Analysis
-
max time kernel
115s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
06-02-2023 18:22
Static task
static1
Behavioral task
behavioral1
Sample
TLauncher-2.871-Installer-1.0.6-global.exe
Resource
win7-20221111-en
General
-
Target
TLauncher-2.871-Installer-1.0.6-global.exe
-
Size
23.6MB
-
MD5
7a4472a78d0651e11d20aa08e43cc045
-
SHA1
aab1d5f80d7399ae2c1982201733be7681d100b1
-
SHA256
318df7404e6c4d5538a6d31997b95af52bbb8d40caf5553b3cbd9b1bc4f6db96
-
SHA512
c152c9d21b0615548173dcc61accb1a1afd5b6f98e6ec21f6a7119536397f07a54ad4087669716c3344dd338ce4f24cecf9989d472f65eaa18c87d496f23c681
-
SSDEEP
393216:gXQLpnUN/n8IPfs/dQETVlOBbpFEj9GZ1GphRqV56Hpk7IXOzDnKI17fyVS:ggLFUp8aHExiTI3qqHp6zvKcfyVS
Malware Config
Signatures
-
BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
-
Bazar/Team9 Backdoor payload 2 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\jre-windows.exe BazarBackdoorVar3 C:\Users\Admin\AppData\Local\Temp\jre-windows.exe BazarBackdoorVar3 -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
opera.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\International\Geo\Nation opera.exe -
Executes dropped EXE 29 IoCs
Processes:
irsetup.exeAdditionalExecuteTL.exeirsetup.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exe_sfx.exejre-windows.exeassistant_installer.exeTLauncher.exeassistant_installer.exejre-windows.exeinstaller.exeinstaller.exeTLauncher.exelauncher.exeopera.exeopera_crashreporter.exeopera.exeopera_crashreporter.exelauncher.exeopera.exeopera_crashreporter.exeopera.exeopera.exeopera.exeopera.exepid process 1252 irsetup.exe 1916 AdditionalExecuteTL.exe 1524 irsetup.exe 1592 opera-installer-bro.exe 656 opera-installer-bro.exe 1084 opera-installer-bro.exe 1212 opera-installer-bro.exe 1028 opera-installer-bro.exe 1780 _sfx.exe 1608 jre-windows.exe 1084 assistant_installer.exe 892 TLauncher.exe 1568 assistant_installer.exe 1244 jre-windows.exe 2292 installer.exe 2324 installer.exe 2436 TLauncher.exe 2488 launcher.exe 2532 opera.exe 2548 opera_crashreporter.exe 2896 opera.exe 2908 opera_crashreporter.exe 1720 launcher.exe 1616 opera.exe 2228 opera_crashreporter.exe 3052 opera.exe 2336 opera.exe 2292 opera.exe 816 opera.exe -
Loads dropped DLL 64 IoCs
Processes:
TLauncher-2.871-Installer-1.0.6-global.exeirsetup.exeAdditionalExecuteTL.exeirsetup.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exeassistant_installer.exejre-windows.exeinstaller.exeinstaller.exelauncher.exeopera.exepid process 1508 TLauncher-2.871-Installer-1.0.6-global.exe 1508 TLauncher-2.871-Installer-1.0.6-global.exe 1508 TLauncher-2.871-Installer-1.0.6-global.exe 1508 TLauncher-2.871-Installer-1.0.6-global.exe 1252 irsetup.exe 1252 irsetup.exe 1252 irsetup.exe 1252 irsetup.exe 1252 irsetup.exe 1252 irsetup.exe 1252 irsetup.exe 1252 irsetup.exe 1916 AdditionalExecuteTL.exe 1916 AdditionalExecuteTL.exe 1916 AdditionalExecuteTL.exe 1916 AdditionalExecuteTL.exe 1524 irsetup.exe 1524 irsetup.exe 1524 irsetup.exe 1524 irsetup.exe 1524 irsetup.exe 1524 irsetup.exe 1524 irsetup.exe 1524 irsetup.exe 1592 opera-installer-bro.exe 1592 opera-installer-bro.exe 656 opera-installer-bro.exe 1592 opera-installer-bro.exe 1084 opera-installer-bro.exe 1592 opera-installer-bro.exe 1212 opera-installer-bro.exe 1212 opera-installer-bro.exe 1028 opera-installer-bro.exe 1592 opera-installer-bro.exe 1592 opera-installer-bro.exe 1592 opera-installer-bro.exe 1252 irsetup.exe 1592 opera-installer-bro.exe 1084 assistant_installer.exe 1212 opera-installer-bro.exe 1212 opera-installer-bro.exe 1608 jre-windows.exe 1212 opera-installer-bro.exe 2292 installer.exe 2292 installer.exe 2324 installer.exe 2292 installer.exe 1220 1220 1220 1220 1220 1220 1220 2292 installer.exe 2488 launcher.exe 2532 opera.exe 2532 opera.exe 2532 opera.exe 2532 opera.exe 1220 1220 1220 2532 opera.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx behavioral1/memory/1252-66-0x0000000000A80000-0x0000000000E68000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx behavioral1/memory/1252-72-0x0000000000A80000-0x0000000000E68000-memory.dmp upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe upx C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe upx C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe upx behavioral1/memory/1524-100-0x0000000000CA0000-0x0000000001088000-memory.dmp upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe upx \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx behavioral1/memory/1524-108-0x0000000000CA0000-0x0000000001088000-memory.dmp upx behavioral1/memory/1592-110-0x0000000000400000-0x0000000000947000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe upx behavioral1/memory/656-119-0x0000000000400000-0x0000000000947000-memory.dmp upx \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe upx behavioral1/memory/1084-125-0x0000000000400000-0x0000000000947000-memory.dmp upx \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx behavioral1/memory/1212-141-0x0000000000400000-0x0000000000947000-memory.dmp upx behavioral1/memory/1028-143-0x0000000000400000-0x0000000000947000-memory.dmp upx behavioral1/memory/1212-194-0x0000000000400000-0x0000000000947000-memory.dmp upx behavioral1/memory/1028-195-0x0000000000400000-0x0000000000947000-memory.dmp upx behavioral1/memory/1592-197-0x0000000000400000-0x0000000000947000-memory.dmp upx behavioral1/memory/656-199-0x0000000000400000-0x0000000000947000-memory.dmp upx behavioral1/memory/2356-274-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral1/memory/2356-283-0x0000000000400000-0x0000000000417000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
opera.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run opera.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Opera Stable = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\launcher.exe" opera.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 27 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exeopera-installer-bro.exeopera-installer-bro.exeinstaller.exedescription ioc process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\D: opera-installer-bro.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: opera-installer-bro.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: installer.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe -
Drops file in Program Files directory 2 IoCs
Processes:
opera.exedescription ioc process File created C:\Program Files\scoped_dir2896_1925565752\persona.ini opera.exe File created C:\Program Files\scoped_dir2896_1925565752\reborn5.png opera.exe -
Drops file in Windows directory 2 IoCs
Processes:
msiexec.exedescription ioc process File created C:\Windows\Installer\6dce86.msi msiexec.exe File opened for modification C:\Windows\Installer\6dce86.msi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 6 IoCs
Processes:
opera.exeopera.exeopera.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName opera.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS opera.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName opera.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS opera.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName opera.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS opera.exe -
Processes:
jre-windows.exeiexplore.exeIEXPLORE.EXEirsetup.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main jre-windows.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DF672A51-A653-11ED-9DF7-72598884447E} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main irsetup.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Modifies registry class 64 IoCs
Processes:
installer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.xht installer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.xht\OpenWithProgIDs\OperaStable = "0" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\https\URL Protocol installer.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\https\DefaultIcon installer.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\https\shell\open installer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\ftp\EditFlags = "2" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\OperaStable\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\Launcher.exe,0" installer.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\OperaStable\shell\open\command installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.crx\ = "OperaStable" installer.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Applications\opera.exe\shell installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\http\URL Protocol installer.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\http\shell\open\command installer.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\http\shell\open installer.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\ftp installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\ftp\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\Launcher.exe,0" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\OperaStable\URL Protocol installer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.pdf\OpenWithProgIDs\OperaStable = "0" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.xht\ = "OperaStable" installer.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.xhtml installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Applications\opera.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\Launcher.exe\" \"%1\"" installer.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\https\shell\open\command installer.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.opdownload installer.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.xhtml\OpenWithProgIDs installer.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\http\shell\open\ddeexec\Topic installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\https\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\launcher.exe\" -noautoupdate -- \"%1\"" installer.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\https\shell\open\ddeexec installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\https\shell\open\ddeexec\Application\ installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\ftp\shell\open\ddeexec\ installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\ftp\shell\open\ddeexec\Topic\ installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\OperaStable\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\Launcher.exe\" -noautoupdate -- \"%1\"" installer.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\http installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\http\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\Launcher.exe,0" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\http\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\launcher.exe\" -noautoupdate -- \"%1\"" installer.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\http\shell\open\ddeexec\Application installer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\https\EditFlags = "2" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.htm\ = "OperaStable" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.shtml\ = "OperaStable" installer.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\OperaStable\shell\open\ddeexec\Application installer.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.shtml installer.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.crx installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\http\shell\open\ddeexec\Application\ installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\https\shell\open\ddeexec\Topic\ installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\https\shell\open\ddeexec\ installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\ftp\URL Protocol installer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.htm\OpenWithProgIDs\OperaStable = "0" installer.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.xht\OpenWithProgIDs installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\ftp\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\launcher.exe\" -noautoupdate -- \"%1\"" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.opdownload\ = "OperaStable" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\OperaStable\shell\open\ddeexec\Application\ installer.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\OperaStable\shell\open\ddeexec\Topic installer.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\http\DefaultIcon installer.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\https\shell\open\ddeexec\Topic installer.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\ftp\shell\open\command installer.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\ftp\shell installer.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\ftp\shell\open installer.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\ftp\shell\open\ddeexec installer.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.html\OpenWithProgIDs installer.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.pdf installer.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Applications\opera.exe\shell\open installer.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\ftp\shell\open\ddeexec\Application installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\ftp\shell\open\ddeexec\Application\ installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.xhtml\ = "OperaStable" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\OperaStable\FriendlyTypeName = "Opera Web Document" installer.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.html installer.exe -
Processes:
irsetup.exeopera-installer-bro.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 irsetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 opera-installer-bro.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 opera-installer-bro.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 opera-installer-bro.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 opera-installer-bro.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde irsetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 opera-installer-bro.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 opera-installer-bro.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 opera-installer-bro.exe -
Suspicious use of AdjustPrivilegeToken 56 IoCs
Processes:
opera.exeopera.exeopera.exejre-windows.exemsiexec.exedescription pid process Token: SeShutdownPrivilege 2532 opera.exe Token: SeShutdownPrivilege 2532 opera.exe Token: SeShutdownPrivilege 2896 opera.exe Token: SeShutdownPrivilege 2896 opera.exe Token: SeShutdownPrivilege 2896 opera.exe Token: SeShutdownPrivilege 2896 opera.exe Token: SeShutdownPrivilege 2896 opera.exe Token: SeShutdownPrivilege 2896 opera.exe Token: SeShutdownPrivilege 1616 opera.exe Token: SeShutdownPrivilege 1616 opera.exe Token: SeShutdownPrivilege 2896 opera.exe Token: SeShutdownPrivilege 2896 opera.exe Token: SeShutdownPrivilege 2896 opera.exe Token: SeShutdownPrivilege 2896 opera.exe Token: SeShutdownPrivilege 1244 jre-windows.exe Token: SeIncreaseQuotaPrivilege 1244 jre-windows.exe Token: SeRestorePrivilege 2892 msiexec.exe Token: SeTakeOwnershipPrivilege 2892 msiexec.exe Token: SeSecurityPrivilege 2892 msiexec.exe Token: SeShutdownPrivilege 2896 opera.exe Token: SeShutdownPrivilege 2896 opera.exe Token: SeCreateTokenPrivilege 1244 jre-windows.exe Token: SeAssignPrimaryTokenPrivilege 1244 jre-windows.exe Token: SeLockMemoryPrivilege 1244 jre-windows.exe Token: SeIncreaseQuotaPrivilege 1244 jre-windows.exe Token: SeMachineAccountPrivilege 1244 jre-windows.exe Token: SeTcbPrivilege 1244 jre-windows.exe Token: SeSecurityPrivilege 1244 jre-windows.exe Token: SeTakeOwnershipPrivilege 1244 jre-windows.exe Token: SeLoadDriverPrivilege 1244 jre-windows.exe Token: SeSystemProfilePrivilege 1244 jre-windows.exe Token: SeSystemtimePrivilege 1244 jre-windows.exe Token: SeProfSingleProcessPrivilege 1244 jre-windows.exe Token: SeIncBasePriorityPrivilege 1244 jre-windows.exe Token: SeCreatePagefilePrivilege 1244 jre-windows.exe Token: SeCreatePermanentPrivilege 1244 jre-windows.exe Token: SeBackupPrivilege 1244 jre-windows.exe Token: SeRestorePrivilege 1244 jre-windows.exe Token: SeShutdownPrivilege 1244 jre-windows.exe Token: SeDebugPrivilege 1244 jre-windows.exe Token: SeAuditPrivilege 1244 jre-windows.exe Token: SeSystemEnvironmentPrivilege 1244 jre-windows.exe Token: SeChangeNotifyPrivilege 1244 jre-windows.exe Token: SeRemoteShutdownPrivilege 1244 jre-windows.exe Token: SeUndockPrivilege 1244 jre-windows.exe Token: SeSyncAgentPrivilege 1244 jre-windows.exe Token: SeEnableDelegationPrivilege 1244 jre-windows.exe Token: SeManageVolumePrivilege 1244 jre-windows.exe Token: SeImpersonatePrivilege 1244 jre-windows.exe Token: SeCreateGlobalPrivilege 1244 jre-windows.exe Token: SeRestorePrivilege 2892 msiexec.exe Token: SeTakeOwnershipPrivilege 2892 msiexec.exe Token: SeShutdownPrivilege 2896 opera.exe Token: SeShutdownPrivilege 2896 opera.exe Token: SeShutdownPrivilege 2896 opera.exe Token: SeShutdownPrivilege 2896 opera.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1100 iexplore.exe -
Suspicious use of SetWindowsHookEx 16 IoCs
Processes:
irsetup.exeirsetup.exeiexplore.exeIEXPLORE.EXEjre-windows.exepid process 1252 irsetup.exe 1252 irsetup.exe 1252 irsetup.exe 1252 irsetup.exe 1252 irsetup.exe 1252 irsetup.exe 1524 irsetup.exe 1524 irsetup.exe 1100 iexplore.exe 1100 iexplore.exe 1804 IEXPLORE.EXE 1804 IEXPLORE.EXE 1244 jre-windows.exe 1244 jre-windows.exe 1244 jre-windows.exe 1244 jre-windows.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
TLauncher-2.871-Installer-1.0.6-global.exeirsetup.exeAdditionalExecuteTL.exeirsetup.exeopera-installer-bro.exeopera-installer-bro.exedescription pid process target process PID 1508 wrote to memory of 1252 1508 TLauncher-2.871-Installer-1.0.6-global.exe irsetup.exe PID 1508 wrote to memory of 1252 1508 TLauncher-2.871-Installer-1.0.6-global.exe irsetup.exe PID 1508 wrote to memory of 1252 1508 TLauncher-2.871-Installer-1.0.6-global.exe irsetup.exe PID 1508 wrote to memory of 1252 1508 TLauncher-2.871-Installer-1.0.6-global.exe irsetup.exe PID 1508 wrote to memory of 1252 1508 TLauncher-2.871-Installer-1.0.6-global.exe irsetup.exe PID 1508 wrote to memory of 1252 1508 TLauncher-2.871-Installer-1.0.6-global.exe irsetup.exe PID 1508 wrote to memory of 1252 1508 TLauncher-2.871-Installer-1.0.6-global.exe irsetup.exe PID 1252 wrote to memory of 1916 1252 irsetup.exe AdditionalExecuteTL.exe PID 1252 wrote to memory of 1916 1252 irsetup.exe AdditionalExecuteTL.exe PID 1252 wrote to memory of 1916 1252 irsetup.exe AdditionalExecuteTL.exe PID 1252 wrote to memory of 1916 1252 irsetup.exe AdditionalExecuteTL.exe PID 1252 wrote to memory of 1916 1252 irsetup.exe AdditionalExecuteTL.exe PID 1252 wrote to memory of 1916 1252 irsetup.exe AdditionalExecuteTL.exe PID 1252 wrote to memory of 1916 1252 irsetup.exe AdditionalExecuteTL.exe PID 1916 wrote to memory of 1524 1916 AdditionalExecuteTL.exe irsetup.exe PID 1916 wrote to memory of 1524 1916 AdditionalExecuteTL.exe irsetup.exe PID 1916 wrote to memory of 1524 1916 AdditionalExecuteTL.exe irsetup.exe PID 1916 wrote to memory of 1524 1916 AdditionalExecuteTL.exe irsetup.exe PID 1916 wrote to memory of 1524 1916 AdditionalExecuteTL.exe irsetup.exe PID 1916 wrote to memory of 1524 1916 AdditionalExecuteTL.exe irsetup.exe PID 1916 wrote to memory of 1524 1916 AdditionalExecuteTL.exe irsetup.exe PID 1524 wrote to memory of 1592 1524 irsetup.exe opera-installer-bro.exe PID 1524 wrote to memory of 1592 1524 irsetup.exe opera-installer-bro.exe PID 1524 wrote to memory of 1592 1524 irsetup.exe opera-installer-bro.exe PID 1524 wrote to memory of 1592 1524 irsetup.exe opera-installer-bro.exe PID 1524 wrote to memory of 1592 1524 irsetup.exe opera-installer-bro.exe PID 1524 wrote to memory of 1592 1524 irsetup.exe opera-installer-bro.exe PID 1524 wrote to memory of 1592 1524 irsetup.exe opera-installer-bro.exe PID 1592 wrote to memory of 656 1592 opera-installer-bro.exe opera-installer-bro.exe PID 1592 wrote to memory of 656 1592 opera-installer-bro.exe opera-installer-bro.exe PID 1592 wrote to memory of 656 1592 opera-installer-bro.exe opera-installer-bro.exe PID 1592 wrote to memory of 656 1592 opera-installer-bro.exe opera-installer-bro.exe PID 1592 wrote to memory of 656 1592 opera-installer-bro.exe opera-installer-bro.exe PID 1592 wrote to memory of 656 1592 opera-installer-bro.exe opera-installer-bro.exe PID 1592 wrote to memory of 656 1592 opera-installer-bro.exe opera-installer-bro.exe PID 1592 wrote to memory of 1084 1592 opera-installer-bro.exe opera-installer-bro.exe PID 1592 wrote to memory of 1084 1592 opera-installer-bro.exe opera-installer-bro.exe PID 1592 wrote to memory of 1084 1592 opera-installer-bro.exe opera-installer-bro.exe PID 1592 wrote to memory of 1084 1592 opera-installer-bro.exe opera-installer-bro.exe PID 1592 wrote to memory of 1084 1592 opera-installer-bro.exe opera-installer-bro.exe PID 1592 wrote to memory of 1084 1592 opera-installer-bro.exe opera-installer-bro.exe PID 1592 wrote to memory of 1084 1592 opera-installer-bro.exe opera-installer-bro.exe PID 1592 wrote to memory of 1212 1592 opera-installer-bro.exe opera-installer-bro.exe PID 1592 wrote to memory of 1212 1592 opera-installer-bro.exe opera-installer-bro.exe PID 1592 wrote to memory of 1212 1592 opera-installer-bro.exe opera-installer-bro.exe PID 1592 wrote to memory of 1212 1592 opera-installer-bro.exe opera-installer-bro.exe PID 1592 wrote to memory of 1212 1592 opera-installer-bro.exe opera-installer-bro.exe PID 1592 wrote to memory of 1212 1592 opera-installer-bro.exe opera-installer-bro.exe PID 1592 wrote to memory of 1212 1592 opera-installer-bro.exe opera-installer-bro.exe PID 1212 wrote to memory of 1028 1212 opera-installer-bro.exe opera-installer-bro.exe PID 1212 wrote to memory of 1028 1212 opera-installer-bro.exe opera-installer-bro.exe PID 1212 wrote to memory of 1028 1212 opera-installer-bro.exe opera-installer-bro.exe PID 1212 wrote to memory of 1028 1212 opera-installer-bro.exe opera-installer-bro.exe PID 1212 wrote to memory of 1028 1212 opera-installer-bro.exe opera-installer-bro.exe PID 1212 wrote to memory of 1028 1212 opera-installer-bro.exe opera-installer-bro.exe PID 1212 wrote to memory of 1028 1212 opera-installer-bro.exe opera-installer-bro.exe PID 1592 wrote to memory of 1780 1592 opera-installer-bro.exe _sfx.exe PID 1592 wrote to memory of 1780 1592 opera-installer-bro.exe _sfx.exe PID 1592 wrote to memory of 1780 1592 opera-installer-bro.exe _sfx.exe PID 1592 wrote to memory of 1780 1592 opera-installer-bro.exe _sfx.exe PID 1592 wrote to memory of 1780 1592 opera-installer-bro.exe _sfx.exe PID 1592 wrote to memory of 1780 1592 opera-installer-bro.exe _sfx.exe PID 1592 wrote to memory of 1780 1592 opera-installer-bro.exe _sfx.exe PID 1252 wrote to memory of 1608 1252 irsetup.exe jre-windows.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe" "__IRCT:3" "__IRTSS:24771453" "__IRSID:S-1-5-21-3385717845-2518323428-350143044-1000"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816850 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" "__IRCT:3" "__IRTSS:1840872" "__IRSID:S-1-5-21-3385717845-2518323428-350143044-1000"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe"C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=05⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exeC:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=95.0.4635.25 --initial-client-data=0x1a4,0x1a8,0x1ac,0x178,0x1b0,0x70e9e428,0x70e9e438,0x70e9e4446⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe" --version6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe"C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --pin-additional-shortcuts=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=1592 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20230206192345" --session-guid=c04cf3f3-3bb9-4dbd-b5b2-9ba2a384497b --server-tracking-blob=NDkzYjc4NzI2MTkzN2I5ZjBkNjg4ZmIxMDk1ZjBkODhiODJiNjZkZDJjZDBkZTZiOWIzN2QyYjgyYjNmOWU5MTp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInRpbWVzdGFtcCI6IjE2NzU3MDc4MjIuNzg5NiIsInVzZXJhZ2VudCI6IlNldHVwIEZhY3RvcnkgOS4wIiwidXRtIjp7ImNhbXBhaWduIjoiT3BlcmFEZXNrdG9wIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiTVNUTCJ9LCJ1dWlkIjoiNTkwZGRjNDEtODE2OS00MjFkLWExZmQtNDI0MTUwZDcxNzhkIn0= --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=10030000000000006⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exeC:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=95.0.4635.25 --initial-client-data=0x1b0,0x1b4,0x1b8,0x178,0x1bc,0x703ae428,0x703ae438,0x703ae4447⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.25\installer.exe"C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.25\installer.exe" --backend --initial-pid=1592 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --pin-additional-shortcuts=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302061923451" --session-guid=c04cf3f3-3bb9-4dbd-b5b2-9ba2a384497b --server-tracking-blob=NDkzYjc4NzI2MTkzN2I5ZjBkNjg4ZmIxMDk1ZjBkODhiODJiNjZkZDJjZDBkZTZiOWIzN2QyYjgyYjNmOWU5MTp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInRpbWVzdGFtcCI6IjE2NzU3MDc4MjIuNzg5NiIsInVzZXJhZ2VudCI6IlNldHVwIEZhY3RvcnkgOS4wIiwidXRtIjp7ImNhbXBhaWduIjoiT3BlcmFEZXNrdG9wIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiTVNUTCJ9LCJ1dWlkIjoiNTkwZGRjNDEtODE2OS00MjFkLWExZmQtNDI0MTUwZDcxNzhkIn0= --silent --desktopshortcut=1 --install-subfolder=95.0.4635.257⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.25\installer.exeC:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.25\installer.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=95.0.4635.25 --initial-client-data=0x174,0x178,0x17c,0x148,0x180,0x7fef5eaa908,0x7fef5eaa918,0x7fef5eaa9288⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe"C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe" --start-maximized8⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --start-maximized --ran-launcher9⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.25\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.25\opera_crashreporter.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=95.0.4635.25 --initial-client-data=0x15c,0x160,0x164,0x130,0x168,0x7feeece1a18,0x7feeece1a28,0x7feeece1a3810⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:campaign-ignore-dna=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=980 --field-trial-handle=1192,i,18022210161222973596,15895346788141721529,131072 /prefetch:210⤵
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302061923451\assistant\_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302061923451\assistant\_sfx.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302061923451\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302061923451\assistant\assistant_installer.exe" --version6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302061923451\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302061923451\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x148,0x14c,0x150,0x11c,0x154,0xe92dc0,0xe92dd0,0xe92ddc7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jre-windows.exe"C:\Users\Admin\AppData\Local\Temp\jre-windows.exe" STATIC=13⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\jds7155391.tmp\jre-windows.exe"C:\Users\Admin\AppData\Local\Temp\jds7155391.tmp\jre-windows.exe" "STATIC=1"4⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://java-for-minecraft.com/2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1100 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe"C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe" -noautoupdate -- "http://java-for-minecraft.com/"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" -noautoupdate --ran-launcher -- http://java-for-minecraft.com/3⤵
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.25\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.25\opera_crashreporter.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=95.0.4635.25 --initial-client-data=0x15c,0x160,0x164,0x130,0x168,0x7feeece1a18,0x7feeece1a28,0x7feeece1a384⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:campaign-ignore-dna=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1084 --field-trial-handle=1168,i,4368621652355670271,16047691482675966,131072 /prefetch:24⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:campaign-ignore-dna=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=1316 --field-trial-handle=1168,i,4368621652355670271,16047691482675966,131072 /prefetch:84⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --start-maximized --ran-launcher --flag-switches-begin --flag-switches-end --enable-quic --lowered-browser1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.25\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.25\opera_crashreporter.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=95.0.4635.25 --initial-client-data=0x15c,0x160,0x164,0x130,0x168,0x7feeece1a18,0x7feeece1a28,0x7feeece1a382⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:campaign-ignore-dna=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1028 --field-trial-handle=1072,i,6426745082925742542,12936367492592963090,131072 /prefetch:22⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:campaign-ignore-dna=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=1300 --field-trial-handle=1072,i,6426745082925742542,12936367492592963090,131072 /prefetch:82⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:booking-modal=off --with-feature:campaign-ignore-dna=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:premium-valve-in=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=1384 --field-trial-handle=1072,i,6426745082925742542,12936367492592963090,131072 /prefetch:82⤵
-
C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.25\opera_autoupdate.exe"C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.25\opera_autoupdate.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" --pipeid=oauc_pipe2906202b27b41e4bd66c9238c4b575c12⤵
-
C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.25\opera_autoupdate.exeC:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.25\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=95.0.4635.25 --initial-client-data=0x138,0x13c,0x140,0x10c,0x144,0x13fb0cbd8,0x13fb0cbe8,0x13fb0cbf83⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding 24D999AA521C54B6D99F8CAD47A756F52⤵
-
C:\Program Files\Java\jre1.8.0_351\installer.exe"C:\Program Files\Java\jre1.8.0_351\installer.exe" /s INSTALLDIR="C:\Program Files\Java\jre1.8.0_351\\" STATIC=1 INSTALL_SILENT=1 REPAIRMODE=0 ProductCode={26A24AE4-039D-4CA4-87B4-2F64180351F0}2⤵
-
C:\ProgramData\Oracle\Java\installcache_x64\7207214.tmp\bspatch.exe"bspatch.exe" baseimagefam8 newimage diff3⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {3B4B01E6-9261-4358-A162-0BF4DE3A2815} S-1-5-21-3385717845-2518323428-350143044-1000:SABDUHNY\Admin:Interactive:[1]1⤵
-
C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exeC:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe --scheduledautoupdate --autoupdaterequesttype=automatic --autoupdateoperaversion=95.0.4635.25 --newautoupdaterlogic2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565Filesize
471B
MD53dafab4edf63fd8fddf39bc590c0d564
SHA1f8c6aafd9c9cfcb1d1e98be8dd0d9aa543aab316
SHA256acaa2644dbba359eb70b0f0cf46054e17a2cd94b9edcd84566b25451fcab78bc
SHA51289233bd5215ab8637f71d3bd0b5acb13ec75381e49165875b32d589b9ead7ae483ed777e3717d12c7d80dafeffff49f2439c1e163c93519b899af56b7c5b86cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD55eae2ee20ee908e69ff3a393d2ba6473
SHA19d9e5a587e762fae25781b03219639e8edea8699
SHA25684411827346c5e112741a87728ceb4b28e480359e825ed6adc820ede00d3f5ad
SHA512542c1bf74c7f51e0a8caff59c312a7279dcb656c264b6c01fa2c3b4cd120a1f92132c3712a394a70af1d3f0af14a0bfcc250913118f4cd7c7f854c073317e974
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5786d7c9ea3636df130b71049ea16635c
SHA1aee67d3b3eff63f2bd76218ac585e1d70a086cc5
SHA256eecf1a143a7ee37f3ffa029bb544987b6c1c4571219eb6da2e9eb105b91bf7d4
SHA512546b2bc203c94b5941c1baa6f9edc1b2d3a23460684b39f83e163c4d4688409b36ee005fc96b98e5c591ab7f014324e71772308ecfce1552d93fd46afa460f94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD542b00002a3bb05b5b11b2380ceb46e9b
SHA1c5993d5425b3fca42ba9c4e0ac26e1c219e6de01
SHA2564556fa51a4b6069fbfdd8e5066b5100f703545e09ae685e033c1a4bc123a7f3d
SHA512001f875d81bf1eb163fd9ef16838911bd27eca0d74e58ae6b5e1eab3ba556069dca26bce7d3e3ca29ff4018eae3c5ddbb78b3919cd9a3b9bb2b1dca783bafd73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565Filesize
404B
MD55c5b3d70d69a00e8011906b365cf22f6
SHA177ae034ad69179a36509110185c9e18efe1ba3c1
SHA25694905e2d8b1a3ce645a303398871c67c6d1ab7b3ae740bb1a202f402942ddb80
SHA512ddda9327d4d24570535726a3f119a8ca145f00e739b102c8b172ef7a5ff440389e61b33a71f6eb4a8295c028e403624fdfb69ea8a5f207c512d71510bd36e1b6
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exeFilesize
2.7MB
MD51e39ebd9ac9163a5a428a3fd80b6986e
SHA1943e6c9fb3780fb064907b3ad6b3c3b6bb4a47a5
SHA2564e580bc172a325e018bc83e00d4d645977d02be450f62368d5e684d61f23db26
SHA512627315260afedd28c573c6794eff933074b0a5311edbbe544e95bf5cba1f5ac0f53a4593fb685841ae56ba03e8a30b37061f928e595f86da7d834684518257f1
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302061923451\assistant\_sfx.exeFilesize
1.7MB
MD50238df215bf6943892daf85de8ad433a
SHA13d905e4e2c0e9170df61b7a199321847691f945e
SHA256a7818aca6acbe347df13d51d9750f6a852c5aa2a58580f7f2015113e0a3e06d7
SHA512fc6c12e359b9a4ce84ef878f29648a4c97c38fd12ed80996c5e03829833220010fff9c751a99f399dad3529bda6438424194ed18236addfbe430343807aaad69
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302061923451\assistant\_sfx.exeFilesize
1.7MB
MD50238df215bf6943892daf85de8ad433a
SHA13d905e4e2c0e9170df61b7a199321847691f945e
SHA256a7818aca6acbe347df13d51d9750f6a852c5aa2a58580f7f2015113e0a3e06d7
SHA512fc6c12e359b9a4ce84ef878f29648a4c97c38fd12ed80996c5e03829833220010fff9c751a99f399dad3529bda6438424194ed18236addfbe430343807aaad69
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302061923451\assistant\assistant_installer.exeFilesize
2.1MB
MD59df6e2fbb7e38964f35016bf91ef7424
SHA1d0c1266dc46814bc6165cf6a69e90581228989a7
SHA2563573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d
SHA512b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exeFilesize
1.8MB
MD5aa4de04ccc16b74a4c2301da8d621ec1
SHA1d05c6d8200f6e6b1283df82d24d687adc47d9664
SHA256e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b
SHA51228d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exeFilesize
1.8MB
MD5aa4de04ccc16b74a4c2301da8d621ec1
SHA1d05c6d8200f6e6b1283df82d24d687adc47d9664
SHA256e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b
SHA51228d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exeFilesize
1.3MB
MD57e08af319c9eb3297e09ca7bb8387de4
SHA14cf091f77a3eb9437ef33985e64bd10c1257284f
SHA2566c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8
SHA512bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exeFilesize
1.3MB
MD57e08af319c9eb3297e09ca7bb8387de4
SHA14cf091f77a3eb9437ef33985e64bd10c1257284f
SHA2566c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8
SHA512bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dllFilesize
326KB
MD580d93d38badecdd2b134fe4699721223
SHA1e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA5129f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exeFilesize
1.3MB
MD5e801c5847f5f9d207db53aaaf5c6f3a2
SHA18e6818ce66555e2cca92e5c5f32551fb4a91645e
SHA256196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03
SHA512303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exeFilesize
1.3MB
MD5e801c5847f5f9d207db53aaaf5c6f3a2
SHA18e6818ce66555e2cca92e5c5f32551fb4a91645e
SHA256196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03
SHA512303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dllFilesize
326KB
MD580d93d38badecdd2b134fe4699721223
SHA1e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA5129f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4
-
C:\Users\Admin\AppData\Local\Temp\jre-windows.exeFilesize
84.5MB
MD57542ec421a2f6e90751e8b64c22e0542
SHA1d207d221a28ede5c2c8415f82c555989aa7068ba
SHA256188ca8ecc44de1b7f602e883c3054dc392792c3631bf362b1bc4f3e1dba323e6
SHA5128987bf8aa1b401815fa9850e56954db6015bdd06ce78b65ba435724582ffa615dee4e1452fa237c53257dca8ee97b469d01c27757a5f070ce6f807a4f81094bc
-
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exeFilesize
2.7MB
MD51e39ebd9ac9163a5a428a3fd80b6986e
SHA1943e6c9fb3780fb064907b3ad6b3c3b6bb4a47a5
SHA2564e580bc172a325e018bc83e00d4d645977d02be450f62368d5e684d61f23db26
SHA512627315260afedd28c573c6794eff933074b0a5311edbbe544e95bf5cba1f5ac0f53a4593fb685841ae56ba03e8a30b37061f928e595f86da7d834684518257f1
-
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exeFilesize
2.7MB
MD51e39ebd9ac9163a5a428a3fd80b6986e
SHA1943e6c9fb3780fb064907b3ad6b3c3b6bb4a47a5
SHA2564e580bc172a325e018bc83e00d4d645977d02be450f62368d5e684d61f23db26
SHA512627315260afedd28c573c6794eff933074b0a5311edbbe544e95bf5cba1f5ac0f53a4593fb685841ae56ba03e8a30b37061f928e595f86da7d834684518257f1
-
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exeFilesize
2.7MB
MD51e39ebd9ac9163a5a428a3fd80b6986e
SHA1943e6c9fb3780fb064907b3ad6b3c3b6bb4a47a5
SHA2564e580bc172a325e018bc83e00d4d645977d02be450f62368d5e684d61f23db26
SHA512627315260afedd28c573c6794eff933074b0a5311edbbe544e95bf5cba1f5ac0f53a4593fb685841ae56ba03e8a30b37061f928e595f86da7d834684518257f1
-
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exeFilesize
2.7MB
MD51e39ebd9ac9163a5a428a3fd80b6986e
SHA1943e6c9fb3780fb064907b3ad6b3c3b6bb4a47a5
SHA2564e580bc172a325e018bc83e00d4d645977d02be450f62368d5e684d61f23db26
SHA512627315260afedd28c573c6794eff933074b0a5311edbbe544e95bf5cba1f5ac0f53a4593fb685841ae56ba03e8a30b37061f928e595f86da7d834684518257f1
-
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exeFilesize
2.7MB
MD51e39ebd9ac9163a5a428a3fd80b6986e
SHA1943e6c9fb3780fb064907b3ad6b3c3b6bb4a47a5
SHA2564e580bc172a325e018bc83e00d4d645977d02be450f62368d5e684d61f23db26
SHA512627315260afedd28c573c6794eff933074b0a5311edbbe544e95bf5cba1f5ac0f53a4593fb685841ae56ba03e8a30b37061f928e595f86da7d834684518257f1
-
C:\Users\Admin\AppData\Local\Temp\setuparguments.iniFilesize
602B
MD50f487fd09fff59906b744aff658b4c40
SHA19e5169fa51d706955abcc13225e4710d9a83ab20
SHA256631b70839ddd25cf621379e2c6474f16c0f5ef80bc0925d652f27bddb80c1451
SHA512f154c21ac2ee7c5ed8ecc08a4cdb1518f7722c18edbd444165fbcf5e8fc790c2ff97d04c6bb7df200b5db40c0b57c667dc3ac8de09fd7f688d41c98ef81b1722
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.datFilesize
40B
MD564b4aa6a099c05f8e76931484c81e4ec
SHA1d3987f86c24c460bc82bff84f93773b4e4b47c09
SHA2566e43d6181ea2fd2d03375ff48e91779156426575624af8ba52ff31127a059b42
SHA512d07fea5359b83c85edb940593f9d3785e6ce14f62407708e326bde013f013836b20b89baae2d35c53e4e9bbc95bf8ce458003f0e11e15ea2495408d902b3a451
-
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exeFilesize
2.7MB
MD51e39ebd9ac9163a5a428a3fd80b6986e
SHA1943e6c9fb3780fb064907b3ad6b3c3b6bb4a47a5
SHA2564e580bc172a325e018bc83e00d4d645977d02be450f62368d5e684d61f23db26
SHA512627315260afedd28c573c6794eff933074b0a5311edbbe544e95bf5cba1f5ac0f53a4593fb685841ae56ba03e8a30b37061f928e595f86da7d834684518257f1
-
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302061923451\assistant\_sfx.exeFilesize
1.7MB
MD50238df215bf6943892daf85de8ad433a
SHA13d905e4e2c0e9170df61b7a199321847691f945e
SHA256a7818aca6acbe347df13d51d9750f6a852c5aa2a58580f7f2015113e0a3e06d7
SHA512fc6c12e359b9a4ce84ef878f29648a4c97c38fd12ed80996c5e03829833220010fff9c751a99f399dad3529bda6438424194ed18236addfbe430343807aaad69
-
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302061923451\assistant\assistant_installer.exeFilesize
2.1MB
MD59df6e2fbb7e38964f35016bf91ef7424
SHA1d0c1266dc46814bc6165cf6a69e90581228989a7
SHA2563573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d
SHA512b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e
-
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302061923451\opera_packageFilesize
86.8MB
MD57f98c2aa3a2b1a46caf94752d2e73907
SHA1105b7b96c23d403008f603a1e3cc4c7162884fe3
SHA2568f85c61fe1ca76f4c8e2dcb5f51758de73c85d25817cfab70540fa193d3ee417
SHA51257f46f5af493f73472f7c664f12156cf8e18126a3f91e4c313d1ec185c78dad9301e09db38396cf811ada24eecd01b4b705384ca61da5f640c7ad38f3860b1e0
-
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302061923451\opera_packageFilesize
86.8MB
MD57f98c2aa3a2b1a46caf94752d2e73907
SHA1105b7b96c23d403008f603a1e3cc4c7162884fe3
SHA2568f85c61fe1ca76f4c8e2dcb5f51758de73c85d25817cfab70540fa193d3ee417
SHA51257f46f5af493f73472f7c664f12156cf8e18126a3f91e4c313d1ec185c78dad9301e09db38396cf811ada24eecd01b4b705384ca61da5f640c7ad38f3860b1e0
-
\Users\Admin\AppData\Local\Temp\Opera_installer_2302061923424981592.dllFilesize
4.6MB
MD5914ec7fb3d69e977440248ef30323636
SHA12aa31e599769f34d0cb6e979947ca5728db9b009
SHA256528117e7c698fbe7ad3036aef77f99ab8af74316def7a4ba60f738c40168c203
SHA512ff62901ffe79bbc8ffe6cce3efc8f13e71f13a41772b8d0180614b6ba80d5b9db1094a97cf3d239057dca2efdd7b0adc217f3ddce5111267c50ec9d0d1125b3a
-
\Users\Admin\AppData\Local\Temp\Opera_installer_230206192344370656.dllFilesize
4.6MB
MD5914ec7fb3d69e977440248ef30323636
SHA12aa31e599769f34d0cb6e979947ca5728db9b009
SHA256528117e7c698fbe7ad3036aef77f99ab8af74316def7a4ba60f738c40168c203
SHA512ff62901ffe79bbc8ffe6cce3efc8f13e71f13a41772b8d0180614b6ba80d5b9db1094a97cf3d239057dca2efdd7b0adc217f3ddce5111267c50ec9d0d1125b3a
-
\Users\Admin\AppData\Local\Temp\Opera_installer_2302061923452441084.dllFilesize
4.6MB
MD5914ec7fb3d69e977440248ef30323636
SHA12aa31e599769f34d0cb6e979947ca5728db9b009
SHA256528117e7c698fbe7ad3036aef77f99ab8af74316def7a4ba60f738c40168c203
SHA512ff62901ffe79bbc8ffe6cce3efc8f13e71f13a41772b8d0180614b6ba80d5b9db1094a97cf3d239057dca2efdd7b0adc217f3ddce5111267c50ec9d0d1125b3a
-
\Users\Admin\AppData\Local\Temp\Opera_installer_2302061923472871212.dllFilesize
4.6MB
MD5914ec7fb3d69e977440248ef30323636
SHA12aa31e599769f34d0cb6e979947ca5728db9b009
SHA256528117e7c698fbe7ad3036aef77f99ab8af74316def7a4ba60f738c40168c203
SHA512ff62901ffe79bbc8ffe6cce3efc8f13e71f13a41772b8d0180614b6ba80d5b9db1094a97cf3d239057dca2efdd7b0adc217f3ddce5111267c50ec9d0d1125b3a
-
\Users\Admin\AppData\Local\Temp\Opera_installer_2302061923488321028.dllFilesize
4.6MB
MD5914ec7fb3d69e977440248ef30323636
SHA12aa31e599769f34d0cb6e979947ca5728db9b009
SHA256528117e7c698fbe7ad3036aef77f99ab8af74316def7a4ba60f738c40168c203
SHA512ff62901ffe79bbc8ffe6cce3efc8f13e71f13a41772b8d0180614b6ba80d5b9db1094a97cf3d239057dca2efdd7b0adc217f3ddce5111267c50ec9d0d1125b3a
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exeFilesize
1.8MB
MD5aa4de04ccc16b74a4c2301da8d621ec1
SHA1d05c6d8200f6e6b1283df82d24d687adc47d9664
SHA256e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b
SHA51228d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exeFilesize
1.8MB
MD5aa4de04ccc16b74a4c2301da8d621ec1
SHA1d05c6d8200f6e6b1283df82d24d687adc47d9664
SHA256e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b
SHA51228d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exeFilesize
1.8MB
MD5aa4de04ccc16b74a4c2301da8d621ec1
SHA1d05c6d8200f6e6b1283df82d24d687adc47d9664
SHA256e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b
SHA51228d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exeFilesize
1.8MB
MD5aa4de04ccc16b74a4c2301da8d621ec1
SHA1d05c6d8200f6e6b1283df82d24d687adc47d9664
SHA256e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b
SHA51228d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exeFilesize
1.8MB
MD5aa4de04ccc16b74a4c2301da8d621ec1
SHA1d05c6d8200f6e6b1283df82d24d687adc47d9664
SHA256e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b
SHA51228d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exeFilesize
1.8MB
MD5aa4de04ccc16b74a4c2301da8d621ec1
SHA1d05c6d8200f6e6b1283df82d24d687adc47d9664
SHA256e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b
SHA51228d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmdFilesize
1.7MB
MD51bbf5dd0b6ca80e4c7c77495c3f33083
SHA1e0520037e60eb641ec04d1e814394c9da0a6a862
SHA256bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b
SHA51297bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmdFilesize
97KB
MD5da1d0cd400e0b6ad6415fd4d90f69666
SHA1de9083d2902906cacf57259cf581b1466400b799
SHA2567a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575
SHA512f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exeFilesize
1.3MB
MD57e08af319c9eb3297e09ca7bb8387de4
SHA14cf091f77a3eb9437ef33985e64bd10c1257284f
SHA2566c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8
SHA512bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exeFilesize
1.3MB
MD57e08af319c9eb3297e09ca7bb8387de4
SHA14cf091f77a3eb9437ef33985e64bd10c1257284f
SHA2566c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8
SHA512bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exeFilesize
1.3MB
MD57e08af319c9eb3297e09ca7bb8387de4
SHA14cf091f77a3eb9437ef33985e64bd10c1257284f
SHA2566c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8
SHA512bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exeFilesize
1.3MB
MD57e08af319c9eb3297e09ca7bb8387de4
SHA14cf091f77a3eb9437ef33985e64bd10c1257284f
SHA2566c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8
SHA512bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exeFilesize
1.3MB
MD57e08af319c9eb3297e09ca7bb8387de4
SHA14cf091f77a3eb9437ef33985e64bd10c1257284f
SHA2566c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8
SHA512bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dllFilesize
326KB
MD580d93d38badecdd2b134fe4699721223
SHA1e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA5129f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exeFilesize
1.3MB
MD5e801c5847f5f9d207db53aaaf5c6f3a2
SHA18e6818ce66555e2cca92e5c5f32551fb4a91645e
SHA256196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03
SHA512303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exeFilesize
1.3MB
MD5e801c5847f5f9d207db53aaaf5c6f3a2
SHA18e6818ce66555e2cca92e5c5f32551fb4a91645e
SHA256196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03
SHA512303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exeFilesize
1.3MB
MD5e801c5847f5f9d207db53aaaf5c6f3a2
SHA18e6818ce66555e2cca92e5c5f32551fb4a91645e
SHA256196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03
SHA512303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exeFilesize
1.3MB
MD5e801c5847f5f9d207db53aaaf5c6f3a2
SHA18e6818ce66555e2cca92e5c5f32551fb4a91645e
SHA256196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03
SHA512303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exeFilesize
1.3MB
MD5e801c5847f5f9d207db53aaaf5c6f3a2
SHA18e6818ce66555e2cca92e5c5f32551fb4a91645e
SHA256196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03
SHA512303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dllFilesize
326KB
MD580d93d38badecdd2b134fe4699721223
SHA1e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA5129f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4
-
\Users\Admin\AppData\Local\Temp\jre-windows.exeFilesize
84.5MB
MD57542ec421a2f6e90751e8b64c22e0542
SHA1d207d221a28ede5c2c8415f82c555989aa7068ba
SHA256188ca8ecc44de1b7f602e883c3054dc392792c3631bf362b1bc4f3e1dba323e6
SHA5128987bf8aa1b401815fa9850e56954db6015bdd06ce78b65ba435724582ffa615dee4e1452fa237c53257dca8ee97b469d01c27757a5f070ce6f807a4f81094bc
-
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exeFilesize
2.7MB
MD51e39ebd9ac9163a5a428a3fd80b6986e
SHA1943e6c9fb3780fb064907b3ad6b3c3b6bb4a47a5
SHA2564e580bc172a325e018bc83e00d4d645977d02be450f62368d5e684d61f23db26
SHA512627315260afedd28c573c6794eff933074b0a5311edbbe544e95bf5cba1f5ac0f53a4593fb685841ae56ba03e8a30b37061f928e595f86da7d834684518257f1
-
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exeFilesize
2.7MB
MD51e39ebd9ac9163a5a428a3fd80b6986e
SHA1943e6c9fb3780fb064907b3ad6b3c3b6bb4a47a5
SHA2564e580bc172a325e018bc83e00d4d645977d02be450f62368d5e684d61f23db26
SHA512627315260afedd28c573c6794eff933074b0a5311edbbe544e95bf5cba1f5ac0f53a4593fb685841ae56ba03e8a30b37061f928e595f86da7d834684518257f1
-
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exeFilesize
2.7MB
MD51e39ebd9ac9163a5a428a3fd80b6986e
SHA1943e6c9fb3780fb064907b3ad6b3c3b6bb4a47a5
SHA2564e580bc172a325e018bc83e00d4d645977d02be450f62368d5e684d61f23db26
SHA512627315260afedd28c573c6794eff933074b0a5311edbbe544e95bf5cba1f5ac0f53a4593fb685841ae56ba03e8a30b37061f928e595f86da7d834684518257f1
-
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exeFilesize
2.7MB
MD51e39ebd9ac9163a5a428a3fd80b6986e
SHA1943e6c9fb3780fb064907b3ad6b3c3b6bb4a47a5
SHA2564e580bc172a325e018bc83e00d4d645977d02be450f62368d5e684d61f23db26
SHA512627315260afedd28c573c6794eff933074b0a5311edbbe544e95bf5cba1f5ac0f53a4593fb685841ae56ba03e8a30b37061f928e595f86da7d834684518257f1
-
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exeFilesize
2.7MB
MD51e39ebd9ac9163a5a428a3fd80b6986e
SHA1943e6c9fb3780fb064907b3ad6b3c3b6bb4a47a5
SHA2564e580bc172a325e018bc83e00d4d645977d02be450f62368d5e684d61f23db26
SHA512627315260afedd28c573c6794eff933074b0a5311edbbe544e95bf5cba1f5ac0f53a4593fb685841ae56ba03e8a30b37061f928e595f86da7d834684518257f1
-
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exeFilesize
2.7MB
MD51e39ebd9ac9163a5a428a3fd80b6986e
SHA1943e6c9fb3780fb064907b3ad6b3c3b6bb4a47a5
SHA2564e580bc172a325e018bc83e00d4d645977d02be450f62368d5e684d61f23db26
SHA512627315260afedd28c573c6794eff933074b0a5311edbbe544e95bf5cba1f5ac0f53a4593fb685841ae56ba03e8a30b37061f928e595f86da7d834684518257f1
-
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exeFilesize
2.7MB
MD51e39ebd9ac9163a5a428a3fd80b6986e
SHA1943e6c9fb3780fb064907b3ad6b3c3b6bb4a47a5
SHA2564e580bc172a325e018bc83e00d4d645977d02be450f62368d5e684d61f23db26
SHA512627315260afedd28c573c6794eff933074b0a5311edbbe544e95bf5cba1f5ac0f53a4593fb685841ae56ba03e8a30b37061f928e595f86da7d834684518257f1
-
memory/656-119-0x0000000000400000-0x0000000000947000-memory.dmpFilesize
5.3MB
-
memory/656-199-0x0000000000400000-0x0000000000947000-memory.dmpFilesize
5.3MB
-
memory/656-114-0x0000000000000000-mapping.dmp
-
memory/816-266-0x0000000000000000-mapping.dmp
-
memory/824-277-0x0000000000000000-mapping.dmp
-
memory/992-280-0x0000000000000000-mapping.dmp
-
memory/1028-195-0x0000000000400000-0x0000000000947000-memory.dmpFilesize
5.3MB
-
memory/1028-136-0x0000000000000000-mapping.dmp
-
memory/1028-143-0x0000000000400000-0x0000000000947000-memory.dmpFilesize
5.3MB
-
memory/1084-121-0x0000000000000000-mapping.dmp
-
memory/1084-125-0x0000000000400000-0x0000000000947000-memory.dmpFilesize
5.3MB
-
memory/1084-162-0x0000000000000000-mapping.dmp
-
memory/1212-127-0x0000000000000000-mapping.dmp
-
memory/1212-194-0x0000000000400000-0x0000000000947000-memory.dmpFilesize
5.3MB
-
memory/1212-141-0x0000000000400000-0x0000000000947000-memory.dmpFilesize
5.3MB
-
memory/1212-142-0x0000000002900000-0x0000000002E47000-memory.dmpFilesize
5.3MB
-
memory/1244-168-0x000007FEFB7C1000-0x000007FEFB7C3000-memory.dmpFilesize
8KB
-
memory/1244-167-0x0000000000000000-mapping.dmp
-
memory/1252-59-0x0000000000000000-mapping.dmp
-
memory/1252-72-0x0000000000A80000-0x0000000000E68000-memory.dmpFilesize
3.9MB
-
memory/1252-282-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/1252-66-0x0000000000A80000-0x0000000000E68000-memory.dmpFilesize
3.9MB
-
memory/1252-70-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/1252-71-0x0000000000370000-0x000000000039C000-memory.dmpFilesize
176KB
-
memory/1252-81-0x0000000002B90000-0x0000000002BA0000-memory.dmpFilesize
64KB
-
memory/1508-54-0x0000000075991000-0x0000000075993000-memory.dmpFilesize
8KB
-
memory/1508-65-0x0000000002D00000-0x00000000030E8000-memory.dmpFilesize
3.9MB
-
memory/1508-64-0x0000000002D00000-0x00000000030E8000-memory.dmpFilesize
3.9MB
-
memory/1524-100-0x0000000000CA0000-0x0000000001088000-memory.dmpFilesize
3.9MB
-
memory/1524-108-0x0000000000CA0000-0x0000000001088000-memory.dmpFilesize
3.9MB
-
memory/1524-87-0x0000000000000000-mapping.dmp
-
memory/1568-165-0x0000000000000000-mapping.dmp
-
memory/1592-106-0x0000000000000000-mapping.dmp
-
memory/1592-197-0x0000000000400000-0x0000000000947000-memory.dmpFilesize
5.3MB
-
memory/1592-118-0x0000000002790000-0x0000000002CD7000-memory.dmpFilesize
5.3MB
-
memory/1592-139-0x0000000003750000-0x0000000003C97000-memory.dmpFilesize
5.3MB
-
memory/1592-110-0x0000000000400000-0x0000000000947000-memory.dmpFilesize
5.3MB
-
memory/1592-198-0x0000000002F10000-0x0000000002F12000-memory.dmpFilesize
8KB
-
memory/1592-148-0x0000000002790000-0x0000000002CD7000-memory.dmpFilesize
5.3MB
-
memory/1592-128-0x0000000002F10000-0x0000000003457000-memory.dmpFilesize
5.3MB
-
memory/1592-149-0x0000000002F10000-0x0000000003457000-memory.dmpFilesize
5.3MB
-
memory/1608-158-0x0000000000000000-mapping.dmp
-
memory/1616-210-0x0000000000000000-mapping.dmp
-
memory/1720-207-0x0000000000000000-mapping.dmp
-
memory/1780-153-0x0000000000000000-mapping.dmp
-
memory/1916-99-0x0000000002D40000-0x0000000003128000-memory.dmpFilesize
3.9MB
-
memory/1916-78-0x0000000000000000-mapping.dmp
-
memory/1916-96-0x0000000002D40000-0x0000000003128000-memory.dmpFilesize
3.9MB
-
memory/1916-97-0x0000000002D40000-0x0000000003128000-memory.dmpFilesize
3.9MB
-
memory/1916-98-0x0000000002D40000-0x0000000003128000-memory.dmpFilesize
3.9MB
-
memory/2228-219-0x0000000000000000-mapping.dmp
-
memory/2248-269-0x0000000000000000-mapping.dmp
-
memory/2292-265-0x0000000000000000-mapping.dmp
-
memory/2292-169-0x0000000000000000-mapping.dmp
-
memory/2324-171-0x0000000000000000-mapping.dmp
-
memory/2336-227-0x0000000000000000-mapping.dmp
-
memory/2356-272-0x0000000000000000-mapping.dmp
-
memory/2356-286-0x0000000000230000-0x0000000000247000-memory.dmpFilesize
92KB
-
memory/2356-285-0x0000000000230000-0x0000000000247000-memory.dmpFilesize
92KB
-
memory/2356-274-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2356-275-0x0000000000230000-0x0000000000247000-memory.dmpFilesize
92KB
-
memory/2356-276-0x0000000000230000-0x0000000000247000-memory.dmpFilesize
92KB
-
memory/2356-284-0x0000000000230000-0x0000000000247000-memory.dmpFilesize
92KB
-
memory/2356-283-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2364-278-0x0000000000000000-mapping.dmp
-
memory/2452-271-0x0000000000000000-mapping.dmp
-
memory/2488-174-0x0000000000000000-mapping.dmp
-
memory/2532-196-0x0000000002590000-0x00000000025A0000-memory.dmpFilesize
64KB
-
memory/2532-176-0x0000000000000000-mapping.dmp
-
memory/2548-177-0x0000000000000000-mapping.dmp
-
memory/2908-200-0x0000000000000000-mapping.dmp
-
memory/3052-226-0x0000000000000000-mapping.dmp