Overview

overview

8

Static

static

TLauncher-...al.exe

windows7-x64

8

TLauncher-...al.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    31/01/2023, 17:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    TLauncher-2.871-Installer-1.0.6-global.exe

  • Size

    23.6MB

  • MD5

    7a4472a78d0651e11d20aa08e43cc045

  • SHA1

    aab1d5f80d7399ae2c1982201733be7681d100b1

  • SHA256

    318df7404e6c4d5538a6d31997b95af52bbb8d40caf5553b3cbd9b1bc4f6db96

  • SHA512

    c152c9d21b0615548173dcc61accb1a1afd5b6f98e6ec21f6a7119536397f07a54ad4087669716c3344dd338ce4f24cecf9989d472f65eaa18c87d496f23c681

  • SSDEEP

    393216:gXQLpnUN/n8IPfs/dQETVlOBbpFEj9GZ1GphRqV56Hpk7IXOzDnKI17fyVS:ggLFUp8aHExiTI3qqHp6zvKcfyVS

Score
8/10
discoverypersistencespywarestealerupx

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 30 IoCs
  • UPX packed file 41 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 27 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 9 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1700
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe" "__IRCT:3" "__IRTSS:24771453" "__IRSID:S-1-5-21-3406023954-474543476-3319432036-1000"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:680
      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
        "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1312
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816850 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" "__IRCT:3" "__IRTSS:1840872" "__IRSID:S-1-5-21-3406023954-474543476-3319432036-1000"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies system certificate store
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:432
          • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
            "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Enumerates connected drives
            • Modifies system certificate store
            • Suspicious use of WriteProcessMemory
            PID:548
            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.76 --initial-client-data=0x1a4,0x1a8,0x1ac,0x178,0x1b0,0x719d8658,0x719d8668,0x719d8674
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1616
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe" --version
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:828
            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --pin-additional-shortcuts=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=548 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20230131185049" --session-guid=fe318a02-5de4-43a1-bb8c-af8654f75ee3 --server-tracking-blob=NjRkNTBmMjg4MDZmNjdhNzk5OWU2NGFhYWFlNWIwZjMwNDM4NDczZjBhYTRhOWZlNDhiZmVhNGY5OGQyZDg3Mzp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInRpbWVzdGFtcCI6IjE2NzUxODc0NDYuMTM1MyIsInVzZXJhZ2VudCI6IlNldHVwIEZhY3RvcnkgOS4wIiwidXRtIjp7ImNhbXBhaWduIjoiT3BlcmFEZXNrdG9wIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiTVNUTCJ9LCJ1dWlkIjoiZWVmMTJhMDMtY2UyYS00NzMwLThjOTQtZTY5N2U2MmRmNGI1In0= --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=0C03000000000000
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Enumerates connected drives
              • Suspicious use of WriteProcessMemory
              PID:480
              • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.76 --initial-client-data=0x1b0,0x1b4,0x1b8,0x178,0x1bc,0x70fb8658,0x70fb8668,0x70fb8674
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:1332
              • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\installer.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\installer.exe" --backend --initial-pid=548 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --pin-additional-shortcuts=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301311850491" --session-guid=fe318a02-5de4-43a1-bb8c-af8654f75ee3 --server-tracking-blob=NjRkNTBmMjg4MDZmNjdhNzk5OWU2NGFhYWFlNWIwZjMwNDM4NDczZjBhYTRhOWZlNDhiZmVhNGY5OGQyZDg3Mzp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInRpbWVzdGFtcCI6IjE2NzUxODc0NDYuMTM1MyIsInVzZXJhZ2VudCI6IlNldHVwIEZhY3RvcnkgOS4wIiwidXRtIjp7ImNhbXBhaWduIjoiT3BlcmFEZXNrdG9wIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiTVNUTCJ9LCJ1dWlkIjoiZWVmMTJhMDMtY2UyYS00NzMwLThjOTQtZTY5N2U2MmRmNGI1In0= --silent --desktopshortcut=1 --install-subfolder=94.0.4606.76
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates connected drives
                • Modifies registry class
                PID:932
                • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\installer.exe
                  C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\installer.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.76 --initial-client-data=0x174,0x178,0x17c,0x148,0x180,0x7fef4832c98,0x7fef4832ca8,0x7fef4832cb8
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:1196
                • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe" --start-maximized
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:2104
                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --start-maximized --ran-launcher
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Enumerates system info in registry
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2144
                    • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\opera_crashreporter.exe
                      C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\opera_crashreporter.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.76 --initial-client-data=0x15c,0x160,0x164,0x130,0x168,0x7feef2dc490,0x7feef2dc4a0,0x7feef2dc4b0
                      10⤵
                      • Executes dropped EXE
                      PID:2160
                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1008 --field-trial-handle=1140,i,2896210966124628743,18294009756278417418,131072 /prefetch:2
                      10⤵
                      • Executes dropped EXE
                      PID:2316
                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=1416 --field-trial-handle=1140,i,2896210966124628743,18294009756278417418,131072 /prefetch:8
                      10⤵
                      • Executes dropped EXE
                      PID:2460
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301311850491\assistant\_sfx.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301311850491\assistant\_sfx.exe"
              6⤵
              • Executes dropped EXE
              PID:1500
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301311850491\assistant\assistant_installer.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301311850491\assistant\assistant_installer.exe" --version
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1976
              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301311850491\assistant\assistant_installer.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301311850491\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x148,0x14c,0x150,0x11c,0x154,0xe52dc0,0xe52dd0,0xe52ddc
                7⤵
                • Executes dropped EXE
                PID:1636
      • C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
        "C:\Users\Admin\AppData\Local\Temp\jre-windows.exe" STATIC=1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1532
        • C:\Users\Admin\AppData\Local\Temp\jds7192613.tmp\jre-windows.exe
          "C:\Users\Admin\AppData\Local\Temp\jds7192613.tmp\jre-windows.exe" "STATIC=1"
          4⤵
          • Executes dropped EXE
          • Modifies Internet Explorer settings
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1808
  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --start-maximized --ran-launcher --flag-switches-begin --flag-switches-end --enable-quic --lowered-browser
    1⤵
    • Executes dropped EXE
    • Checks computer location settings
    • Adds Run key to start application
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2616
    • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\opera_crashreporter.exe
      C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\opera_crashreporter.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.76 --initial-client-data=0x15c,0x160,0x164,0x130,0x168,0x7feef2dc490,0x7feef2dc4a0,0x7feef2dc4b0
      2⤵
      • Executes dropped EXE
      PID:2648
    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1040 --field-trial-handle=1148,i,1981359818852606041,18123177277520168250,131072 /prefetch:2
      2⤵
      • Executes dropped EXE
      PID:2800
    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=1376 --field-trial-handle=1148,i,1981359818852606041,18123177277520168250,131072 /prefetch:8
      2⤵
      • Executes dropped EXE
      PID:2980
    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=1504 --field-trial-handle=1148,i,1981359818852606041,18123177277520168250,131072 /prefetch:8
      2⤵
      • Executes dropped EXE
      PID:2992
    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=2032 --field-trial-handle=1148,i,1981359818852606041,18123177277520168250,131072 /prefetch:8
      2⤵
      • Executes dropped EXE
      PID:2372
    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --mojo-platform-channel-handle=2080 --field-trial-handle=1148,i,1981359818852606041,18123177277520168250,131072 /prefetch:8
      2⤵
        PID:1544
      • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\opera_autoupdate.exe
        "C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\opera_autoupdate.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" --pipeid=oauc_pipe2906202b27b41e4bd66c9238c4b575c1
        2⤵
        • Executes dropped EXE
        PID:2632
        • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\opera_autoupdate.exe
          C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.76 --initial-client-data=0x138,0x13c,0x140,0x10c,0x144,0x13f59ab38,0x13f59ab48,0x13f59ab58
          3⤵
          • Executes dropped EXE
          PID:2272
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Blocklisted process makes network request
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:824
      • C:\Windows\system32\MsiExec.exe
        C:\Windows\system32\MsiExec.exe -Embedding F1A10546BB63A8223212BADCD00EDE0E
        2⤵
          PID:2512
        • C:\Program Files\Java\jre1.8.0_351\installer.exe
          "C:\Program Files\Java\jre1.8.0_351\installer.exe" /s INSTALLDIR="C:\Program Files\Java\jre1.8.0_351\\" STATIC=1 INSTALL_SILENT=1 REPAIRMODE=0 ProductCode={26A24AE4-039D-4CA4-87B4-2F64180351F0}
          2⤵
          • Executes dropped EXE
          PID:2168
      • C:\Windows\system32\taskeng.exe
        taskeng.exe {6A4EA925-BB09-4A7F-B4E5-987A241893C1} S-1-5-21-3406023954-474543476-3319432036-1000:VUIIVLGQ\Admin:Interactive:[1]
        1⤵
          PID:2208
          • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
            C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe --scheduledautoupdate --autoupdaterequesttype=automatic --autoupdateoperaversion=94.0.4606.76 --newautoupdaterlogic
            2⤵
            • Executes dropped EXE
            PID:2828

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
          Filesize

          61KB

          MD5

          fc4666cbca561e864e7fdf883a9e6661

          SHA1

          2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

          SHA256

          10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

          SHA512

          c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
          Filesize

          471B

          MD5

          b93def072383f54ce5000ce4b8ccf928

          SHA1

          2e5498d461734043bb8388e90ace8e0002ed0bd7

          SHA256

          f76fef89e8b688e22a28018a2db8ebebc33d5d42aef85c52c8b27073858aef56

          SHA512

          036c448d11f475abf480b62c377cc164edf7e8c6879f2cce3ea0aa88dd2ba33c3202c7724833bd771f8b4b3fed5ae3e4f95e061327e2469cbf89b04afc981adc

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          68ffcc4ee79e762cc37295c449123b9b

          SHA1

          9484d340de3872b21cf5e57b14ee6c29dd802e0c

          SHA256

          1c6dea65e66f74dd7f358b1106dd3175b5b4a9ba97626e9f4bf3cacd4b4cc33f

          SHA512

          a7efe9230ded350965d69d600b0149e0c14d56d94b7868c8f87f1b271e2f9ea79b74b7300be3a7f1819ca90d91695db0d3981399ccdc4d03028341f32e64e55f

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          1b279e553f1921830252dad18cbd5f8a

          SHA1

          409c2b18a18f23fc8287f7c1a07bc03668597c97

          SHA256

          b5f91ae32da7627c45547caae95c3ab0c77e00b18b50b0285b776a34b21b8a87

          SHA512

          5ce438238f23367a077b79d359d735cd5043a76db5b97a57a5b0cef30a36ec381bc45c4812c0dae14d253eba4ffcd9efb6fd855c9d4c251f9de5dd5bef2def72

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
          Filesize

          434B

          MD5

          8201da3947e1206a61297bf1e76d00ac

          SHA1

          12188738c19e848ab70624c1c41924b8865e7cdf

          SHA256

          588c071a5ffd72c521e9402254e249dfc25cb13ccb3cdffdb5ad0fbea8341984

          SHA512

          534730ae09ba2cf3bfe14a262b3d6113af3a653cc860478b06bb02697775f95c14d77dbd7c923cff66cfb0bf666bd7d7b5d04214785b37ea7521b9319b75a9a5

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
          Filesize

          2.7MB

          MD5

          f0229746fcbce9698014f2d4b3c9c0f2

          SHA1

          f5c77b17678af5e5174c2331d5ece7652fa85909

          SHA256

          331e9c12c7e410884563268bb4c421b37732298ecfc99ad321f22f1ac8e81089

          SHA512

          a27be9f4f2aa0a3b734d12e92d0be27b5f611063b07b424b1f8ef5dc1fa97dffef989ed6b85a4bdc26bfe219505520a703aac2d0af2660c43a01d932f5c1ab8a

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301311850491\assistant\_sfx.exe
          Filesize

          1.7MB

          MD5

          0238df215bf6943892daf85de8ad433a

          SHA1

          3d905e4e2c0e9170df61b7a199321847691f945e

          SHA256

          a7818aca6acbe347df13d51d9750f6a852c5aa2a58580f7f2015113e0a3e06d7

          SHA512

          fc6c12e359b9a4ce84ef878f29648a4c97c38fd12ed80996c5e03829833220010fff9c751a99f399dad3529bda6438424194ed18236addfbe430343807aaad69

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301311850491\assistant\_sfx.exe
          Filesize

          1.7MB

          MD5

          0238df215bf6943892daf85de8ad433a

          SHA1

          3d905e4e2c0e9170df61b7a199321847691f945e

          SHA256

          a7818aca6acbe347df13d51d9750f6a852c5aa2a58580f7f2015113e0a3e06d7

          SHA512

          fc6c12e359b9a4ce84ef878f29648a4c97c38fd12ed80996c5e03829833220010fff9c751a99f399dad3529bda6438424194ed18236addfbe430343807aaad69

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301311850491\assistant\assistant_installer.exe
          Filesize

          2.1MB

          MD5

          9df6e2fbb7e38964f35016bf91ef7424

          SHA1

          d0c1266dc46814bc6165cf6a69e90581228989a7

          SHA256

          3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

          SHA512

          b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301311850491\assistant\assistant_installer.exe
          Filesize

          2.1MB

          MD5

          9df6e2fbb7e38964f35016bf91ef7424

          SHA1

          d0c1266dc46814bc6165cf6a69e90581228989a7

          SHA256

          3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

          SHA512

          b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301311850491\assistant\assistant_installer.exe
          Filesize

          2.1MB

          MD5

          9df6e2fbb7e38964f35016bf91ef7424

          SHA1

          d0c1266dc46814bc6165cf6a69e90581228989a7

          SHA256

          3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

          SHA512

          b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
          Filesize

          1.8MB

          MD5

          aa4de04ccc16b74a4c2301da8d621ec1

          SHA1

          d05c6d8200f6e6b1283df82d24d687adc47d9664

          SHA256

          e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

          SHA512

          28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
          Filesize

          1.8MB

          MD5

          aa4de04ccc16b74a4c2301da8d621ec1

          SHA1

          d05c6d8200f6e6b1283df82d24d687adc47d9664

          SHA256

          e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

          SHA512

          28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
          Filesize

          1.3MB

          MD5

          7e08af319c9eb3297e09ca7bb8387de4

          SHA1

          4cf091f77a3eb9437ef33985e64bd10c1257284f

          SHA256

          6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

          SHA512

          bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
          Filesize

          1.3MB

          MD5

          7e08af319c9eb3297e09ca7bb8387de4

          SHA1

          4cf091f77a3eb9437ef33985e64bd10c1257284f

          SHA256

          6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

          SHA512

          bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
          Filesize

          326KB

          MD5

          80d93d38badecdd2b134fe4699721223

          SHA1

          e829e58091bae93bc64e0c6f9f0bac999cfda23d

          SHA256

          c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

          SHA512

          9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          Filesize

          1.3MB

          MD5

          e801c5847f5f9d207db53aaaf5c6f3a2

          SHA1

          8e6818ce66555e2cca92e5c5f32551fb4a91645e

          SHA256

          196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

          SHA512

          303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          Filesize

          1.3MB

          MD5

          e801c5847f5f9d207db53aaaf5c6f3a2

          SHA1

          8e6818ce66555e2cca92e5c5f32551fb4a91645e

          SHA256

          196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

          SHA512

          303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
          Filesize

          326KB

          MD5

          80d93d38badecdd2b134fe4699721223

          SHA1

          e829e58091bae93bc64e0c6f9f0bac999cfda23d

          SHA256

          c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

          SHA512

          9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
          Filesize

          2.7MB

          MD5

          f0229746fcbce9698014f2d4b3c9c0f2

          SHA1

          f5c77b17678af5e5174c2331d5ece7652fa85909

          SHA256

          331e9c12c7e410884563268bb4c421b37732298ecfc99ad321f22f1ac8e81089

          SHA512

          a27be9f4f2aa0a3b734d12e92d0be27b5f611063b07b424b1f8ef5dc1fa97dffef989ed6b85a4bdc26bfe219505520a703aac2d0af2660c43a01d932f5c1ab8a

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
          Filesize

          2.7MB

          MD5

          f0229746fcbce9698014f2d4b3c9c0f2

          SHA1

          f5c77b17678af5e5174c2331d5ece7652fa85909

          SHA256

          331e9c12c7e410884563268bb4c421b37732298ecfc99ad321f22f1ac8e81089

          SHA512

          a27be9f4f2aa0a3b734d12e92d0be27b5f611063b07b424b1f8ef5dc1fa97dffef989ed6b85a4bdc26bfe219505520a703aac2d0af2660c43a01d932f5c1ab8a

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
          Filesize

          2.7MB

          MD5

          f0229746fcbce9698014f2d4b3c9c0f2

          SHA1

          f5c77b17678af5e5174c2331d5ece7652fa85909

          SHA256

          331e9c12c7e410884563268bb4c421b37732298ecfc99ad321f22f1ac8e81089

          SHA512

          a27be9f4f2aa0a3b734d12e92d0be27b5f611063b07b424b1f8ef5dc1fa97dffef989ed6b85a4bdc26bfe219505520a703aac2d0af2660c43a01d932f5c1ab8a

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
          Filesize

          2.7MB

          MD5

          f0229746fcbce9698014f2d4b3c9c0f2

          SHA1

          f5c77b17678af5e5174c2331d5ece7652fa85909

          SHA256

          331e9c12c7e410884563268bb4c421b37732298ecfc99ad321f22f1ac8e81089

          SHA512

          a27be9f4f2aa0a3b734d12e92d0be27b5f611063b07b424b1f8ef5dc1fa97dffef989ed6b85a4bdc26bfe219505520a703aac2d0af2660c43a01d932f5c1ab8a

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
          Filesize

          2.7MB

          MD5

          f0229746fcbce9698014f2d4b3c9c0f2

          SHA1

          f5c77b17678af5e5174c2331d5ece7652fa85909

          SHA256

          331e9c12c7e410884563268bb4c421b37732298ecfc99ad321f22f1ac8e81089

          SHA512

          a27be9f4f2aa0a3b734d12e92d0be27b5f611063b07b424b1f8ef5dc1fa97dffef989ed6b85a4bdc26bfe219505520a703aac2d0af2660c43a01d932f5c1ab8a

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
          Filesize

          602B

          MD5

          a8ce36b26dc26dee2ce636806f6ef6da

          SHA1

          cdb5144c3a8d9af9722cbd73cdd35146e839cc1e

          SHA256

          1da7bff55479e5ebe75ce742f05a8a24969056c3bdf9b5dac071581cfb67d469

          SHA512

          1bf64beeca1cded7ad9389e40592a2ab6f292ab42748d214e97b8d26abceab1cf281e410ed2646b1855f6cbcb17867dc96e82873c60aa083632903320c9bdd77

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
          Filesize

          40B

          MD5

          070c8470c1d65f3b6392a340f36230e9

          SHA1

          5ba89b33284b0007365bad03329aa80fad05bb83

          SHA256

          68eaf64f3951b153a5ab999f9325fe8492bdee86d1989adbc657bdd32ec70ab0

          SHA512

          976876c9f2edea6a1f17bd64f1605a54647e03fb77cff56404f02f67be594126b429872a2f4f6390e84c2a7246e7dfa38fa54707bccc7f5627b44cc727dc394c

          Download Submit

        • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
          Filesize

          2.7MB

          MD5

          f0229746fcbce9698014f2d4b3c9c0f2

          SHA1

          f5c77b17678af5e5174c2331d5ece7652fa85909

          SHA256

          331e9c12c7e410884563268bb4c421b37732298ecfc99ad321f22f1ac8e81089

          SHA512

          a27be9f4f2aa0a3b734d12e92d0be27b5f611063b07b424b1f8ef5dc1fa97dffef989ed6b85a4bdc26bfe219505520a703aac2d0af2660c43a01d932f5c1ab8a

          Download Submit

        • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301311850491\assistant\_sfx.exe
          Filesize

          1.7MB

          MD5

          0238df215bf6943892daf85de8ad433a

          SHA1

          3d905e4e2c0e9170df61b7a199321847691f945e

          SHA256

          a7818aca6acbe347df13d51d9750f6a852c5aa2a58580f7f2015113e0a3e06d7

          SHA512

          fc6c12e359b9a4ce84ef878f29648a4c97c38fd12ed80996c5e03829833220010fff9c751a99f399dad3529bda6438424194ed18236addfbe430343807aaad69

          Download Submit

        • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301311850491\assistant\assistant_installer.exe
          Filesize

          2.1MB

          MD5

          9df6e2fbb7e38964f35016bf91ef7424

          SHA1

          d0c1266dc46814bc6165cf6a69e90581228989a7

          SHA256

          3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

          SHA512

          b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

          Download Submit

        • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301311850491\assistant\assistant_installer.exe
          Filesize

          2.1MB

          MD5

          9df6e2fbb7e38964f35016bf91ef7424

          SHA1

          d0c1266dc46814bc6165cf6a69e90581228989a7

          SHA256

          3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

          SHA512

          b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

          Download Submit

        • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301311850491\opera_package
          Filesize

          86.7MB

          MD5

          038275aad393989e8c0b6634da083fc7

          SHA1

          65b4ebd22a289935b71d41077a06eeda11eed154

          SHA256

          ac96d0fca59c713690e2dd0d899c90d0c27ad4784f8425656ae14aefdaca3d05

          SHA512

          2dd5bdfa1e500232ac0ac06030db3b73b3a5af2a8d9fa1601913deeb853ec99249387bc96f5efa25919fa3ef2bf1c512e21dd07b2baecccacfa90548cd21a4d8

          Download Submit

        • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301311850491\opera_package
          Filesize

          86.7MB

          MD5

          038275aad393989e8c0b6634da083fc7

          SHA1

          65b4ebd22a289935b71d41077a06eeda11eed154

          SHA256

          ac96d0fca59c713690e2dd0d899c90d0c27ad4784f8425656ae14aefdaca3d05

          SHA512

          2dd5bdfa1e500232ac0ac06030db3b73b3a5af2a8d9fa1601913deeb853ec99249387bc96f5efa25919fa3ef2bf1c512e21dd07b2baecccacfa90548cd21a4d8

          Download Submit

        • \Users\Admin\AppData\Local\Temp\Opera_installer_230131185044695548.dll
          Filesize

          4.3MB

          MD5

          832ae69091fba73338df9103db4f8be1

          SHA1

          d386710f4a8b5cfcf0ef2e0acc73f4dd883094b7

          SHA256

          191b3d16fa277b5dcbaa342ccafaea28c3ad25ddc1f9fa6ab2f3e23d46931e47

          SHA512

          b14835a3ac8e0a1089ded8620b2664ef2f1c86392f979ea4ac4e53eca97e1fbf3327ad40e8ea496bd9d4be36490cd781a12987e500d09d8d023847b90c76c387

          Download Submit

        • \Users\Admin\AppData\Local\Temp\Opera_installer_2301311850485951616.dll
          Filesize

          4.3MB

          MD5

          832ae69091fba73338df9103db4f8be1

          SHA1

          d386710f4a8b5cfcf0ef2e0acc73f4dd883094b7

          SHA256

          191b3d16fa277b5dcbaa342ccafaea28c3ad25ddc1f9fa6ab2f3e23d46931e47

          SHA512

          b14835a3ac8e0a1089ded8620b2664ef2f1c86392f979ea4ac4e53eca97e1fbf3327ad40e8ea496bd9d4be36490cd781a12987e500d09d8d023847b90c76c387

          Download Submit

        • \Users\Admin\AppData\Local\Temp\Opera_installer_230131185049109828.dll
          Filesize

          4.3MB

          MD5

          832ae69091fba73338df9103db4f8be1

          SHA1

          d386710f4a8b5cfcf0ef2e0acc73f4dd883094b7

          SHA256

          191b3d16fa277b5dcbaa342ccafaea28c3ad25ddc1f9fa6ab2f3e23d46931e47

          SHA512

          b14835a3ac8e0a1089ded8620b2664ef2f1c86392f979ea4ac4e53eca97e1fbf3327ad40e8ea496bd9d4be36490cd781a12987e500d09d8d023847b90c76c387

          Download Submit

        • \Users\Admin\AppData\Local\Temp\Opera_installer_230131185051215480.dll
          Filesize

          4.3MB

          MD5

          832ae69091fba73338df9103db4f8be1

          SHA1

          d386710f4a8b5cfcf0ef2e0acc73f4dd883094b7

          SHA256

          191b3d16fa277b5dcbaa342ccafaea28c3ad25ddc1f9fa6ab2f3e23d46931e47

          SHA512

          b14835a3ac8e0a1089ded8620b2664ef2f1c86392f979ea4ac4e53eca97e1fbf3327ad40e8ea496bd9d4be36490cd781a12987e500d09d8d023847b90c76c387

          Download Submit

        • \Users\Admin\AppData\Local\Temp\Opera_installer_2301311850516991332.dll
          Filesize

          4.3MB

          MD5

          832ae69091fba73338df9103db4f8be1

          SHA1

          d386710f4a8b5cfcf0ef2e0acc73f4dd883094b7

          SHA256

          191b3d16fa277b5dcbaa342ccafaea28c3ad25ddc1f9fa6ab2f3e23d46931e47

          SHA512

          b14835a3ac8e0a1089ded8620b2664ef2f1c86392f979ea4ac4e53eca97e1fbf3327ad40e8ea496bd9d4be36490cd781a12987e500d09d8d023847b90c76c387

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
          Filesize

          1.8MB

          MD5

          aa4de04ccc16b74a4c2301da8d621ec1

          SHA1

          d05c6d8200f6e6b1283df82d24d687adc47d9664

          SHA256

          e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

          SHA512

          28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
          Filesize

          1.8MB

          MD5

          aa4de04ccc16b74a4c2301da8d621ec1

          SHA1

          d05c6d8200f6e6b1283df82d24d687adc47d9664

          SHA256

          e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

          SHA512

          28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
          Filesize

          1.8MB

          MD5

          aa4de04ccc16b74a4c2301da8d621ec1

          SHA1

          d05c6d8200f6e6b1283df82d24d687adc47d9664

          SHA256

          e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

          SHA512

          28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
          Filesize

          1.8MB

          MD5

          aa4de04ccc16b74a4c2301da8d621ec1

          SHA1

          d05c6d8200f6e6b1283df82d24d687adc47d9664

          SHA256

          e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

          SHA512

          28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
          Filesize

          1.8MB

          MD5

          aa4de04ccc16b74a4c2301da8d621ec1

          SHA1

          d05c6d8200f6e6b1283df82d24d687adc47d9664

          SHA256

          e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

          SHA512

          28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
          Filesize

          1.8MB

          MD5

          aa4de04ccc16b74a4c2301da8d621ec1

          SHA1

          d05c6d8200f6e6b1283df82d24d687adc47d9664

          SHA256

          e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

          SHA512

          28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
          Filesize

          1.7MB

          MD5

          1bbf5dd0b6ca80e4c7c77495c3f33083

          SHA1

          e0520037e60eb641ec04d1e814394c9da0a6a862

          SHA256

          bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

          SHA512

          97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
          Filesize

          97KB

          MD5

          da1d0cd400e0b6ad6415fd4d90f69666

          SHA1

          de9083d2902906cacf57259cf581b1466400b799

          SHA256

          7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

          SHA512

          f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
          Filesize

          1.3MB

          MD5

          7e08af319c9eb3297e09ca7bb8387de4

          SHA1

          4cf091f77a3eb9437ef33985e64bd10c1257284f

          SHA256

          6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

          SHA512

          bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
          Filesize

          1.3MB

          MD5

          7e08af319c9eb3297e09ca7bb8387de4

          SHA1

          4cf091f77a3eb9437ef33985e64bd10c1257284f

          SHA256

          6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

          SHA512

          bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
          Filesize

          1.3MB

          MD5

          7e08af319c9eb3297e09ca7bb8387de4

          SHA1

          4cf091f77a3eb9437ef33985e64bd10c1257284f

          SHA256

          6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

          SHA512

          bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
          Filesize

          1.3MB

          MD5

          7e08af319c9eb3297e09ca7bb8387de4

          SHA1

          4cf091f77a3eb9437ef33985e64bd10c1257284f

          SHA256

          6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

          SHA512

          bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
          Filesize

          1.3MB

          MD5

          7e08af319c9eb3297e09ca7bb8387de4

          SHA1

          4cf091f77a3eb9437ef33985e64bd10c1257284f

          SHA256

          6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

          SHA512

          bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
          Filesize

          326KB

          MD5

          80d93d38badecdd2b134fe4699721223

          SHA1

          e829e58091bae93bc64e0c6f9f0bac999cfda23d

          SHA256

          c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

          SHA512

          9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          Filesize

          1.3MB

          MD5

          e801c5847f5f9d207db53aaaf5c6f3a2

          SHA1

          8e6818ce66555e2cca92e5c5f32551fb4a91645e

          SHA256

          196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

          SHA512

          303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          Filesize

          1.3MB

          MD5

          e801c5847f5f9d207db53aaaf5c6f3a2

          SHA1

          8e6818ce66555e2cca92e5c5f32551fb4a91645e

          SHA256

          196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

          SHA512

          303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          Filesize

          1.3MB

          MD5

          e801c5847f5f9d207db53aaaf5c6f3a2

          SHA1

          8e6818ce66555e2cca92e5c5f32551fb4a91645e

          SHA256

          196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

          SHA512

          303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          Filesize

          1.3MB

          MD5

          e801c5847f5f9d207db53aaaf5c6f3a2

          SHA1

          8e6818ce66555e2cca92e5c5f32551fb4a91645e

          SHA256

          196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

          SHA512

          303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          Filesize

          1.3MB

          MD5

          e801c5847f5f9d207db53aaaf5c6f3a2

          SHA1

          8e6818ce66555e2cca92e5c5f32551fb4a91645e

          SHA256

          196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

          SHA512

          303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
          Filesize

          326KB

          MD5

          80d93d38badecdd2b134fe4699721223

          SHA1

          e829e58091bae93bc64e0c6f9f0bac999cfda23d

          SHA256

          c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

          SHA512

          9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

          Download Submit

        • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
          Filesize

          2.7MB

          MD5

          f0229746fcbce9698014f2d4b3c9c0f2

          SHA1

          f5c77b17678af5e5174c2331d5ece7652fa85909

          SHA256

          331e9c12c7e410884563268bb4c421b37732298ecfc99ad321f22f1ac8e81089

          SHA512

          a27be9f4f2aa0a3b734d12e92d0be27b5f611063b07b424b1f8ef5dc1fa97dffef989ed6b85a4bdc26bfe219505520a703aac2d0af2660c43a01d932f5c1ab8a

          Download Submit

        • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
          Filesize

          2.7MB

          MD5

          f0229746fcbce9698014f2d4b3c9c0f2

          SHA1

          f5c77b17678af5e5174c2331d5ece7652fa85909

          SHA256

          331e9c12c7e410884563268bb4c421b37732298ecfc99ad321f22f1ac8e81089

          SHA512

          a27be9f4f2aa0a3b734d12e92d0be27b5f611063b07b424b1f8ef5dc1fa97dffef989ed6b85a4bdc26bfe219505520a703aac2d0af2660c43a01d932f5c1ab8a

          Download Submit

        • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
          Filesize

          2.7MB

          MD5

          f0229746fcbce9698014f2d4b3c9c0f2

          SHA1

          f5c77b17678af5e5174c2331d5ece7652fa85909

          SHA256

          331e9c12c7e410884563268bb4c421b37732298ecfc99ad321f22f1ac8e81089

          SHA512

          a27be9f4f2aa0a3b734d12e92d0be27b5f611063b07b424b1f8ef5dc1fa97dffef989ed6b85a4bdc26bfe219505520a703aac2d0af2660c43a01d932f5c1ab8a

          Download Submit

        • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
          Filesize

          2.7MB

          MD5

          f0229746fcbce9698014f2d4b3c9c0f2

          SHA1

          f5c77b17678af5e5174c2331d5ece7652fa85909

          SHA256

          331e9c12c7e410884563268bb4c421b37732298ecfc99ad321f22f1ac8e81089

          SHA512

          a27be9f4f2aa0a3b734d12e92d0be27b5f611063b07b424b1f8ef5dc1fa97dffef989ed6b85a4bdc26bfe219505520a703aac2d0af2660c43a01d932f5c1ab8a

          Download Submit

        • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
          Filesize

          2.7MB

          MD5

          f0229746fcbce9698014f2d4b3c9c0f2

          SHA1

          f5c77b17678af5e5174c2331d5ece7652fa85909

          SHA256

          331e9c12c7e410884563268bb4c421b37732298ecfc99ad321f22f1ac8e81089

          SHA512

          a27be9f4f2aa0a3b734d12e92d0be27b5f611063b07b424b1f8ef5dc1fa97dffef989ed6b85a4bdc26bfe219505520a703aac2d0af2660c43a01d932f5c1ab8a

          Download Submit

        • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
          Filesize

          2.7MB

          MD5

          f0229746fcbce9698014f2d4b3c9c0f2

          SHA1

          f5c77b17678af5e5174c2331d5ece7652fa85909

          SHA256

          331e9c12c7e410884563268bb4c421b37732298ecfc99ad321f22f1ac8e81089

          SHA512

          a27be9f4f2aa0a3b734d12e92d0be27b5f611063b07b424b1f8ef5dc1fa97dffef989ed6b85a4bdc26bfe219505520a703aac2d0af2660c43a01d932f5c1ab8a

          Download Submit

        • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
          Filesize

          2.7MB

          MD5

          f0229746fcbce9698014f2d4b3c9c0f2

          SHA1

          f5c77b17678af5e5174c2331d5ece7652fa85909

          SHA256

          331e9c12c7e410884563268bb4c421b37732298ecfc99ad321f22f1ac8e81089

          SHA512

          a27be9f4f2aa0a3b734d12e92d0be27b5f611063b07b424b1f8ef5dc1fa97dffef989ed6b85a4bdc26bfe219505520a703aac2d0af2660c43a01d932f5c1ab8a

          Download Submit

        • memory/432-117-0x0000000000F10000-0x00000000012F8000-memory.dmp

          Filesize

          3.9MB

          Download

        • memory/432-106-0x0000000000EA0000-0x0000000000EB0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/432-108-0x0000000005560000-0x0000000005A68000-memory.dmp

          Filesize

          5.0MB

          Download

        • memory/432-98-0x0000000000F10000-0x00000000012F8000-memory.dmp

          Filesize

          3.9MB

          Download

        • memory/432-109-0x0000000005560000-0x0000000005A68000-memory.dmp

          Filesize

          5.0MB

          Download

        • memory/432-111-0x0000000005560000-0x0000000005A68000-memory.dmp

          Filesize

          5.0MB

          Download

        • memory/432-110-0x0000000005560000-0x0000000005A68000-memory.dmp

          Filesize

          5.0MB

          Download

        • memory/480-150-0x0000000002830000-0x0000000002D38000-memory.dmp

          Filesize

          5.0MB

          Download

        • memory/480-144-0x0000000000400000-0x0000000000908000-memory.dmp

          Filesize

          5.0MB

          Download

        • memory/480-145-0x0000000002830000-0x0000000002D38000-memory.dmp

          Filesize

          5.0MB

          Download

        • memory/480-213-0x0000000000400000-0x0000000000908000-memory.dmp

          Filesize

          5.0MB

          Download

        • memory/548-149-0x00000000034E0000-0x00000000039E8000-memory.dmp

          Filesize

          5.0MB

          Download

        • memory/548-148-0x00000000037E0000-0x0000000003CE8000-memory.dmp

          Filesize

          5.0MB

          Download

        • memory/548-118-0x0000000002920000-0x0000000002E28000-memory.dmp

          Filesize

          5.0MB

          Download

        • memory/548-112-0x0000000000400000-0x0000000000908000-memory.dmp

          Filesize

          5.0MB

          Download

        • memory/548-216-0x0000000000400000-0x0000000000908000-memory.dmp

          Filesize

          5.0MB

          Download

        • memory/548-130-0x00000000037E0000-0x0000000003CE8000-memory.dmp

          Filesize

          5.0MB

          Download

        • memory/680-70-0x0000000010000000-0x0000000010051000-memory.dmp

          Filesize

          324KB

          Download

        • memory/680-72-0x0000000000910000-0x0000000000CF8000-memory.dmp

          Filesize

          3.9MB

          Download

        • memory/680-147-0x0000000003420000-0x0000000003430000-memory.dmp

          Filesize

          64KB

          Download

        • memory/680-333-0x0000000010000000-0x0000000010051000-memory.dmp

          Filesize

          324KB

          Download

        • memory/680-82-0x0000000003420000-0x0000000003430000-memory.dmp

          Filesize

          64KB

          Download

        • memory/680-71-0x0000000000490000-0x0000000000493000-memory.dmp

          Filesize

          12KB

          Download

        • memory/680-64-0x0000000000910000-0x0000000000CF8000-memory.dmp

          Filesize

          3.9MB

          Download

        • memory/828-127-0x0000000000400000-0x0000000000908000-memory.dmp

          Filesize

          5.0MB

          Download

        • memory/1312-97-0x0000000002D70000-0x0000000003158000-memory.dmp

          Filesize

          3.9MB

          Download

        • memory/1312-96-0x0000000002D70000-0x0000000003158000-memory.dmp

          Filesize

          3.9MB

          Download

        • memory/1332-214-0x0000000000400000-0x0000000000908000-memory.dmp

          Filesize

          5.0MB

          Download

        • memory/1332-146-0x0000000000400000-0x0000000000908000-memory.dmp

          Filesize

          5.0MB

          Download

        • memory/1616-133-0x0000000000400000-0x0000000000908000-memory.dmp

          Filesize

          5.0MB

          Download

        • memory/1616-219-0x0000000000400000-0x0000000000908000-memory.dmp

          Filesize

          5.0MB

          Download

        • memory/1700-62-0x0000000002E00000-0x00000000031E8000-memory.dmp

          Filesize

          3.9MB

          Download

        • memory/1700-63-0x0000000002E00000-0x00000000031E8000-memory.dmp

          Filesize

          3.9MB

          Download

        • memory/1700-54-0x00000000767D1000-0x00000000767D3000-memory.dmp

          Filesize

          8KB

          Download

        • memory/1808-171-0x000007FEFC421000-0x000007FEFC423000-memory.dmp

          Filesize

          8KB

          Download

        • memory/2144-215-0x00000000027F0000-0x0000000002800000-memory.dmp

          Filesize

          64KB

          Download