Overview

overview

10

Static

static

1

TLauncher-...al.exe

windows7-x64

10

TLauncher-...al.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    135s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    14/02/2023, 20:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    TLauncher-2.871-Installer-1.0.6-global.exe

  • Size

    23.6MB

  • MD5

    7a4472a78d0651e11d20aa08e43cc045

  • SHA1

    aab1d5f80d7399ae2c1982201733be7681d100b1

  • SHA256

    318df7404e6c4d5538a6d31997b95af52bbb8d40caf5553b3cbd9b1bc4f6db96

  • SHA512

    c152c9d21b0615548173dcc61accb1a1afd5b6f98e6ec21f6a7119536397f07a54ad4087669716c3344dd338ce4f24cecf9989d472f65eaa18c87d496f23c681

  • SSDEEP

    393216:gXQLpnUN/n8IPfs/dQETVlOBbpFEj9GZ1GphRqV56Hpk7IXOzDnKI17fyVS:ggLFUp8aHExiTI3qqHp6zvKcfyVS

Score
10/10
bazarbackdooradwarebackdoordiscoverypersistencespywarestealerupx

Malware Config

Signatures

  • BazarBackdoor

    Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

    backdoorbazarbackdoor
  • Bazar/Team9 Backdoor payload 5 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 40 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Registers COM server for autorun 1 TTPs 64 IoCs
    persistence
  • UPX packed file 40 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 27 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 6 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 7 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2004
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe" "__IRCT:3" "__IRTSS:24771453" "__IRSID:S-1-5-21-3845472200-3839195424-595303356-1000"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1884
      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
        "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:828
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816850 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" "__IRCT:3" "__IRTSS:1840872" "__IRSID:S-1-5-21-3845472200-3839195424-595303356-1000"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies system certificate store
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1508
          • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
            "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Enumerates connected drives
            • Modifies system certificate store
            • Suspicious use of WriteProcessMemory
            PID:1620
            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=95.0.4635.37 --initial-client-data=0x1a4,0x1a8,0x1ac,0x178,0x1b0,0x70a6e428,0x70a6e438,0x70a6e444
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1256
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe" --version
              6⤵
                PID:1956
              • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --pin-additional-shortcuts=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=1620 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20230214214718" --session-guid=548bbfa7-5dd3-4b38-aec1-944262167803 --server-tracking-blob=MDg3M2I0MTllMDgyYmRhYmNjZGY5NzA4NzVkNThlMThhM2IyMTBhZTdhNzNjNjBmNDQyOTI5NDA1M2NhNzVmYjp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInRpbWVzdGFtcCI6IjE2NzY0MDc2MzQuMDM5OSIsInVzZXJhZ2VudCI6IlNldHVwIEZhY3RvcnkgOS4wIiwidXRtIjp7ImNhbXBhaWduIjoiT3BlcmFEZXNrdG9wIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiTVNUTCJ9LCJ1dWlkIjoiMjJkZDg5YWUtZmZjZC00OGVkLTk1NGUtMzAzZjk4NzRmNTVmIn0= --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=2C03000000000000
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates connected drives
                • Suspicious use of WriteProcessMemory
                PID:760
                • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                  C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=95.0.4635.37 --initial-client-data=0x1b0,0x1b4,0x1b8,0x178,0x1bc,0x6ffee428,0x6ffee438,0x6ffee444
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:1304
                • C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.37\installer.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.37\installer.exe" --backend --initial-pid=1620 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --pin-additional-shortcuts=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302142147181" --session-guid=548bbfa7-5dd3-4b38-aec1-944262167803 --server-tracking-blob=MDg3M2I0MTllMDgyYmRhYmNjZGY5NzA4NzVkNThlMThhM2IyMTBhZTdhNzNjNjBmNDQyOTI5NDA1M2NhNzVmYjp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInRpbWVzdGFtcCI6IjE2NzY0MDc2MzQuMDM5OSIsInVzZXJhZ2VudCI6IlNldHVwIEZhY3RvcnkgOS4wIiwidXRtIjp7ImNhbXBhaWduIjoiT3BlcmFEZXNrdG9wIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiTVNUTCJ9LCJ1dWlkIjoiMjJkZDg5YWUtZmZjZC00OGVkLTk1NGUtMzAzZjk4NzRmNTVmIn0= --silent --desktopshortcut=1 --install-subfolder=95.0.4635.37
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Enumerates connected drives
                  • Modifies registry class
                  PID:2120
                  • C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.37\installer.exe
                    C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.37\installer.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=95.0.4635.37 --initial-client-data=0x174,0x178,0x17c,0x148,0x180,0x7fef39da908,0x7fef39da918,0x7fef39da928
                    8⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:2140
                  • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe" --start-maximized
                    8⤵
                    • Executes dropped EXE
                    PID:2260
                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --start-maximized --ran-launcher
                      9⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:2300
                      • C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.37\opera_crashreporter.exe
                        C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.37\opera_crashreporter.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=95.0.4635.37 --initial-client-data=0x15c,0x160,0x164,0x130,0x168,0x7feede43a18,0x7feede43a28,0x7feede43a38
                        10⤵
                        • Executes dropped EXE
                        PID:2336
                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1140 --field-trial-handle=1200,i,1033993494890629165,11001720139094151025,131072 /prefetch:2
                        10⤵
                        • Executes dropped EXE
                        PID:2480
                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=1356 --field-trial-handle=1200,i,1033993494890629165,11001720139094151025,131072 /prefetch:8
                        10⤵
                        • Executes dropped EXE
                        PID:2624
              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302142147181\assistant\_sfx.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302142147181\assistant\_sfx.exe"
                6⤵
                • Executes dropped EXE
                PID:1312
              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302142147181\assistant\assistant_installer.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302142147181\assistant\assistant_installer.exe" --version
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:832
                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302142147181\assistant\assistant_installer.exe
                  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302142147181\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x148,0x14c,0x150,0x11c,0x154,0x1222dc0,0x1222dd0,0x1222ddc
                  7⤵
                    PID:1984
          • C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
            "C:\Users\Admin\AppData\Local\Temp\jre-windows.exe" STATIC=1
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:668
            • C:\Users\Admin\AppData\Local\Temp\jds7144736.tmp\jre-windows.exe
              "C:\Users\Admin\AppData\Local\Temp\jds7144736.tmp\jre-windows.exe" "STATIC=1"
              4⤵
              • Executes dropped EXE
              • Modifies Internet Explorer settings
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:1580
      • C:\Windows\system32\DllHost.exe
        C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1956
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Enumerates connected drives
        • Drops file in Windows directory
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:1980
        • C:\Windows\system32\MsiExec.exe
          C:\Windows\system32\MsiExec.exe -Embedding 8E31CFDFDF4ED01BF3DC2922B1D05985
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1984
        • C:\Program Files\Java\jre1.8.0_351\installer.exe
          "C:\Program Files\Java\jre1.8.0_351\installer.exe" /s INSTALLDIR="C:\Program Files\Java\jre1.8.0_351\\" STATIC=1 INSTALL_SILENT=1 REPAIRMODE=0 ProductCode={26A24AE4-039D-4CA4-87B4-2F64180351F0}
          2⤵
          • Executes dropped EXE
          • Registers COM server for autorun
          • Installs/modifies Browser Helper Object
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Modifies Internet Explorer settings
          • Modifies data under HKEY_USERS
          • Modifies registry class
          PID:1896
          • C:\ProgramData\Oracle\Java\installcache_x64\7190086.tmp\bspatch.exe
            "bspatch.exe" baseimagefam8 newimage diff
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1412
          • C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
            "C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/plugin.pack" "C:\Program Files\Java\jre1.8.0_351\lib/plugin.jar"
            3⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            PID:2964
          • C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
            "C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/javaws.pack" "C:\Program Files\Java\jre1.8.0_351\lib/javaws.jar"
            3⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            PID:3012
          • C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
            "C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/deploy.pack" "C:\Program Files\Java\jre1.8.0_351\lib/deploy.jar"
            3⤵
            • Executes dropped EXE
            PID:3044
          • C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
            "C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/rt.pack" "C:\Program Files\Java\jre1.8.0_351\lib/rt.jar"
            3⤵
            • Executes dropped EXE
            PID:3068
          • C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
            "C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/jsse.pack" "C:\Program Files\Java\jre1.8.0_351\lib/jsse.jar"
            3⤵
            • Executes dropped EXE
            PID:2152
          • C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
            "C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/charsets.pack" "C:\Program Files\Java\jre1.8.0_351\lib/charsets.jar"
            3⤵
            • Executes dropped EXE
            PID:2308
          • C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
            "C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/ext/localedata.pack" "C:\Program Files\Java\jre1.8.0_351\lib/ext/localedata.jar"
            3⤵
            • Executes dropped EXE
            PID:2276
          • C:\Program Files\Java\jre1.8.0_351\bin\javaw.exe
            "C:\Program Files\Java\jre1.8.0_351\bin\javaw.exe" -Xshare:dump -Djdk.disableLastUsageTracking
            3⤵
            • Executes dropped EXE
            PID:2520
          • C:\Program Files\Java\jre1.8.0_351\bin\ssvagent.exe
            "C:\Program Files\Java\jre1.8.0_351\bin\ssvagent.exe" -doHKCUSSVSetup
            3⤵
              PID:2176
            • C:\Program Files\Java\jre1.8.0_351\bin\javaws.exe
              "C:\Program Files\Java\jre1.8.0_351\bin\javaws.exe" -wait -fix -permissions -silent
              3⤵
                PID:1176
                • C:\Program Files\Java\jre1.8.0_351\bin\jp2launcher.exe
                  "C:\Program Files\Java\jre1.8.0_351\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre1.8.0_351" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzM1MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF8zNTFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzM1MVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==
                  4⤵
                    PID:2656
            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --start-maximized --ran-launcher --flag-switches-begin --flag-switches-end --enable-quic --lowered-browser
              1⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in Program Files directory
              • Enumerates system info in registry
              • Suspicious behavior: EnumeratesProcesses
              PID:2748
              • C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.37\opera_crashreporter.exe
                C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.37\opera_crashreporter.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=95.0.4635.37 --initial-client-data=0x15c,0x160,0x164,0x130,0x168,0x7feede43a18,0x7feede43a28,0x7feede43a38
                2⤵
                • Executes dropped EXE
                PID:2776
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=976 --field-trial-handle=1188,i,2072262293552240,12824201545356568099,131072 /prefetch:2
                2⤵
                • Executes dropped EXE
                PID:2928
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=1296 --field-trial-handle=1188,i,2072262293552240,12824201545356568099,131072 /prefetch:8
                2⤵
                • Executes dropped EXE
                PID:2116
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=1380 --field-trial-handle=1188,i,2072262293552240,12824201545356568099,131072 /prefetch:8
                2⤵
                • Executes dropped EXE
                PID:972
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=1960 --field-trial-handle=1188,i,2072262293552240,12824201545356568099,131072 /prefetch:8
                2⤵
                • Executes dropped EXE
                PID:2488
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=1972 --field-trial-handle=1188,i,2072262293552240,12824201545356568099,131072 /prefetch:8
                2⤵
                  PID:2264
                • C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.37\opera_autoupdate.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.37\opera_autoupdate.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" --pipeid=oauc_pipe2906202b27b41e4bd66c9238c4b575c1
                  2⤵
                  • Executes dropped EXE
                  PID:2760
                  • C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.37\opera_autoupdate.exe
                    C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.37\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=95.0.4635.37 --initial-client-data=0x138,0x13c,0x140,0x10c,0x144,0x13fbdcbd8,0x13fbdcbe8,0x13fbdcbf8
                    3⤵
                    • Executes dropped EXE
                    PID:2640
              • C:\Windows\system32\taskeng.exe
                taskeng.exe {BCDC2015-BDC1-4176-A205-851E5CC82A29} S-1-5-21-3845472200-3839195424-595303356-1000:ZERMMMDR\Admin:Interactive:[1]
                1⤵
                  PID:2536
                  • C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
                    C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe --scheduledautoupdate --autoupdaterequesttype=automatic --autoupdateoperaversion=95.0.4635.37 --newautoupdaterlogic
                    2⤵
                    • Executes dropped EXE
                    PID:2392
                    • C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe
                      "C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe" --version
                      3⤵
                      • Executes dropped EXE
                      PID:2864

                Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
                        Filesize

                        471B

                        MD5

                        497c3126e55ba8d8e842c593df16613d

                        SHA1

                        b5df43f4628f4d6b590989156886b1d6f1661bb0

                        SHA256

                        f680dd7002c4436b0ba3cb137520f6c2431f00d8a199ad3be9fb665cd8e1b1cd

                        SHA512

                        bf64e8541c7ef354153249525f81a3b1c6f792f00c3ef03b5dcfe60226d5094c7ac292076174df801d9b2cd3ae6daa6f20177996c55106a8adec41fbb4773a63

                        Download Submit

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
                        Filesize

                        471B

                        MD5

                        d959e2a5ced2c5a8b0729f8a958f76a0

                        SHA1

                        349caaf452ccebb42559b42960f863af535c9f84

                        SHA256

                        a9287c0df7edc85a7b498939804990d2ce78db5f8014ef252d2c7cc48f5bd8ec

                        SHA512

                        16ec4a49a9a961ada5607ae567e0d65c3002a8578371a45c55f0f137b52b2fff6382f9a3be0199a1732c6d0d8bae5a6a82df7a63ea9790cc6fea50bdd97f7767

                        Download Submit

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
                        Filesize

                        1KB

                        MD5

                        a266bb7dcc38a562631361bbf61dd11b

                        SHA1

                        3b1efd3a66ea28b16697394703a72ca340a05bd5

                        SHA256

                        df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

                        SHA512

                        0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

                        Download Submit

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                        Filesize

                        340B

                        MD5

                        d81885b1831b920c3e026ce3e89227ee

                        SHA1

                        9557ea93a830684d672d79f65c9568454dccf1c0

                        SHA256

                        c6c6704e91cc4f28b7280494b3bb0803749ac37dbd29e3c6fa71985ab66cb80a

                        SHA512

                        668bc76eb693a599fe9557ebefc2e3625a5589a0c0444150e7ec6317b434cc72ca01b92d00d4f3e284d0e74392825dbbfb7b7b9e229381e917f5a9e75d5def4f

                        Download Submit

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
                        Filesize

                        430B

                        MD5

                        d3d61f7a8d12675cf265616589fd74d6

                        SHA1

                        72c3162a02accbe908e5249da621c4b154172db9

                        SHA256

                        92fe55211c0f8bc50f1fc59d078418a08a7b30e803d5cedb9544fd8c41e41c8f

                        SHA512

                        119ccceca4ee5d4661a638baaef5bc934b05630f09dc61fab8b73b4efae7417e5667237067d5d4b8a81bcf9829a80e53dea8d6063a6d0899253d1aa9baa4fed8

                        Download Submit

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
                        Filesize

                        404B

                        MD5

                        227529a6807fe69a39e1fef124ba6103

                        SHA1

                        dc475fd53c53c27274de5027a8d58198cdcc53e8

                        SHA256

                        1dad53192e5205369af1a0dde34c61b831f160356b2941531a41a155234c4244

                        SHA512

                        cb96fb7e643ef66f254cc7972482207d9e416037593bad68fe883de63e7b60aeb1bfda30d4b0bafedf872986472474f5df8421570a2a9b35a9ed869d372dc1eb

                        Download Submit

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
                        Filesize

                        242B

                        MD5

                        c8a16ff28cec687851b2a194af596fbd

                        SHA1

                        2f728e36d888516825fc349aab3f74df4b70107a

                        SHA256

                        30d18ce049d5cd08c4e25574986d45afd4213fc3fe128e9b8a71a149c5097957

                        SHA512

                        7ccf2d63dbb7f8cc1aea865dc8af4310be091b7202bcd4866b7a4fa790a0012697cf0969e19b0e5c1ee42427dff241579596bfd8b2d0b761123689a9713655f2

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
                        Filesize

                        2.7MB

                        MD5

                        f86fcef75c50f2244ea5969e7e6d0e34

                        SHA1

                        23d81eea714210ab78580dcc4c2500b19bc400ff

                        SHA256

                        9eda02d2e1209609f5cf3b717f92f99c47a7e8901547fef1f04aa0e054831bb1

                        SHA512

                        82346f59d8d8c5c7348d005c335823351cb9d26240bfb4ad0b10974cbf1fd895b16dbc003b7e3cd18bb55f02cbf7c46f2ae30cb5d68bdebe65f73dbd12ca042e

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                        Filesize

                        1.8MB

                        MD5

                        aa4de04ccc16b74a4c2301da8d621ec1

                        SHA1

                        d05c6d8200f6e6b1283df82d24d687adc47d9664

                        SHA256

                        e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

                        SHA512

                        28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                        Filesize

                        1.8MB

                        MD5

                        aa4de04ccc16b74a4c2301da8d621ec1

                        SHA1

                        d05c6d8200f6e6b1283df82d24d687adc47d9664

                        SHA256

                        e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

                        SHA512

                        28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                        Filesize

                        1.3MB

                        MD5

                        7e08af319c9eb3297e09ca7bb8387de4

                        SHA1

                        4cf091f77a3eb9437ef33985e64bd10c1257284f

                        SHA256

                        6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

                        SHA512

                        bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                        Filesize

                        1.3MB

                        MD5

                        7e08af319c9eb3297e09ca7bb8387de4

                        SHA1

                        4cf091f77a3eb9437ef33985e64bd10c1257284f

                        SHA256

                        6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

                        SHA512

                        bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
                        Filesize

                        326KB

                        MD5

                        80d93d38badecdd2b134fe4699721223

                        SHA1

                        e829e58091bae93bc64e0c6f9f0bac999cfda23d

                        SHA256

                        c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                        SHA512

                        9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                        Filesize

                        1.3MB

                        MD5

                        e801c5847f5f9d207db53aaaf5c6f3a2

                        SHA1

                        8e6818ce66555e2cca92e5c5f32551fb4a91645e

                        SHA256

                        196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

                        SHA512

                        303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                        Filesize

                        1.3MB

                        MD5

                        e801c5847f5f9d207db53aaaf5c6f3a2

                        SHA1

                        8e6818ce66555e2cca92e5c5f32551fb4a91645e

                        SHA256

                        196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

                        SHA512

                        303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
                        Filesize

                        326KB

                        MD5

                        80d93d38badecdd2b134fe4699721223

                        SHA1

                        e829e58091bae93bc64e0c6f9f0bac999cfda23d

                        SHA256

                        c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                        SHA512

                        9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\jds7144736.tmp\jre-windows.exe
                        Filesize

                        84.1MB

                        MD5

                        dfcfc788d67437530a50177164db42b0

                        SHA1

                        2d9ed0dc5671a358186dcf83abb74bfe39c40e9f

                        SHA256

                        a90318bae7d99da633d9cac8ce322120d087e7b6f5eec0d1d0d7f9413fdd4dc1

                        SHA512

                        dbdfd02528c9f0e506232e8640a8602fade0d05f4139368187300ea2d537e41d2d167655ded30d938bd445a21c776a3c3721f8db4d3f03e3c06807a84cf232e3

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\jds7144736.tmp\jre-windows.exe
                        Filesize

                        84.1MB

                        MD5

                        dfcfc788d67437530a50177164db42b0

                        SHA1

                        2d9ed0dc5671a358186dcf83abb74bfe39c40e9f

                        SHA256

                        a90318bae7d99da633d9cac8ce322120d087e7b6f5eec0d1d0d7f9413fdd4dc1

                        SHA512

                        dbdfd02528c9f0e506232e8640a8602fade0d05f4139368187300ea2d537e41d2d167655ded30d938bd445a21c776a3c3721f8db4d3f03e3c06807a84cf232e3

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
                        Filesize

                        84.5MB

                        MD5

                        7542ec421a2f6e90751e8b64c22e0542

                        SHA1

                        d207d221a28ede5c2c8415f82c555989aa7068ba

                        SHA256

                        188ca8ecc44de1b7f602e883c3054dc392792c3631bf362b1bc4f3e1dba323e6

                        SHA512

                        8987bf8aa1b401815fa9850e56954db6015bdd06ce78b65ba435724582ffa615dee4e1452fa237c53257dca8ee97b469d01c27757a5f070ce6f807a4f81094bc

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\jusched.log
                        Filesize

                        4KB

                        MD5

                        6d5a87a5ccc34ea2b69a4396d5d4b5ea

                        SHA1

                        24991168b1d712b3dd0839210a423172b707dd4f

                        SHA256

                        d1039ec665fd3e2de8b012b3ec44aeaad3906311be30e7d56182dd2716167ea9

                        SHA512

                        08a26c26ceab4a6218f7e11963b8e95e1391ed7485c096980c5628611d34a0e73d859bf0e5b26f5453835e12840390c674dd1eaecc6548c91320e6083fdc6ebc

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                        Filesize

                        2.7MB

                        MD5

                        f86fcef75c50f2244ea5969e7e6d0e34

                        SHA1

                        23d81eea714210ab78580dcc4c2500b19bc400ff

                        SHA256

                        9eda02d2e1209609f5cf3b717f92f99c47a7e8901547fef1f04aa0e054831bb1

                        SHA512

                        82346f59d8d8c5c7348d005c335823351cb9d26240bfb4ad0b10974cbf1fd895b16dbc003b7e3cd18bb55f02cbf7c46f2ae30cb5d68bdebe65f73dbd12ca042e

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                        Filesize

                        2.7MB

                        MD5

                        f86fcef75c50f2244ea5969e7e6d0e34

                        SHA1

                        23d81eea714210ab78580dcc4c2500b19bc400ff

                        SHA256

                        9eda02d2e1209609f5cf3b717f92f99c47a7e8901547fef1f04aa0e054831bb1

                        SHA512

                        82346f59d8d8c5c7348d005c335823351cb9d26240bfb4ad0b10974cbf1fd895b16dbc003b7e3cd18bb55f02cbf7c46f2ae30cb5d68bdebe65f73dbd12ca042e

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                        Filesize

                        2.7MB

                        MD5

                        f86fcef75c50f2244ea5969e7e6d0e34

                        SHA1

                        23d81eea714210ab78580dcc4c2500b19bc400ff

                        SHA256

                        9eda02d2e1209609f5cf3b717f92f99c47a7e8901547fef1f04aa0e054831bb1

                        SHA512

                        82346f59d8d8c5c7348d005c335823351cb9d26240bfb4ad0b10974cbf1fd895b16dbc003b7e3cd18bb55f02cbf7c46f2ae30cb5d68bdebe65f73dbd12ca042e

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                        Filesize

                        2.7MB

                        MD5

                        f86fcef75c50f2244ea5969e7e6d0e34

                        SHA1

                        23d81eea714210ab78580dcc4c2500b19bc400ff

                        SHA256

                        9eda02d2e1209609f5cf3b717f92f99c47a7e8901547fef1f04aa0e054831bb1

                        SHA512

                        82346f59d8d8c5c7348d005c335823351cb9d26240bfb4ad0b10974cbf1fd895b16dbc003b7e3cd18bb55f02cbf7c46f2ae30cb5d68bdebe65f73dbd12ca042e

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                        Filesize

                        2.7MB

                        MD5

                        f86fcef75c50f2244ea5969e7e6d0e34

                        SHA1

                        23d81eea714210ab78580dcc4c2500b19bc400ff

                        SHA256

                        9eda02d2e1209609f5cf3b717f92f99c47a7e8901547fef1f04aa0e054831bb1

                        SHA512

                        82346f59d8d8c5c7348d005c335823351cb9d26240bfb4ad0b10974cbf1fd895b16dbc003b7e3cd18bb55f02cbf7c46f2ae30cb5d68bdebe65f73dbd12ca042e

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
                        Filesize

                        602B

                        MD5

                        74791b1340beefa4b3ed3a4fc4442ff3

                        SHA1

                        5b07e38767950d31732f2e0fbed01723008dc137

                        SHA256

                        d1a1d15ffe7df7546def3525a612c17758222166c1cde3b7dce3df422a5c4178

                        SHA512

                        70fe75b8e0e7127a249248ebf221c6b575328d211e2a86b92a94ddd5159dddbf733c627d2da37f5ef0714ec924e548746eb1827f15995e5f5ed3a43ff750fdf5

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\3PKN6O76.txt
                        Filesize

                        869B

                        MD5

                        bfb1565ed5c7a6ae59644545813cf73c

                        SHA1

                        97fe471d59c3ff18467af103ef809796d8b9b2c3

                        SHA256

                        c187ea11c2338a24a61e5c1679fc185a088632fcde54a8815b635362993831b8

                        SHA512

                        4868ab5b38369dbd543f8c048a121477b1c270ecb672e3822122047d193c8128640401a1657779a981d2e97a0edbd992db4c45a8924c612018b3c8a646b9ae68

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
                        Filesize

                        40B

                        MD5

                        4937ada676ef61cf859c213e9886b520

                        SHA1

                        104df83c959240cca8ff03676374844e818842a1

                        SHA256

                        ecd253bda38461ad8f4010d52c2ae7db0d58ccd62f6fd3f561b574138862dcf7

                        SHA512

                        1c99d56ce95155e9f526baad23d5b66393aadd6246951a113bff8fc1f25c1d3667c0988a535d57cdeccc33f34a2e3e12468920bde464ab6b3ab4fea46f236c7d

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
                        Filesize

                        2.7MB

                        MD5

                        f86fcef75c50f2244ea5969e7e6d0e34

                        SHA1

                        23d81eea714210ab78580dcc4c2500b19bc400ff

                        SHA256

                        9eda02d2e1209609f5cf3b717f92f99c47a7e8901547fef1f04aa0e054831bb1

                        SHA512

                        82346f59d8d8c5c7348d005c335823351cb9d26240bfb4ad0b10974cbf1fd895b16dbc003b7e3cd18bb55f02cbf7c46f2ae30cb5d68bdebe65f73dbd12ca042e

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302142147181\opera_package
                        Filesize

                        86.8MB

                        MD5

                        d952728a4ce9fa6fd1df1e71f2cdad79

                        SHA1

                        62a0cdac813c83cea2f5a406a6940982f33d839a

                        SHA256

                        f115d42f06f27045cf1cf04bbfa4591789547ddb3614be6c912fa75bd4eb4cb6

                        SHA512

                        8720da841a9d31832b943fb56271e3efcb05520d0d5506a5ce823d8d5e909ebafd796d3d2b8afd82e2479329b84ee1813de5380598a7271ca9d5b64a2d3b4534

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\Opera_installer_2302142147152981620.dll
                        Filesize

                        4.6MB

                        MD5

                        5ff9275c5cee292fff9034f03bd847e1

                        SHA1

                        37bf88e062278882492823c7039b7cf374756ae0

                        SHA256

                        2309501e723a011f4bf2b505e178cbb97af4d798a8720d344f2730c4d756ee08

                        SHA512

                        f58e5981e25cd6cdd5edb9d9974f137615dee7516d221bf0df08a7425ec68361f29d7b5ca1b835c476fcbcee0df4a028bfa5308867fb3976aaba67cbf8b8dd02

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\Opera_installer_2302142147160471256.dll
                        Filesize

                        4.6MB

                        MD5

                        5ff9275c5cee292fff9034f03bd847e1

                        SHA1

                        37bf88e062278882492823c7039b7cf374756ae0

                        SHA256

                        2309501e723a011f4bf2b505e178cbb97af4d798a8720d344f2730c4d756ee08

                        SHA512

                        f58e5981e25cd6cdd5edb9d9974f137615dee7516d221bf0df08a7425ec68361f29d7b5ca1b835c476fcbcee0df4a028bfa5308867fb3976aaba67cbf8b8dd02

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\Opera_installer_2302142147179651956.dll
                        Filesize

                        4.6MB

                        MD5

                        5ff9275c5cee292fff9034f03bd847e1

                        SHA1

                        37bf88e062278882492823c7039b7cf374756ae0

                        SHA256

                        2309501e723a011f4bf2b505e178cbb97af4d798a8720d344f2730c4d756ee08

                        SHA512

                        f58e5981e25cd6cdd5edb9d9974f137615dee7516d221bf0df08a7425ec68361f29d7b5ca1b835c476fcbcee0df4a028bfa5308867fb3976aaba67cbf8b8dd02

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\Opera_installer_230214214719260760.dll
                        Filesize

                        4.6MB

                        MD5

                        5ff9275c5cee292fff9034f03bd847e1

                        SHA1

                        37bf88e062278882492823c7039b7cf374756ae0

                        SHA256

                        2309501e723a011f4bf2b505e178cbb97af4d798a8720d344f2730c4d756ee08

                        SHA512

                        f58e5981e25cd6cdd5edb9d9974f137615dee7516d221bf0df08a7425ec68361f29d7b5ca1b835c476fcbcee0df4a028bfa5308867fb3976aaba67cbf8b8dd02

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\Opera_installer_2302142147206021304.dll
                        Filesize

                        4.6MB

                        MD5

                        5ff9275c5cee292fff9034f03bd847e1

                        SHA1

                        37bf88e062278882492823c7039b7cf374756ae0

                        SHA256

                        2309501e723a011f4bf2b505e178cbb97af4d798a8720d344f2730c4d756ee08

                        SHA512

                        f58e5981e25cd6cdd5edb9d9974f137615dee7516d221bf0df08a7425ec68361f29d7b5ca1b835c476fcbcee0df4a028bfa5308867fb3976aaba67cbf8b8dd02

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                        Filesize

                        1.8MB

                        MD5

                        aa4de04ccc16b74a4c2301da8d621ec1

                        SHA1

                        d05c6d8200f6e6b1283df82d24d687adc47d9664

                        SHA256

                        e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

                        SHA512

                        28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                        Filesize

                        1.8MB

                        MD5

                        aa4de04ccc16b74a4c2301da8d621ec1

                        SHA1

                        d05c6d8200f6e6b1283df82d24d687adc47d9664

                        SHA256

                        e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

                        SHA512

                        28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                        Filesize

                        1.8MB

                        MD5

                        aa4de04ccc16b74a4c2301da8d621ec1

                        SHA1

                        d05c6d8200f6e6b1283df82d24d687adc47d9664

                        SHA256

                        e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

                        SHA512

                        28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                        Filesize

                        1.8MB

                        MD5

                        aa4de04ccc16b74a4c2301da8d621ec1

                        SHA1

                        d05c6d8200f6e6b1283df82d24d687adc47d9664

                        SHA256

                        e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

                        SHA512

                        28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                        Filesize

                        1.8MB

                        MD5

                        aa4de04ccc16b74a4c2301da8d621ec1

                        SHA1

                        d05c6d8200f6e6b1283df82d24d687adc47d9664

                        SHA256

                        e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

                        SHA512

                        28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
                        Filesize

                        1.8MB

                        MD5

                        aa4de04ccc16b74a4c2301da8d621ec1

                        SHA1

                        d05c6d8200f6e6b1283df82d24d687adc47d9664

                        SHA256

                        e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

                        SHA512

                        28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
                        Filesize

                        1.7MB

                        MD5

                        1bbf5dd0b6ca80e4c7c77495c3f33083

                        SHA1

                        e0520037e60eb641ec04d1e814394c9da0a6a862

                        SHA256

                        bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

                        SHA512

                        97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
                        Filesize

                        97KB

                        MD5

                        da1d0cd400e0b6ad6415fd4d90f69666

                        SHA1

                        de9083d2902906cacf57259cf581b1466400b799

                        SHA256

                        7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

                        SHA512

                        f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                        Filesize

                        1.3MB

                        MD5

                        7e08af319c9eb3297e09ca7bb8387de4

                        SHA1

                        4cf091f77a3eb9437ef33985e64bd10c1257284f

                        SHA256

                        6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

                        SHA512

                        bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                        Filesize

                        1.3MB

                        MD5

                        7e08af319c9eb3297e09ca7bb8387de4

                        SHA1

                        4cf091f77a3eb9437ef33985e64bd10c1257284f

                        SHA256

                        6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

                        SHA512

                        bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                        Filesize

                        1.3MB

                        MD5

                        7e08af319c9eb3297e09ca7bb8387de4

                        SHA1

                        4cf091f77a3eb9437ef33985e64bd10c1257284f

                        SHA256

                        6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

                        SHA512

                        bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                        Filesize

                        1.3MB

                        MD5

                        7e08af319c9eb3297e09ca7bb8387de4

                        SHA1

                        4cf091f77a3eb9437ef33985e64bd10c1257284f

                        SHA256

                        6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

                        SHA512

                        bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                        Filesize

                        1.3MB

                        MD5

                        7e08af319c9eb3297e09ca7bb8387de4

                        SHA1

                        4cf091f77a3eb9437ef33985e64bd10c1257284f

                        SHA256

                        6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

                        SHA512

                        bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
                        Filesize

                        326KB

                        MD5

                        80d93d38badecdd2b134fe4699721223

                        SHA1

                        e829e58091bae93bc64e0c6f9f0bac999cfda23d

                        SHA256

                        c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                        SHA512

                        9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                        Filesize

                        1.3MB

                        MD5

                        e801c5847f5f9d207db53aaaf5c6f3a2

                        SHA1

                        8e6818ce66555e2cca92e5c5f32551fb4a91645e

                        SHA256

                        196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

                        SHA512

                        303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                        Filesize

                        1.3MB

                        MD5

                        e801c5847f5f9d207db53aaaf5c6f3a2

                        SHA1

                        8e6818ce66555e2cca92e5c5f32551fb4a91645e

                        SHA256

                        196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

                        SHA512

                        303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                        Filesize

                        1.3MB

                        MD5

                        e801c5847f5f9d207db53aaaf5c6f3a2

                        SHA1

                        8e6818ce66555e2cca92e5c5f32551fb4a91645e

                        SHA256

                        196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

                        SHA512

                        303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                        Filesize

                        1.3MB

                        MD5

                        e801c5847f5f9d207db53aaaf5c6f3a2

                        SHA1

                        8e6818ce66555e2cca92e5c5f32551fb4a91645e

                        SHA256

                        196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

                        SHA512

                        303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                        Filesize

                        1.3MB

                        MD5

                        e801c5847f5f9d207db53aaaf5c6f3a2

                        SHA1

                        8e6818ce66555e2cca92e5c5f32551fb4a91645e

                        SHA256

                        196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

                        SHA512

                        303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
                        Filesize

                        326KB

                        MD5

                        80d93d38badecdd2b134fe4699721223

                        SHA1

                        e829e58091bae93bc64e0c6f9f0bac999cfda23d

                        SHA256

                        c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                        SHA512

                        9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\jds7144736.tmp\jre-windows.exe
                        Filesize

                        84.1MB

                        MD5

                        dfcfc788d67437530a50177164db42b0

                        SHA1

                        2d9ed0dc5671a358186dcf83abb74bfe39c40e9f

                        SHA256

                        a90318bae7d99da633d9cac8ce322120d087e7b6f5eec0d1d0d7f9413fdd4dc1

                        SHA512

                        dbdfd02528c9f0e506232e8640a8602fade0d05f4139368187300ea2d537e41d2d167655ded30d938bd445a21c776a3c3721f8db4d3f03e3c06807a84cf232e3

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\jre-windows.exe
                        Filesize

                        84.5MB

                        MD5

                        7542ec421a2f6e90751e8b64c22e0542

                        SHA1

                        d207d221a28ede5c2c8415f82c555989aa7068ba

                        SHA256

                        188ca8ecc44de1b7f602e883c3054dc392792c3631bf362b1bc4f3e1dba323e6

                        SHA512

                        8987bf8aa1b401815fa9850e56954db6015bdd06ce78b65ba435724582ffa615dee4e1452fa237c53257dca8ee97b469d01c27757a5f070ce6f807a4f81094bc

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                        Filesize

                        2.7MB

                        MD5

                        f86fcef75c50f2244ea5969e7e6d0e34

                        SHA1

                        23d81eea714210ab78580dcc4c2500b19bc400ff

                        SHA256

                        9eda02d2e1209609f5cf3b717f92f99c47a7e8901547fef1f04aa0e054831bb1

                        SHA512

                        82346f59d8d8c5c7348d005c335823351cb9d26240bfb4ad0b10974cbf1fd895b16dbc003b7e3cd18bb55f02cbf7c46f2ae30cb5d68bdebe65f73dbd12ca042e

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                        Filesize

                        2.7MB

                        MD5

                        f86fcef75c50f2244ea5969e7e6d0e34

                        SHA1

                        23d81eea714210ab78580dcc4c2500b19bc400ff

                        SHA256

                        9eda02d2e1209609f5cf3b717f92f99c47a7e8901547fef1f04aa0e054831bb1

                        SHA512

                        82346f59d8d8c5c7348d005c335823351cb9d26240bfb4ad0b10974cbf1fd895b16dbc003b7e3cd18bb55f02cbf7c46f2ae30cb5d68bdebe65f73dbd12ca042e

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                        Filesize

                        2.7MB

                        MD5

                        f86fcef75c50f2244ea5969e7e6d0e34

                        SHA1

                        23d81eea714210ab78580dcc4c2500b19bc400ff

                        SHA256

                        9eda02d2e1209609f5cf3b717f92f99c47a7e8901547fef1f04aa0e054831bb1

                        SHA512

                        82346f59d8d8c5c7348d005c335823351cb9d26240bfb4ad0b10974cbf1fd895b16dbc003b7e3cd18bb55f02cbf7c46f2ae30cb5d68bdebe65f73dbd12ca042e

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                        Filesize

                        2.7MB

                        MD5

                        f86fcef75c50f2244ea5969e7e6d0e34

                        SHA1

                        23d81eea714210ab78580dcc4c2500b19bc400ff

                        SHA256

                        9eda02d2e1209609f5cf3b717f92f99c47a7e8901547fef1f04aa0e054831bb1

                        SHA512

                        82346f59d8d8c5c7348d005c335823351cb9d26240bfb4ad0b10974cbf1fd895b16dbc003b7e3cd18bb55f02cbf7c46f2ae30cb5d68bdebe65f73dbd12ca042e

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                        Filesize

                        2.7MB

                        MD5

                        f86fcef75c50f2244ea5969e7e6d0e34

                        SHA1

                        23d81eea714210ab78580dcc4c2500b19bc400ff

                        SHA256

                        9eda02d2e1209609f5cf3b717f92f99c47a7e8901547fef1f04aa0e054831bb1

                        SHA512

                        82346f59d8d8c5c7348d005c335823351cb9d26240bfb4ad0b10974cbf1fd895b16dbc003b7e3cd18bb55f02cbf7c46f2ae30cb5d68bdebe65f73dbd12ca042e

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                        Filesize

                        2.7MB

                        MD5

                        f86fcef75c50f2244ea5969e7e6d0e34

                        SHA1

                        23d81eea714210ab78580dcc4c2500b19bc400ff

                        SHA256

                        9eda02d2e1209609f5cf3b717f92f99c47a7e8901547fef1f04aa0e054831bb1

                        SHA512

                        82346f59d8d8c5c7348d005c335823351cb9d26240bfb4ad0b10974cbf1fd895b16dbc003b7e3cd18bb55f02cbf7c46f2ae30cb5d68bdebe65f73dbd12ca042e

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                        Filesize

                        2.7MB

                        MD5

                        f86fcef75c50f2244ea5969e7e6d0e34

                        SHA1

                        23d81eea714210ab78580dcc4c2500b19bc400ff

                        SHA256

                        9eda02d2e1209609f5cf3b717f92f99c47a7e8901547fef1f04aa0e054831bb1

                        SHA512

                        82346f59d8d8c5c7348d005c335823351cb9d26240bfb4ad0b10974cbf1fd895b16dbc003b7e3cd18bb55f02cbf7c46f2ae30cb5d68bdebe65f73dbd12ca042e

                        Download Submit

                      • memory/760-142-0x0000000002860000-0x0000000002DA7000-memory.dmp

                        Filesize

                        5.3MB

                        Download

                      • memory/760-152-0x0000000002860000-0x0000000002DA7000-memory.dmp

                        Filesize

                        5.3MB

                        Download

                      • memory/760-139-0x0000000000400000-0x0000000000947000-memory.dmp

                        Filesize

                        5.3MB

                        Download

                      • memory/760-308-0x0000000000400000-0x0000000000947000-memory.dmp

                        Filesize

                        5.3MB

                        Download

                      • memory/828-98-0x0000000002B20000-0x0000000002F08000-memory.dmp

                        Filesize

                        3.9MB

                        Download

                      • memory/828-94-0x0000000002B20000-0x0000000002F08000-memory.dmp

                        Filesize

                        3.9MB

                        Download

                      • memory/1256-125-0x0000000000400000-0x0000000000947000-memory.dmp

                        Filesize

                        5.3MB

                        Download

                      • memory/1304-146-0x0000000000400000-0x0000000000947000-memory.dmp

                        Filesize

                        5.3MB

                        Download

                      • memory/1412-281-0x0000000000400000-0x0000000000417000-memory.dmp

                        Filesize

                        92KB

                        Download

                      • memory/1412-181-0x0000000000230000-0x0000000000247000-memory.dmp

                        Filesize

                        92KB

                        Download

                      • memory/1412-180-0x0000000000230000-0x0000000000247000-memory.dmp

                        Filesize

                        92KB

                        Download

                      • memory/1412-179-0x0000000000230000-0x0000000000247000-memory.dmp

                        Filesize

                        92KB

                        Download

                      • memory/1412-178-0x0000000000400000-0x0000000000417000-memory.dmp

                        Filesize

                        92KB

                        Download

                      • memory/1508-101-0x0000000000C90000-0x0000000000CA0000-memory.dmp

                        Filesize

                        64KB

                        Download

                      • memory/1508-115-0x0000000005980000-0x0000000005EC7000-memory.dmp

                        Filesize

                        5.3MB

                        Download

                      • memory/1508-117-0x0000000005980000-0x0000000005EC7000-memory.dmp

                        Filesize

                        5.3MB

                        Download

                      • memory/1508-99-0x0000000001040000-0x0000000001428000-memory.dmp

                        Filesize

                        3.9MB

                        Download

                      • memory/1508-118-0x0000000001040000-0x0000000001428000-memory.dmp

                        Filesize

                        3.9MB

                        Download

                      • memory/1580-156-0x000007FEFB6D1000-0x000007FEFB6D3000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/1620-124-0x0000000002830000-0x0000000002D77000-memory.dmp

                        Filesize

                        5.3MB

                        Download

                      • memory/1620-138-0x00000000038A0000-0x0000000003DE7000-memory.dmp

                        Filesize

                        5.3MB

                        Download

                      • memory/1620-123-0x0000000000400000-0x0000000000947000-memory.dmp

                        Filesize

                        5.3MB

                        Download

                      • memory/1620-151-0x00000000038A0000-0x0000000003DE7000-memory.dmp

                        Filesize

                        5.3MB

                        Download

                      • memory/1620-143-0x00000000033E0000-0x0000000003927000-memory.dmp

                        Filesize

                        5.3MB

                        Download

                      • memory/1884-73-0x0000000000680000-0x00000000006AC000-memory.dmp

                        Filesize

                        176KB

                        Download

                      • memory/1884-72-0x0000000000FB0000-0x0000000001398000-memory.dmp

                        Filesize

                        3.9MB

                        Download

                      • memory/1884-78-0x0000000002C80000-0x0000000002C90000-memory.dmp

                        Filesize

                        64KB

                        Download

                      • memory/1884-70-0x0000000000680000-0x00000000006AC000-memory.dmp

                        Filesize

                        176KB

                        Download

                      • memory/1884-69-0x0000000010000000-0x0000000010051000-memory.dmp

                        Filesize

                        324KB

                        Download

                      • memory/1884-66-0x0000000000FB0000-0x0000000001398000-memory.dmp

                        Filesize

                        3.9MB

                        Download

                      • memory/1884-147-0x0000000002C80000-0x0000000002C90000-memory.dmp

                        Filesize

                        64KB

                        Download

                      • memory/1956-127-0x0000000000400000-0x0000000000947000-memory.dmp

                        Filesize

                        5.3MB

                        Download

                      • memory/2004-71-0x0000000002DF0000-0x00000000031D8000-memory.dmp

                        Filesize

                        3.9MB

                        Download

                      • memory/2004-54-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/2004-64-0x0000000002DF0000-0x00000000031D8000-memory.dmp

                        Filesize

                        3.9MB

                        Download

                      • memory/2300-214-0x0000000002470000-0x0000000002480000-memory.dmp

                        Filesize

                        64KB

                        Download

                      • memory/2656-307-0x00000000023F0000-0x00000000033F0000-memory.dmp

                        Filesize

                        16.0MB

                        Download