Overview

overview

8

Static

static

TLauncher-...al.exe

windows7-x64

8

TLauncher-...al.exe

windows10-2004-x64

8

Resubmissions

01-02-2023 00:47

230201-a5n2xsbb55 8

01-02-2023 00:43

230201-a29jfsda7t 8

Analysis

  • max time kernel
    86s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    01-02-2023 00:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    TLauncher-2.871-Installer-1.0.6-global.exe

  • Size

    23.6MB

  • MD5

    7a4472a78d0651e11d20aa08e43cc045

  • SHA1

    aab1d5f80d7399ae2c1982201733be7681d100b1

  • SHA256

    318df7404e6c4d5538a6d31997b95af52bbb8d40caf5553b3cbd9b1bc4f6db96

  • SHA512

    c152c9d21b0615548173dcc61accb1a1afd5b6f98e6ec21f6a7119536397f07a54ad4087669716c3344dd338ce4f24cecf9989d472f65eaa18c87d496f23c681

  • SSDEEP

    393216:gXQLpnUN/n8IPfs/dQETVlOBbpFEj9GZ1GphRqV56Hpk7IXOzDnKI17fyVS:ggLFUp8aHExiTI3qqHp6zvKcfyVS

Score
8/10
discoveryspywarestealerupx

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 18 IoCs
  • UPX packed file 41 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 63 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    evasionspywaretrojan
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1844
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe" "__IRCT:3" "__IRTSS:24771453" "__IRSID:S-1-5-21-2292972927-2705560509-2768824231-1000"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:916
      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
        "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:580
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816850 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" "__IRCT:3" "__IRTSS:1840872" "__IRSID:S-1-5-21-2292972927-2705560509-2768824231-1000"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies system certificate store
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1416
          • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
            "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Enumerates connected drives
            • Modifies system certificate store
            • Suspicious use of WriteProcessMemory
            PID:964
            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.76 --initial-client-data=0x1a4,0x1a8,0x1ac,0x178,0x1b0,0x714a8658,0x714a8668,0x714a8674
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1968
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe" --version
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1536
            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --pin-additional-shortcuts=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=964 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20230201014428" --session-guid=d8c16aaa-3f2c-419a-afc4-b8d5b384b388 --server-tracking-blob=ZjlkZTYwOTYwNmQwMWRlMjJlYjA2YjgyMDY4Y2JkMjNkMTBkYjA5NzgzNWVhYTExYzhmMzE5ZTg5YWZmNDJlZjp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInRpbWVzdGFtcCI6IjE2NzUyMTIyNjMuOTk2NiIsInVzZXJhZ2VudCI6IlNldHVwIEZhY3RvcnkgOS4wIiwidXRtIjp7ImNhbXBhaWduIjoiT3BlcmFEZXNrdG9wIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiTVNUTCJ9LCJ1dWlkIjoiYTVhZjhiY2EtYmYwZS00ZjA2LWIxMzMtZDUwYjExNWZlMjM4In0= --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=1403000000000000
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Enumerates connected drives
              • Suspicious use of WriteProcessMemory
              PID:1908
              • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.76 --initial-client-data=0x1b0,0x1b4,0x1b8,0x178,0x1bc,0x70a88658,0x70a88668,0x70a88674
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:1448
              • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\installer.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\installer.exe" --backend --initial-pid=964 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --pin-additional-shortcuts=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010144281" --session-guid=d8c16aaa-3f2c-419a-afc4-b8d5b384b388 --server-tracking-blob=ZjlkZTYwOTYwNmQwMWRlMjJlYjA2YjgyMDY4Y2JkMjNkMTBkYjA5NzgzNWVhYTExYzhmMzE5ZTg5YWZmNDJlZjp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInRpbWVzdGFtcCI6IjE2NzUyMTIyNjMuOTk2NiIsInVzZXJhZ2VudCI6IlNldHVwIEZhY3RvcnkgOS4wIiwidXRtIjp7ImNhbXBhaWduIjoiT3BlcmFEZXNrdG9wIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiTVNUTCJ9LCJ1dWlkIjoiYTVhZjhiY2EtYmYwZS00ZjA2LWIxMzMtZDUwYjExNWZlMjM4In0= --silent --desktopshortcut=1 --install-subfolder=94.0.4606.76
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates connected drives
                • Modifies registry class
                PID:1392
                • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\installer.exe
                  C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\installer.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.76 --initial-client-data=0x174,0x178,0x17c,0x148,0x180,0x7fef6702c98,0x7fef6702ca8,0x7fef6702cb8
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:1032
                • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe" --start-maximized
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:848
                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --start-maximized --ran-launcher
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Enumerates system info in registry
                    PID:1464
                    • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\opera_crashreporter.exe
                      C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\opera_crashreporter.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.76 --initial-client-data=0x15c,0x160,0x164,0x130,0x168,0x7feef60c490,0x7feef60c4a0,0x7feef60c4b0
                      10⤵
                      • Executes dropped EXE
                      PID:2100
                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1076 --field-trial-handle=1252,i,17255632522827407857,4961816244031349717,131072 /prefetch:2
                      10⤵
                        PID:2324
              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010144281\assistant\_sfx.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010144281\assistant\_sfx.exe"
                6⤵
                • Executes dropped EXE
                PID:1676
              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010144281\assistant\assistant_installer.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010144281\assistant\assistant_installer.exe" --version
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:1044
                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010144281\assistant\assistant_installer.exe
                  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010144281\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x148,0x14c,0x150,0x11c,0x154,0xb42dc0,0xb42dd0,0xb42ddc
                  7⤵
                  • Executes dropped EXE
                  PID:1720
        • C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
          "C:\Users\Admin\AppData\Local\Temp\jre-windows.exe" STATIC=1
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:268
          • C:\Users\Admin\AppData\Local\Temp\jds7156857.tmp\jre-windows.exe
            "C:\Users\Admin\AppData\Local\Temp\jds7156857.tmp\jre-windows.exe" "STATIC=1"
            4⤵
            • Executes dropped EXE
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:1612
    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --start-maximized --ran-launcher --flag-switches-begin --flag-switches-end --enable-quic --lowered-browser
      1⤵
        PID:2404
        • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\opera_crashreporter.exe
          C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\opera_crashreporter.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.76 --initial-client-data=0x15c,0x160,0x164,0x130,0x168,0x7feef60c490,0x7feef60c4a0,0x7feef60c4b0
          2⤵
            PID:2432
          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1092 --field-trial-handle=1204,i,3939142111084254805,12633887862589323096,131072 /prefetch:2
            2⤵
              PID:2580
            • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\opera_autoupdate.exe
              "C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\opera_autoupdate.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" --pipeid=oauc_pipe2906202b27b41e4bd66c9238c4b575c1
              2⤵
                PID:2796
                • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\opera_autoupdate.exe
                  C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.76 --initial-client-data=0x138,0x13c,0x140,0x10c,0x144,0x13fbbab38,0x13fbbab48,0x13fbbab58
                  3⤵
                    PID:2816
              • C:\Windows\system32\taskeng.exe
                taskeng.exe {B6B58CDC-DFD3-448E-B04F-B85CB2FCE9BE} S-1-5-21-2292972927-2705560509-2768824231-1000:GRXNNIIE\Admin:Interactive:[1]
                1⤵
                  PID:2916
                  • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
                    C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe --scheduledautoupdate --autoupdaterequesttype=automatic --autoupdateoperaversion=94.0.4606.76 --newautoupdaterlogic
                    2⤵
                      PID:2980
                      • C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe
                        "C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe" --version
                        3⤵
                          PID:2080

                    Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                      Filesize

                      61KB

                      MD5

                      fc4666cbca561e864e7fdf883a9e6661

                      SHA1

                      2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

                      SHA256

                      10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

                      SHA512

                      c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

                      Download Submit

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
                      Filesize

                      471B

                      MD5

                      9cbb254ca8da5a4099c66d7dce2d69de

                      SHA1

                      3f328e1410c5c4ea2fa2b387dbef7c6479ea258c

                      SHA256

                      f6cad04bfeb909acd5c89c6137fd33b267fa2e021553b3515c82e9d7cfb3fc58

                      SHA512

                      93fe3387c563d18ea2f9cb96f1d868d1d5a26c0490126242279a6f39a2df53311fc9806ee14b4b0301195a17dd75abc318695aa0a328330820e8fc20b6fed4a4

                      Download Submit

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                      Filesize

                      340B

                      MD5

                      48d119a09decae2c1798b08ef0774040

                      SHA1

                      605de81d6ca7ef2c7430086df0e75f0f7f13c959

                      SHA256

                      a46f2d0a6154f99589d1021d975b410323612cfb0d92741d1bda28b50c9d39e0

                      SHA512

                      1be9023999379e77b8bce57c79ff1e98c4eca21bc2b4d1be9221253b220b308dac47b5f071a112d53e5485fe38a912ca2297593fc3110c4dee9b55622f5a3182

                      Download Submit

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                      Filesize

                      342B

                      MD5

                      5b0d89a2a8ecd2e242d42c1a5f001555

                      SHA1

                      6e838fe2106d0791d08f26a127af607ad1c3cb1e

                      SHA256

                      b38d0ddac7ae096b8595f5b0f176ea604533f871040f2876dcd101ede16a4686

                      SHA512

                      b10a1c53638b03ca433532709d8cb5776a8b43e8de91dcffde3c4515c978461ee6b0e64a731d00013d563f57b3a01424ff82cf289f96f6b48ea780628618470b

                      Download Submit

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
                      Filesize

                      434B

                      MD5

                      12556eb0bc58d1967161fba9402eb397

                      SHA1

                      cbc5b4e0a9374abd7ee93fca0f6d007308fdd25b

                      SHA256

                      ed173b878828166c2271a84abb12d5fa4e250a0485f010943463f459d5d0b9f5

                      SHA512

                      dc24cbd41bee2faa0edac49e9f1254af8d52440cb7adb3534c10b5c53102e7694c3f64bb58f55afd6a18da026a866e75d0e312004cc56333ada6137611a6fb23

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
                      Filesize

                      2.7MB

                      MD5

                      b58b3f896d028778df3528a3ff6e8967

                      SHA1

                      506be618807c061e1de17eff2c0896bce84c2383

                      SHA256

                      d5b7e4c851ee2dd80ab3058cee38f2e87e868b8a7f3ab35e54a112a6546de2bd

                      SHA512

                      4cf5ab25244c9549a66a366f48108c94b51552b5f14d752978dc726c4d314ae0f18ca90c29d00a44b07f8f84ba99dd494f75b803722df964cf4026833c09a10f

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010144281\assistant\_sfx.exe
                      Filesize

                      1.7MB

                      MD5

                      0238df215bf6943892daf85de8ad433a

                      SHA1

                      3d905e4e2c0e9170df61b7a199321847691f945e

                      SHA256

                      a7818aca6acbe347df13d51d9750f6a852c5aa2a58580f7f2015113e0a3e06d7

                      SHA512

                      fc6c12e359b9a4ce84ef878f29648a4c97c38fd12ed80996c5e03829833220010fff9c751a99f399dad3529bda6438424194ed18236addfbe430343807aaad69

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010144281\assistant\_sfx.exe
                      Filesize

                      1.7MB

                      MD5

                      0238df215bf6943892daf85de8ad433a

                      SHA1

                      3d905e4e2c0e9170df61b7a199321847691f945e

                      SHA256

                      a7818aca6acbe347df13d51d9750f6a852c5aa2a58580f7f2015113e0a3e06d7

                      SHA512

                      fc6c12e359b9a4ce84ef878f29648a4c97c38fd12ed80996c5e03829833220010fff9c751a99f399dad3529bda6438424194ed18236addfbe430343807aaad69

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010144281\assistant\assistant_installer.exe
                      Filesize

                      2.1MB

                      MD5

                      9df6e2fbb7e38964f35016bf91ef7424

                      SHA1

                      d0c1266dc46814bc6165cf6a69e90581228989a7

                      SHA256

                      3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

                      SHA512

                      b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010144281\assistant\assistant_installer.exe
                      Filesize

                      2.1MB

                      MD5

                      9df6e2fbb7e38964f35016bf91ef7424

                      SHA1

                      d0c1266dc46814bc6165cf6a69e90581228989a7

                      SHA256

                      3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

                      SHA512

                      b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010144281\assistant\assistant_installer.exe
                      Filesize

                      2.1MB

                      MD5

                      9df6e2fbb7e38964f35016bf91ef7424

                      SHA1

                      d0c1266dc46814bc6165cf6a69e90581228989a7

                      SHA256

                      3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

                      SHA512

                      b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                      Filesize

                      1.8MB

                      MD5

                      aa4de04ccc16b74a4c2301da8d621ec1

                      SHA1

                      d05c6d8200f6e6b1283df82d24d687adc47d9664

                      SHA256

                      e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

                      SHA512

                      28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                      Filesize

                      1.8MB

                      MD5

                      aa4de04ccc16b74a4c2301da8d621ec1

                      SHA1

                      d05c6d8200f6e6b1283df82d24d687adc47d9664

                      SHA256

                      e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

                      SHA512

                      28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                      Filesize

                      1.3MB

                      MD5

                      7e08af319c9eb3297e09ca7bb8387de4

                      SHA1

                      4cf091f77a3eb9437ef33985e64bd10c1257284f

                      SHA256

                      6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

                      SHA512

                      bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                      Filesize

                      1.3MB

                      MD5

                      7e08af319c9eb3297e09ca7bb8387de4

                      SHA1

                      4cf091f77a3eb9437ef33985e64bd10c1257284f

                      SHA256

                      6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

                      SHA512

                      bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
                      Filesize

                      326KB

                      MD5

                      80d93d38badecdd2b134fe4699721223

                      SHA1

                      e829e58091bae93bc64e0c6f9f0bac999cfda23d

                      SHA256

                      c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                      SHA512

                      9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                      Filesize

                      1.3MB

                      MD5

                      e801c5847f5f9d207db53aaaf5c6f3a2

                      SHA1

                      8e6818ce66555e2cca92e5c5f32551fb4a91645e

                      SHA256

                      196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

                      SHA512

                      303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                      Filesize

                      1.3MB

                      MD5

                      e801c5847f5f9d207db53aaaf5c6f3a2

                      SHA1

                      8e6818ce66555e2cca92e5c5f32551fb4a91645e

                      SHA256

                      196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

                      SHA512

                      303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
                      Filesize

                      326KB

                      MD5

                      80d93d38badecdd2b134fe4699721223

                      SHA1

                      e829e58091bae93bc64e0c6f9f0bac999cfda23d

                      SHA256

                      c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                      SHA512

                      9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                      Filesize

                      2.7MB

                      MD5

                      b58b3f896d028778df3528a3ff6e8967

                      SHA1

                      506be618807c061e1de17eff2c0896bce84c2383

                      SHA256

                      d5b7e4c851ee2dd80ab3058cee38f2e87e868b8a7f3ab35e54a112a6546de2bd

                      SHA512

                      4cf5ab25244c9549a66a366f48108c94b51552b5f14d752978dc726c4d314ae0f18ca90c29d00a44b07f8f84ba99dd494f75b803722df964cf4026833c09a10f

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                      Filesize

                      2.7MB

                      MD5

                      b58b3f896d028778df3528a3ff6e8967

                      SHA1

                      506be618807c061e1de17eff2c0896bce84c2383

                      SHA256

                      d5b7e4c851ee2dd80ab3058cee38f2e87e868b8a7f3ab35e54a112a6546de2bd

                      SHA512

                      4cf5ab25244c9549a66a366f48108c94b51552b5f14d752978dc726c4d314ae0f18ca90c29d00a44b07f8f84ba99dd494f75b803722df964cf4026833c09a10f

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                      Filesize

                      2.7MB

                      MD5

                      b58b3f896d028778df3528a3ff6e8967

                      SHA1

                      506be618807c061e1de17eff2c0896bce84c2383

                      SHA256

                      d5b7e4c851ee2dd80ab3058cee38f2e87e868b8a7f3ab35e54a112a6546de2bd

                      SHA512

                      4cf5ab25244c9549a66a366f48108c94b51552b5f14d752978dc726c4d314ae0f18ca90c29d00a44b07f8f84ba99dd494f75b803722df964cf4026833c09a10f

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                      Filesize

                      2.7MB

                      MD5

                      b58b3f896d028778df3528a3ff6e8967

                      SHA1

                      506be618807c061e1de17eff2c0896bce84c2383

                      SHA256

                      d5b7e4c851ee2dd80ab3058cee38f2e87e868b8a7f3ab35e54a112a6546de2bd

                      SHA512

                      4cf5ab25244c9549a66a366f48108c94b51552b5f14d752978dc726c4d314ae0f18ca90c29d00a44b07f8f84ba99dd494f75b803722df964cf4026833c09a10f

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                      Filesize

                      2.7MB

                      MD5

                      b58b3f896d028778df3528a3ff6e8967

                      SHA1

                      506be618807c061e1de17eff2c0896bce84c2383

                      SHA256

                      d5b7e4c851ee2dd80ab3058cee38f2e87e868b8a7f3ab35e54a112a6546de2bd

                      SHA512

                      4cf5ab25244c9549a66a366f48108c94b51552b5f14d752978dc726c4d314ae0f18ca90c29d00a44b07f8f84ba99dd494f75b803722df964cf4026833c09a10f

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
                      Filesize

                      602B

                      MD5

                      a8ce36b26dc26dee2ce636806f6ef6da

                      SHA1

                      cdb5144c3a8d9af9722cbd73cdd35146e839cc1e

                      SHA256

                      1da7bff55479e5ebe75ce742f05a8a24969056c3bdf9b5dac071581cfb67d469

                      SHA512

                      1bf64beeca1cded7ad9389e40592a2ab6f292ab42748d214e97b8d26abceab1cf281e410ed2646b1855f6cbcb17867dc96e82873c60aa083632903320c9bdd77

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
                      Filesize

                      40B

                      MD5

                      96ca8d9c659023c443384f284616b464

                      SHA1

                      581ac02d7800fd94f5110679022943a654c2c7f4

                      SHA256

                      5d6e07739ffcc99437057d36f463138c3915036bbd911d5247f13e7b972caaa6

                      SHA512

                      0d65cca6b2f87418b2616df45d652c582bb4f57ca6a989b417ee9b749b586fd1234a64b52b51b6a75c934339e8e99db31407cc5eaa59555e5d6bb0e123603f98

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
                      Filesize

                      2.7MB

                      MD5

                      b58b3f896d028778df3528a3ff6e8967

                      SHA1

                      506be618807c061e1de17eff2c0896bce84c2383

                      SHA256

                      d5b7e4c851ee2dd80ab3058cee38f2e87e868b8a7f3ab35e54a112a6546de2bd

                      SHA512

                      4cf5ab25244c9549a66a366f48108c94b51552b5f14d752978dc726c4d314ae0f18ca90c29d00a44b07f8f84ba99dd494f75b803722df964cf4026833c09a10f

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010144281\assistant\_sfx.exe
                      Filesize

                      1.7MB

                      MD5

                      0238df215bf6943892daf85de8ad433a

                      SHA1

                      3d905e4e2c0e9170df61b7a199321847691f945e

                      SHA256

                      a7818aca6acbe347df13d51d9750f6a852c5aa2a58580f7f2015113e0a3e06d7

                      SHA512

                      fc6c12e359b9a4ce84ef878f29648a4c97c38fd12ed80996c5e03829833220010fff9c751a99f399dad3529bda6438424194ed18236addfbe430343807aaad69

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010144281\assistant\assistant_installer.exe
                      Filesize

                      2.1MB

                      MD5

                      9df6e2fbb7e38964f35016bf91ef7424

                      SHA1

                      d0c1266dc46814bc6165cf6a69e90581228989a7

                      SHA256

                      3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

                      SHA512

                      b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010144281\assistant\assistant_installer.exe
                      Filesize

                      2.1MB

                      MD5

                      9df6e2fbb7e38964f35016bf91ef7424

                      SHA1

                      d0c1266dc46814bc6165cf6a69e90581228989a7

                      SHA256

                      3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

                      SHA512

                      b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010144281\opera_package
                      Filesize

                      86.7MB

                      MD5

                      038275aad393989e8c0b6634da083fc7

                      SHA1

                      65b4ebd22a289935b71d41077a06eeda11eed154

                      SHA256

                      ac96d0fca59c713690e2dd0d899c90d0c27ad4784f8425656ae14aefdaca3d05

                      SHA512

                      2dd5bdfa1e500232ac0ac06030db3b73b3a5af2a8d9fa1601913deeb853ec99249387bc96f5efa25919fa3ef2bf1c512e21dd07b2baecccacfa90548cd21a4d8

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010144281\opera_package
                      Filesize

                      86.7MB

                      MD5

                      038275aad393989e8c0b6634da083fc7

                      SHA1

                      65b4ebd22a289935b71d41077a06eeda11eed154

                      SHA256

                      ac96d0fca59c713690e2dd0d899c90d0c27ad4784f8425656ae14aefdaca3d05

                      SHA512

                      2dd5bdfa1e500232ac0ac06030db3b73b3a5af2a8d9fa1601913deeb853ec99249387bc96f5efa25919fa3ef2bf1c512e21dd07b2baecccacfa90548cd21a4d8

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\Opera_installer_230201014426435964.dll
                      Filesize

                      4.3MB

                      MD5

                      832ae69091fba73338df9103db4f8be1

                      SHA1

                      d386710f4a8b5cfcf0ef2e0acc73f4dd883094b7

                      SHA256

                      191b3d16fa277b5dcbaa342ccafaea28c3ad25ddc1f9fa6ab2f3e23d46931e47

                      SHA512

                      b14835a3ac8e0a1089ded8620b2664ef2f1c86392f979ea4ac4e53eca97e1fbf3327ad40e8ea496bd9d4be36490cd781a12987e500d09d8d023847b90c76c387

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\Opera_installer_2302010144274341968.dll
                      Filesize

                      4.3MB

                      MD5

                      832ae69091fba73338df9103db4f8be1

                      SHA1

                      d386710f4a8b5cfcf0ef2e0acc73f4dd883094b7

                      SHA256

                      191b3d16fa277b5dcbaa342ccafaea28c3ad25ddc1f9fa6ab2f3e23d46931e47

                      SHA512

                      b14835a3ac8e0a1089ded8620b2664ef2f1c86392f979ea4ac4e53eca97e1fbf3327ad40e8ea496bd9d4be36490cd781a12987e500d09d8d023847b90c76c387

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\Opera_installer_2302010144279331536.dll
                      Filesize

                      4.3MB

                      MD5

                      832ae69091fba73338df9103db4f8be1

                      SHA1

                      d386710f4a8b5cfcf0ef2e0acc73f4dd883094b7

                      SHA256

                      191b3d16fa277b5dcbaa342ccafaea28c3ad25ddc1f9fa6ab2f3e23d46931e47

                      SHA512

                      b14835a3ac8e0a1089ded8620b2664ef2f1c86392f979ea4ac4e53eca97e1fbf3327ad40e8ea496bd9d4be36490cd781a12987e500d09d8d023847b90c76c387

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\Opera_installer_2302010144309121908.dll
                      Filesize

                      4.3MB

                      MD5

                      832ae69091fba73338df9103db4f8be1

                      SHA1

                      d386710f4a8b5cfcf0ef2e0acc73f4dd883094b7

                      SHA256

                      191b3d16fa277b5dcbaa342ccafaea28c3ad25ddc1f9fa6ab2f3e23d46931e47

                      SHA512

                      b14835a3ac8e0a1089ded8620b2664ef2f1c86392f979ea4ac4e53eca97e1fbf3327ad40e8ea496bd9d4be36490cd781a12987e500d09d8d023847b90c76c387

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\Opera_installer_2302010144321451448.dll
                      Filesize

                      4.3MB

                      MD5

                      832ae69091fba73338df9103db4f8be1

                      SHA1

                      d386710f4a8b5cfcf0ef2e0acc73f4dd883094b7

                      SHA256

                      191b3d16fa277b5dcbaa342ccafaea28c3ad25ddc1f9fa6ab2f3e23d46931e47

                      SHA512

                      b14835a3ac8e0a1089ded8620b2664ef2f1c86392f979ea4ac4e53eca97e1fbf3327ad40e8ea496bd9d4be36490cd781a12987e500d09d8d023847b90c76c387

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                      Filesize

                      1.8MB

                      MD5

                      aa4de04ccc16b74a4c2301da8d621ec1

                      SHA1

                      d05c6d8200f6e6b1283df82d24d687adc47d9664

                      SHA256

                      e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

                      SHA512

                      28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                      Filesize

                      1.8MB

                      MD5

                      aa4de04ccc16b74a4c2301da8d621ec1

                      SHA1

                      d05c6d8200f6e6b1283df82d24d687adc47d9664

                      SHA256

                      e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

                      SHA512

                      28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                      Filesize

                      1.8MB

                      MD5

                      aa4de04ccc16b74a4c2301da8d621ec1

                      SHA1

                      d05c6d8200f6e6b1283df82d24d687adc47d9664

                      SHA256

                      e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

                      SHA512

                      28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                      Filesize

                      1.8MB

                      MD5

                      aa4de04ccc16b74a4c2301da8d621ec1

                      SHA1

                      d05c6d8200f6e6b1283df82d24d687adc47d9664

                      SHA256

                      e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

                      SHA512

                      28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                      Filesize

                      1.8MB

                      MD5

                      aa4de04ccc16b74a4c2301da8d621ec1

                      SHA1

                      d05c6d8200f6e6b1283df82d24d687adc47d9664

                      SHA256

                      e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

                      SHA512

                      28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                      Filesize

                      1.8MB

                      MD5

                      aa4de04ccc16b74a4c2301da8d621ec1

                      SHA1

                      d05c6d8200f6e6b1283df82d24d687adc47d9664

                      SHA256

                      e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

                      SHA512

                      28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
                      Filesize

                      1.7MB

                      MD5

                      1bbf5dd0b6ca80e4c7c77495c3f33083

                      SHA1

                      e0520037e60eb641ec04d1e814394c9da0a6a862

                      SHA256

                      bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

                      SHA512

                      97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
                      Filesize

                      97KB

                      MD5

                      da1d0cd400e0b6ad6415fd4d90f69666

                      SHA1

                      de9083d2902906cacf57259cf581b1466400b799

                      SHA256

                      7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

                      SHA512

                      f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                      Filesize

                      1.3MB

                      MD5

                      7e08af319c9eb3297e09ca7bb8387de4

                      SHA1

                      4cf091f77a3eb9437ef33985e64bd10c1257284f

                      SHA256

                      6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

                      SHA512

                      bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                      Filesize

                      1.3MB

                      MD5

                      7e08af319c9eb3297e09ca7bb8387de4

                      SHA1

                      4cf091f77a3eb9437ef33985e64bd10c1257284f

                      SHA256

                      6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

                      SHA512

                      bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                      Filesize

                      1.3MB

                      MD5

                      7e08af319c9eb3297e09ca7bb8387de4

                      SHA1

                      4cf091f77a3eb9437ef33985e64bd10c1257284f

                      SHA256

                      6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

                      SHA512

                      bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                      Filesize

                      1.3MB

                      MD5

                      7e08af319c9eb3297e09ca7bb8387de4

                      SHA1

                      4cf091f77a3eb9437ef33985e64bd10c1257284f

                      SHA256

                      6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

                      SHA512

                      bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                      Filesize

                      1.3MB

                      MD5

                      7e08af319c9eb3297e09ca7bb8387de4

                      SHA1

                      4cf091f77a3eb9437ef33985e64bd10c1257284f

                      SHA256

                      6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

                      SHA512

                      bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
                      Filesize

                      326KB

                      MD5

                      80d93d38badecdd2b134fe4699721223

                      SHA1

                      e829e58091bae93bc64e0c6f9f0bac999cfda23d

                      SHA256

                      c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                      SHA512

                      9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                      Filesize

                      1.3MB

                      MD5

                      e801c5847f5f9d207db53aaaf5c6f3a2

                      SHA1

                      8e6818ce66555e2cca92e5c5f32551fb4a91645e

                      SHA256

                      196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

                      SHA512

                      303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                      Filesize

                      1.3MB

                      MD5

                      e801c5847f5f9d207db53aaaf5c6f3a2

                      SHA1

                      8e6818ce66555e2cca92e5c5f32551fb4a91645e

                      SHA256

                      196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

                      SHA512

                      303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                      Filesize

                      1.3MB

                      MD5

                      e801c5847f5f9d207db53aaaf5c6f3a2

                      SHA1

                      8e6818ce66555e2cca92e5c5f32551fb4a91645e

                      SHA256

                      196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

                      SHA512

                      303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                      Filesize

                      1.3MB

                      MD5

                      e801c5847f5f9d207db53aaaf5c6f3a2

                      SHA1

                      8e6818ce66555e2cca92e5c5f32551fb4a91645e

                      SHA256

                      196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

                      SHA512

                      303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                      Filesize

                      1.3MB

                      MD5

                      e801c5847f5f9d207db53aaaf5c6f3a2

                      SHA1

                      8e6818ce66555e2cca92e5c5f32551fb4a91645e

                      SHA256

                      196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

                      SHA512

                      303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
                      Filesize

                      326KB

                      MD5

                      80d93d38badecdd2b134fe4699721223

                      SHA1

                      e829e58091bae93bc64e0c6f9f0bac999cfda23d

                      SHA256

                      c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                      SHA512

                      9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                      Filesize

                      2.7MB

                      MD5

                      b58b3f896d028778df3528a3ff6e8967

                      SHA1

                      506be618807c061e1de17eff2c0896bce84c2383

                      SHA256

                      d5b7e4c851ee2dd80ab3058cee38f2e87e868b8a7f3ab35e54a112a6546de2bd

                      SHA512

                      4cf5ab25244c9549a66a366f48108c94b51552b5f14d752978dc726c4d314ae0f18ca90c29d00a44b07f8f84ba99dd494f75b803722df964cf4026833c09a10f

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                      Filesize

                      2.7MB

                      MD5

                      b58b3f896d028778df3528a3ff6e8967

                      SHA1

                      506be618807c061e1de17eff2c0896bce84c2383

                      SHA256

                      d5b7e4c851ee2dd80ab3058cee38f2e87e868b8a7f3ab35e54a112a6546de2bd

                      SHA512

                      4cf5ab25244c9549a66a366f48108c94b51552b5f14d752978dc726c4d314ae0f18ca90c29d00a44b07f8f84ba99dd494f75b803722df964cf4026833c09a10f

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                      Filesize

                      2.7MB

                      MD5

                      b58b3f896d028778df3528a3ff6e8967

                      SHA1

                      506be618807c061e1de17eff2c0896bce84c2383

                      SHA256

                      d5b7e4c851ee2dd80ab3058cee38f2e87e868b8a7f3ab35e54a112a6546de2bd

                      SHA512

                      4cf5ab25244c9549a66a366f48108c94b51552b5f14d752978dc726c4d314ae0f18ca90c29d00a44b07f8f84ba99dd494f75b803722df964cf4026833c09a10f

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                      Filesize

                      2.7MB

                      MD5

                      b58b3f896d028778df3528a3ff6e8967

                      SHA1

                      506be618807c061e1de17eff2c0896bce84c2383

                      SHA256

                      d5b7e4c851ee2dd80ab3058cee38f2e87e868b8a7f3ab35e54a112a6546de2bd

                      SHA512

                      4cf5ab25244c9549a66a366f48108c94b51552b5f14d752978dc726c4d314ae0f18ca90c29d00a44b07f8f84ba99dd494f75b803722df964cf4026833c09a10f

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                      Filesize

                      2.7MB

                      MD5

                      b58b3f896d028778df3528a3ff6e8967

                      SHA1

                      506be618807c061e1de17eff2c0896bce84c2383

                      SHA256

                      d5b7e4c851ee2dd80ab3058cee38f2e87e868b8a7f3ab35e54a112a6546de2bd

                      SHA512

                      4cf5ab25244c9549a66a366f48108c94b51552b5f14d752978dc726c4d314ae0f18ca90c29d00a44b07f8f84ba99dd494f75b803722df964cf4026833c09a10f

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                      Filesize

                      2.7MB

                      MD5

                      b58b3f896d028778df3528a3ff6e8967

                      SHA1

                      506be618807c061e1de17eff2c0896bce84c2383

                      SHA256

                      d5b7e4c851ee2dd80ab3058cee38f2e87e868b8a7f3ab35e54a112a6546de2bd

                      SHA512

                      4cf5ab25244c9549a66a366f48108c94b51552b5f14d752978dc726c4d314ae0f18ca90c29d00a44b07f8f84ba99dd494f75b803722df964cf4026833c09a10f

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                      Filesize

                      2.7MB

                      MD5

                      b58b3f896d028778df3528a3ff6e8967

                      SHA1

                      506be618807c061e1de17eff2c0896bce84c2383

                      SHA256

                      d5b7e4c851ee2dd80ab3058cee38f2e87e868b8a7f3ab35e54a112a6546de2bd

                      SHA512

                      4cf5ab25244c9549a66a366f48108c94b51552b5f14d752978dc726c4d314ae0f18ca90c29d00a44b07f8f84ba99dd494f75b803722df964cf4026833c09a10f

                      Download Submit

                    • memory/580-96-0x0000000002B00000-0x0000000002EE8000-memory.dmp

                      Filesize

                      3.9MB

                      Download

                    • memory/580-97-0x0000000002B00000-0x0000000002EE8000-memory.dmp

                      Filesize

                      3.9MB

                      Download

                    • memory/916-70-0x0000000010000000-0x0000000010051000-memory.dmp

                      Filesize

                      324KB

                      Download

                    • memory/916-148-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/916-72-0x0000000000BD0000-0x0000000000FB8000-memory.dmp

                      Filesize

                      3.9MB

                      Download

                    • memory/916-77-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/916-71-0x0000000000AE0000-0x0000000000B0C000-memory.dmp

                      Filesize

                      176KB

                      Download

                    • memory/916-67-0x0000000000BD0000-0x0000000000FB8000-memory.dmp

                      Filesize

                      3.9MB

                      Download

                    • memory/964-144-0x0000000003770000-0x0000000003C78000-memory.dmp

                      Filesize

                      5.0MB

                      Download

                    • memory/964-126-0x0000000000400000-0x0000000000908000-memory.dmp

                      Filesize

                      5.0MB

                      Download

                    • memory/964-129-0x0000000002960000-0x0000000002E68000-memory.dmp

                      Filesize

                      5.0MB

                      Download

                    • memory/964-133-0x0000000003470000-0x0000000003978000-memory.dmp

                      Filesize

                      5.0MB

                      Download

                    • memory/964-157-0x0000000003770000-0x0000000003C78000-memory.dmp

                      Filesize

                      5.0MB

                      Download

                    • memory/964-155-0x0000000002960000-0x0000000002E68000-memory.dmp

                      Filesize

                      5.0MB

                      Download

                    • memory/964-194-0x0000000000400000-0x0000000000908000-memory.dmp

                      Filesize

                      5.0MB

                      Download

                    • memory/1416-105-0x0000000000DE0000-0x0000000000DF0000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/1416-123-0x0000000001230000-0x0000000001618000-memory.dmp

                      Filesize

                      3.9MB

                      Download

                    • memory/1416-111-0x0000000005740000-0x0000000005C48000-memory.dmp

                      Filesize

                      5.0MB

                      Download

                    • memory/1416-110-0x0000000005740000-0x0000000005C48000-memory.dmp

                      Filesize

                      5.0MB

                      Download

                    • memory/1416-109-0x0000000005740000-0x0000000005C48000-memory.dmp

                      Filesize

                      5.0MB

                      Download

                    • memory/1416-98-0x0000000001230000-0x0000000001618000-memory.dmp

                      Filesize

                      3.9MB

                      Download

                    • memory/1416-106-0x0000000005740000-0x0000000005C48000-memory.dmp

                      Filesize

                      5.0MB

                      Download

                    • memory/1448-192-0x0000000000400000-0x0000000000908000-memory.dmp

                      Filesize

                      5.0MB

                      Download

                    • memory/1448-147-0x0000000000400000-0x0000000000908000-memory.dmp

                      Filesize

                      5.0MB

                      Download

                    • memory/1464-193-0x0000000002A40000-0x0000000002A50000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/1536-125-0x0000000000400000-0x0000000000908000-memory.dmp

                      Filesize

                      5.0MB

                      Download

                    • memory/1612-171-0x000007FEFBF71000-0x000007FEFBF73000-memory.dmp

                      Filesize

                      8KB

                      Download

                    • memory/1844-65-0x0000000002AF0000-0x0000000002ED8000-memory.dmp

                      Filesize

                      3.9MB

                      Download

                    • memory/1844-66-0x0000000002AF0000-0x0000000002ED8000-memory.dmp

                      Filesize

                      3.9MB

                      Download

                    • memory/1844-54-0x0000000075B41000-0x0000000075B43000-memory.dmp

                      Filesize

                      8KB

                      Download

                    • memory/1908-145-0x0000000000400000-0x0000000000908000-memory.dmp

                      Filesize

                      5.0MB

                      Download

                    • memory/1908-146-0x00000000029F0000-0x0000000002EF8000-memory.dmp

                      Filesize

                      5.0MB

                      Download

                    • memory/1908-188-0x0000000000400000-0x0000000000908000-memory.dmp

                      Filesize

                      5.0MB

                      Download

                    • memory/1968-132-0x0000000000400000-0x0000000000908000-memory.dmp

                      Filesize

                      5.0MB

                      Download

                    • memory/1968-196-0x0000000000400000-0x0000000000908000-memory.dmp

                      Filesize

                      5.0MB

                      Download