Overview

overview

8

Static

static

TLauncher-....1.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    57s
  • max time network
    62s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-01-2023 16:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    TLauncher-2.86-Installer-1.0.1.exe

  • Size

    21.7MB

  • MD5

    f643be370cc9763a17f7746b1b6a0243

  • SHA1

    c65391f59a6e1421d783eaf43eb9661cfd476f82

  • SHA256

    5ab5f39d143b6ff77df2fd5026ac8e4788edfd3de27a4e1fa4b420a7d2f61d38

  • SHA512

    5ce377dc1a4a59723cf2b969c0cadb3197e5bf61d0064e2e8c94a0be9d4fd1cd9b33e05078a17e89f54b763e180be32ce14b46949a58ff47e5df18183291142f

  • SSDEEP

    393216:WXYwVCtYto0fs/dQETVlOBbpFEj9GZdqV56HpkbGCST7yuk9sLx:WowVCWTHExiTTqqHpMsV

Score
8/10
discoveryspywarestealerupx

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 11 IoCs
  • UPX packed file 20 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 9 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
    evasionspywaretrojan
  • Suspicious use of SetWindowsHookEx 19 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-2.86-Installer-1.0.1.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-2.86-Installer-1.0.1.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3876
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1908426 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.86-Installer-1.0.1.exe" "__IRCT:3" "__IRTSS:22693301" "__IRSID:S-1-5-21-929662420-1054238289-2961194603-1000"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2948
      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
        "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1468
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1814730 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" "__IRCT:3" "__IRTSS:1839152" "__IRSID:S-1-5-21-929662420-1054238289-2961194603-1000"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:548
          • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
            "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Enumerates connected drives
            • Modifies system certificate store
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4796
            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.54 --initial-client-data=0x340,0x344,0x348,0x31c,0x34c,0x6fa28658,0x6fa28668,0x6fa28674
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:5096
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe" --version
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:4192
            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --pin-additional-shortcuts=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=4796 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20230105162553" --session-guid=086e95b3-e116-4c35-ad25-8944a63e59f0 --server-tracking-blob=MjJjMWEzMGJjYzRhNmQ0YjBiZDJkN2IyMTM3NTc3NDNmMTAwMDA3YWQxNDgwNzBiZWEyNWJiMDk4YjBiNGNjMTp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInRpbWVzdGFtcCI6IjE2NzI5MzU5NTMuMzEwOSIsInVzZXJhZ2VudCI6IlNldHVwIEZhY3RvcnkgOS4wIiwidXRtIjp7ImNhbXBhaWduIjoiT3BlcmFEZXNrdG9wIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiTVNUTCJ9LCJ1dWlkIjoiYzQzMzNkYjEtYWIyNS00OWExLWJhYWYtYjhhODVjY2Q0MDZlIn0= --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=E405000000000000
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Enumerates connected drives
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3668
              • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.54 --initial-client-data=0x34c,0x350,0x354,0x31c,0x358,0x6ef68658,0x6ef68668,0x6ef68674
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:1740
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301051625531\assistant\_sfx.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301051625531\assistant\_sfx.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:2716
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301051625531\assistant\assistant_installer.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301051625531\assistant\assistant_installer.exe" --version
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4712
              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301051625531\assistant\assistant_installer.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301051625531\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x2fc,0x1192dc0,0x1192dd0,0x1192ddc
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4276
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 416 -p 456 -ip 456
    1⤵
      PID:2276
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 456 -s 2460
      1⤵
      • Program crash
      PID:5016

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
      Filesize

      471B

      MD5

      2f090120b2020c6ec097b8469d96aa92

      SHA1

      fe1919c257ab5aecb5472446d022c9f0defa5dbb

      SHA256

      7484b437fb0d956047460be95666ca08eb451b6b50f98e88b47c02c6635b0ac7

      SHA512

      c7282023f5c467e7dba4ff514fbc18fe461850bdbff7aadddf214b1b9bc87deac75a98145192b11e23b635f94e03f7c83b243f17fe5c4bab91ce0b3fcf2285be

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
      Filesize

      434B

      MD5

      07c93556b06b8a3a7d9f0804b53ce8a4

      SHA1

      9a1a7c4e02f668aa67aef5a5e3bdf04eb3f81c85

      SHA256

      d600a0c9ef55f63309ed62ae3247290f5b7536bf5668f3ee3ea9e73049c85743

      SHA512

      7112ba34b75be1bd409147a3ce03de2dc9da96800eed271e3ee908b1d940278038320048350a5f798b8ebf0062dce156f5280d98076a15dc3889c315adeb2f1d

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
      Filesize

      2.7MB

      MD5

      8e059a5998daefe17ba4fef64918b632

      SHA1

      286b0a1c140e55290da6ab04b75743589457eb02

      SHA256

      248dd895ec83e340d1b07ca43c3fd8c40e38cc6f276c61def87264461d148bfd

      SHA512

      46ea749a58fc04b01e7a33458e720dc4ff19c58808569242062d5aa407c3db8f76c002cea9061ab87668a3377ba699279676d82ebcd0e84122402bbf6c55f736

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
      Filesize

      2.7MB

      MD5

      8e059a5998daefe17ba4fef64918b632

      SHA1

      286b0a1c140e55290da6ab04b75743589457eb02

      SHA256

      248dd895ec83e340d1b07ca43c3fd8c40e38cc6f276c61def87264461d148bfd

      SHA512

      46ea749a58fc04b01e7a33458e720dc4ff19c58808569242062d5aa407c3db8f76c002cea9061ab87668a3377ba699279676d82ebcd0e84122402bbf6c55f736

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301051625531\assistant\_sfx.exe
      Filesize

      1.7MB

      MD5

      0238df215bf6943892daf85de8ad433a

      SHA1

      3d905e4e2c0e9170df61b7a199321847691f945e

      SHA256

      a7818aca6acbe347df13d51d9750f6a852c5aa2a58580f7f2015113e0a3e06d7

      SHA512

      fc6c12e359b9a4ce84ef878f29648a4c97c38fd12ed80996c5e03829833220010fff9c751a99f399dad3529bda6438424194ed18236addfbe430343807aaad69

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301051625531\assistant\_sfx.exe
      Filesize

      1.7MB

      MD5

      0238df215bf6943892daf85de8ad433a

      SHA1

      3d905e4e2c0e9170df61b7a199321847691f945e

      SHA256

      a7818aca6acbe347df13d51d9750f6a852c5aa2a58580f7f2015113e0a3e06d7

      SHA512

      fc6c12e359b9a4ce84ef878f29648a4c97c38fd12ed80996c5e03829833220010fff9c751a99f399dad3529bda6438424194ed18236addfbe430343807aaad69

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301051625531\assistant\assistant_installer.exe
      Filesize

      2.1MB

      MD5

      9df6e2fbb7e38964f35016bf91ef7424

      SHA1

      d0c1266dc46814bc6165cf6a69e90581228989a7

      SHA256

      3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

      SHA512

      b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301051625531\assistant\assistant_installer.exe
      Filesize

      2.1MB

      MD5

      9df6e2fbb7e38964f35016bf91ef7424

      SHA1

      d0c1266dc46814bc6165cf6a69e90581228989a7

      SHA256

      3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

      SHA512

      b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301051625531\assistant\assistant_installer.exe
      Filesize

      2.1MB

      MD5

      9df6e2fbb7e38964f35016bf91ef7424

      SHA1

      d0c1266dc46814bc6165cf6a69e90581228989a7

      SHA256

      3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

      SHA512

      b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301051625531\opera_package
      Filesize

      72.6MB

      MD5

      0df45211843d62ee919c6edb7dbc5724

      SHA1

      3bd510480fc571096a4185266a98e819bd9ceb71

      SHA256

      fc246681411fab8f256b093d2744ad8e126352bbf3b8f8159e5ed4a0c7552c66

      SHA512

      699871865557a0d9a2084037942342b082c96d70db39c81227f90aece28faaca4d4a8680b36c9ce978cc03ab0e270456fc6f8dc7a0d4a8f3148f0ebbba59bd77

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2301051625518744796.dll
      Filesize

      4.3MB

      MD5

      abd49f95860291b4bea7ed2a17516f3d

      SHA1

      728f48e85427acf242f65da8dee22588c373e9aa

      SHA256

      1da2b7d6cea59b309a892d4ddb64a1f4d8fefd9b9d65da0b3aa0d42e4cedb8bf

      SHA512

      64c32133cee5f62a59cfbfad4742c1479ec2ab53188e09c97a18a062795e62cba3132f1b01b5748b91a4e6f010be933229eb7dc640ecbc7f7c8fda8a3efe7e94

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2301051625525305096.dll
      Filesize

      4.3MB

      MD5

      abd49f95860291b4bea7ed2a17516f3d

      SHA1

      728f48e85427acf242f65da8dee22588c373e9aa

      SHA256

      1da2b7d6cea59b309a892d4ddb64a1f4d8fefd9b9d65da0b3aa0d42e4cedb8bf

      SHA512

      64c32133cee5f62a59cfbfad4742c1479ec2ab53188e09c97a18a062795e62cba3132f1b01b5748b91a4e6f010be933229eb7dc640ecbc7f7c8fda8a3efe7e94

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2301051625529054192.dll
      Filesize

      4.3MB

      MD5

      abd49f95860291b4bea7ed2a17516f3d

      SHA1

      728f48e85427acf242f65da8dee22588c373e9aa

      SHA256

      1da2b7d6cea59b309a892d4ddb64a1f4d8fefd9b9d65da0b3aa0d42e4cedb8bf

      SHA512

      64c32133cee5f62a59cfbfad4742c1479ec2ab53188e09c97a18a062795e62cba3132f1b01b5748b91a4e6f010be933229eb7dc640ecbc7f7c8fda8a3efe7e94

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2301051625535463668.dll
      Filesize

      4.3MB

      MD5

      abd49f95860291b4bea7ed2a17516f3d

      SHA1

      728f48e85427acf242f65da8dee22588c373e9aa

      SHA256

      1da2b7d6cea59b309a892d4ddb64a1f4d8fefd9b9d65da0b3aa0d42e4cedb8bf

      SHA512

      64c32133cee5f62a59cfbfad4742c1479ec2ab53188e09c97a18a062795e62cba3132f1b01b5748b91a4e6f010be933229eb7dc640ecbc7f7c8fda8a3efe7e94

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2301051626048741740.dll
      Filesize

      4.3MB

      MD5

      abd49f95860291b4bea7ed2a17516f3d

      SHA1

      728f48e85427acf242f65da8dee22588c373e9aa

      SHA256

      1da2b7d6cea59b309a892d4ddb64a1f4d8fefd9b9d65da0b3aa0d42e4cedb8bf

      SHA512

      64c32133cee5f62a59cfbfad4742c1479ec2ab53188e09c97a18a062795e62cba3132f1b01b5748b91a4e6f010be933229eb7dc640ecbc7f7c8fda8a3efe7e94

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
      Filesize

      1.8MB

      MD5

      f8996d2158a69a12b4bc99edd28100bc

      SHA1

      892887691df881fe432e09b618e90f50447340e6

      SHA256

      866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

      SHA512

      d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
      Filesize

      1.8MB

      MD5

      f8996d2158a69a12b4bc99edd28100bc

      SHA1

      892887691df881fe432e09b618e90f50447340e6

      SHA256

      866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

      SHA512

      d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
      Filesize

      1.7MB

      MD5

      1bbf5dd0b6ca80e4c7c77495c3f33083

      SHA1

      e0520037e60eb641ec04d1e814394c9da0a6a862

      SHA256

      bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

      SHA512

      97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
      Filesize

      97KB

      MD5

      da1d0cd400e0b6ad6415fd4d90f69666

      SHA1

      de9083d2902906cacf57259cf581b1466400b799

      SHA256

      7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

      SHA512

      f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      Filesize

      1.3MB

      MD5

      1313bb5df6c6e0d5c358735044fbebef

      SHA1

      cac3e2e3ed63dc147318e18f202a9da849830a91

      SHA256

      7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

      SHA512

      596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      Filesize

      1.3MB

      MD5

      1313bb5df6c6e0d5c358735044fbebef

      SHA1

      cac3e2e3ed63dc147318e18f202a9da849830a91

      SHA256

      7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

      SHA512

      596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
      Filesize

      326KB

      MD5

      80d93d38badecdd2b134fe4699721223

      SHA1

      e829e58091bae93bc64e0c6f9f0bac999cfda23d

      SHA256

      c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

      SHA512

      9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
      Filesize

      326KB

      MD5

      80d93d38badecdd2b134fe4699721223

      SHA1

      e829e58091bae93bc64e0c6f9f0bac999cfda23d

      SHA256

      c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

      SHA512

      9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
      Filesize

      1.3MB

      MD5

      e7bbc7b426cee4b8027a00b11f06ef34

      SHA1

      926fad387ede328d3cfd9da80d0b303a865cca98

      SHA256

      e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

      SHA512

      f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
      Filesize

      1.3MB

      MD5

      e7bbc7b426cee4b8027a00b11f06ef34

      SHA1

      926fad387ede328d3cfd9da80d0b303a865cca98

      SHA256

      e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

      SHA512

      f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
      Filesize

      326KB

      MD5

      80d93d38badecdd2b134fe4699721223

      SHA1

      e829e58091bae93bc64e0c6f9f0bac999cfda23d

      SHA256

      c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

      SHA512

      9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
      Filesize

      326KB

      MD5

      80d93d38badecdd2b134fe4699721223

      SHA1

      e829e58091bae93bc64e0c6f9f0bac999cfda23d

      SHA256

      c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

      SHA512

      9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
      Filesize

      2.7MB

      MD5

      8e059a5998daefe17ba4fef64918b632

      SHA1

      286b0a1c140e55290da6ab04b75743589457eb02

      SHA256

      248dd895ec83e340d1b07ca43c3fd8c40e38cc6f276c61def87264461d148bfd

      SHA512

      46ea749a58fc04b01e7a33458e720dc4ff19c58808569242062d5aa407c3db8f76c002cea9061ab87668a3377ba699279676d82ebcd0e84122402bbf6c55f736

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
      Filesize

      2.7MB

      MD5

      8e059a5998daefe17ba4fef64918b632

      SHA1

      286b0a1c140e55290da6ab04b75743589457eb02

      SHA256

      248dd895ec83e340d1b07ca43c3fd8c40e38cc6f276c61def87264461d148bfd

      SHA512

      46ea749a58fc04b01e7a33458e720dc4ff19c58808569242062d5aa407c3db8f76c002cea9061ab87668a3377ba699279676d82ebcd0e84122402bbf6c55f736

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
      Filesize

      2.7MB

      MD5

      8e059a5998daefe17ba4fef64918b632

      SHA1

      286b0a1c140e55290da6ab04b75743589457eb02

      SHA256

      248dd895ec83e340d1b07ca43c3fd8c40e38cc6f276c61def87264461d148bfd

      SHA512

      46ea749a58fc04b01e7a33458e720dc4ff19c58808569242062d5aa407c3db8f76c002cea9061ab87668a3377ba699279676d82ebcd0e84122402bbf6c55f736

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
      Filesize

      2.7MB

      MD5

      8e059a5998daefe17ba4fef64918b632

      SHA1

      286b0a1c140e55290da6ab04b75743589457eb02

      SHA256

      248dd895ec83e340d1b07ca43c3fd8c40e38cc6f276c61def87264461d148bfd

      SHA512

      46ea749a58fc04b01e7a33458e720dc4ff19c58808569242062d5aa407c3db8f76c002cea9061ab87668a3377ba699279676d82ebcd0e84122402bbf6c55f736

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
      Filesize

      2.7MB

      MD5

      8e059a5998daefe17ba4fef64918b632

      SHA1

      286b0a1c140e55290da6ab04b75743589457eb02

      SHA256

      248dd895ec83e340d1b07ca43c3fd8c40e38cc6f276c61def87264461d148bfd

      SHA512

      46ea749a58fc04b01e7a33458e720dc4ff19c58808569242062d5aa407c3db8f76c002cea9061ab87668a3377ba699279676d82ebcd0e84122402bbf6c55f736

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
      Filesize

      646B

      MD5

      2f74e7157f01406ed0d7e5edafc3f506

      SHA1

      d8f9f4c759fa9abfa24d4df8f5ec48b2f3336b95

      SHA256

      6513cbeaa5e90fdd7b487c15e481035c5f57779a29ec270a9e46447bd25289e6

      SHA512

      3f2f27eb75a05d5e4c0169d715247c682cb3980e8d862a49559bf3ca93c4a620e302f4c6f5e83d804cbde6fad6f3a1758bbf737d48bc3d29a344ed719a97977d

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
      Filesize

      40B

      MD5

      ed2a9a99243f6199edce195f4a3697f5

      SHA1

      f130efdfdd47227ec0955034baf534ff7fa816c7

      SHA256

      6cbe1467b4380b39733178e4d169fc69a7cd743ee5711749c273adacb6909e9f

      SHA512

      a4a5ff28d8b4bb50213038dd7b6ac8d5ece40108de5368e4295f19f3fb71aa92da2bcfa0f94e314d1fad128e784fbf4809ea4f2bfa7f4f8c8706797583b2cb42

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
      Filesize

      40B

      MD5

      ed2a9a99243f6199edce195f4a3697f5

      SHA1

      f130efdfdd47227ec0955034baf534ff7fa816c7

      SHA256

      6cbe1467b4380b39733178e4d169fc69a7cd743ee5711749c273adacb6909e9f

      SHA512

      a4a5ff28d8b4bb50213038dd7b6ac8d5ece40108de5368e4295f19f3fb71aa92da2bcfa0f94e314d1fad128e784fbf4809ea4f2bfa7f4f8c8706797583b2cb42

      Download Submit

    • memory/548-150-0x0000000000580000-0x0000000000968000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/548-161-0x0000000000580000-0x0000000000968000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/1740-177-0x0000000000400000-0x000000000090C000-memory.dmp

      Filesize

      5.0MB

      Download

    • memory/2948-142-0x0000000000C10000-0x0000000000FF8000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/2948-140-0x0000000010000000-0x0000000010051000-memory.dmp

      Filesize

      324KB

      Download

    • memory/2948-141-0x0000000006D70000-0x0000000006D73000-memory.dmp

      Filesize

      12KB

      Download

    • memory/2948-137-0x0000000000C10000-0x0000000000FF8000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/3668-175-0x0000000000400000-0x000000000090C000-memory.dmp

      Filesize

      5.0MB

      Download

    • memory/4192-166-0x0000000000400000-0x000000000090C000-memory.dmp

      Filesize

      5.0MB

      Download

    • memory/4796-157-0x0000000000400000-0x000000000090C000-memory.dmp

      Filesize

      5.0MB

      Download

    • memory/5096-167-0x0000000000400000-0x000000000090C000-memory.dmp

      Filesize

      5.0MB

      Download