1960-143-0x0000000000400000-0x000000000090C000-memory.dmp

                                            Filesize

                                            5.0MB

                                            Download

                                          • memory/1960-144-0x00000000028F0000-0x0000000002DFC000-memory.dmp

                                            Filesize

                                            5.0MB

                                            Download

                                          • memory/1984-130-0x0000000000400000-0x000000000090C000-memory.dmp

                                            Filesize

                                            5.0MB

                                            Download

                                          • memory/1984-133-0x0000000000400000-0x000000000090C000-memory.dmp

                                            Filesize

                                            5.0MB

                                            Download

                                          • memory/2144-242-0x0000000000230000-0x0000000000247000-memory.dmp

                                            Filesize

                                            92KB

                                            Download

                                          • memory/2144-243-0x0000000000400000-0x0000000000417000-memory.dmp

                                            Filesize

                                            92KB

                                            Download

                                          • memory/2144-239-0x0000000000400000-0x0000000000417000-memory.dmp

                                            Filesize

                                            92KB

                                            Download

                                          • memory/2144-240-0x0000000000230000-0x0000000000247000-memory.dmp

                                            Filesize

                                            92KB

                                            Download

                                          • memory/2144-241-0x0000000000230000-0x0000000000247000-memory.dmp

                                            Filesize

                                            92KB

                                            Download

                                          • memory/2348-212-0x00000000024C0000-0x00000000024D0000-memory.dmp

                                            Filesize

                                            64KB

                                            Download