Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
27-02-2023 10:27
Static task
static1
Behavioral task
behavioral1
Sample
TLauncher-2.871-Installer-1.0.6-global.exe
Resource
win7-20230220-en
General
-
Target
TLauncher-2.871-Installer-1.0.6-global.exe
-
Size
23.6MB
-
MD5
7a4472a78d0651e11d20aa08e43cc045
-
SHA1
aab1d5f80d7399ae2c1982201733be7681d100b1
-
SHA256
318df7404e6c4d5538a6d31997b95af52bbb8d40caf5553b3cbd9b1bc4f6db96
-
SHA512
c152c9d21b0615548173dcc61accb1a1afd5b6f98e6ec21f6a7119536397f07a54ad4087669716c3344dd338ce4f24cecf9989d472f65eaa18c87d496f23c681
-
SSDEEP
393216:gXQLpnUN/n8IPfs/dQETVlOBbpFEj9GZ1GphRqV56Hpk7IXOzDnKI17fyVS:ggLFUp8aHExiTI3qqHp6zvKcfyVS
Malware Config
Signatures
-
BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
-
Bazar/Team9 Backdoor payload 1 IoCs
Processes:
resource yara_rule C:\Windows\Installer\6dc006.msi BazarBackdoorVar3 -
Blocklisted process makes network request 1 IoCs
Processes:
msiexec.exeflow pid process 99 2680 msiexec.exe -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
opera.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Control Panel\International\Geo\Nation opera.exe -
Executes dropped EXE 40 IoCs
Processes:
irsetup.exeAdditionalExecuteTL.exeirsetup.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exe_sfx.exeassistant_installer.exeassistant_installer.exejre-windows.exejre-windows.exeinstaller.exeinstaller.exelauncher.exeopera.exeopera_crashreporter.exeopera.exeopera.exeopera.exeopera_crashreporter.exeopera.exeopera.exeopera.exeopera.exeopera_autoupdate.exeopera_autoupdate.exelauncher.exeinstaller.exebspatch.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exejavaw.exeinstaller.exepid process 904 irsetup.exe 1668 AdditionalExecuteTL.exe 816 irsetup.exe 1644 opera-installer-bro.exe 616 opera-installer-bro.exe 1012 opera-installer-bro.exe 1348 opera-installer-bro.exe 788 opera-installer-bro.exe 2756 _sfx.exe 2576 assistant_installer.exe 2624 assistant_installer.exe 2688 jre-windows.exe 2852 jre-windows.exe 2136 installer.exe 2856 installer.exe 2752 launcher.exe 1780 opera.exe 1444 opera_crashreporter.exe 316 opera.exe 2876 opera.exe 2216 opera.exe 1300 opera_crashreporter.exe 2392 opera.exe 2320 opera.exe 1668 opera.exe 2148 opera.exe 2728 opera_autoupdate.exe 2948 opera_autoupdate.exe 1684 launcher.exe 1844 installer.exe 2712 bspatch.exe 2392 unpack200.exe 2148 unpack200.exe 2360 unpack200.exe 2556 unpack200.exe 2772 unpack200.exe 2632 unpack200.exe 2056 unpack200.exe 968 javaw.exe 1764 installer.exe -
Loads dropped DLL 64 IoCs
Processes:
TLauncher-2.871-Installer-1.0.6-global.exeirsetup.exeAdditionalExecuteTL.exeirsetup.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exeassistant_installer.exejre-windows.exeinstaller.exeinstaller.exelauncher.exeopera.exepid process 2044 TLauncher-2.871-Installer-1.0.6-global.exe 2044 TLauncher-2.871-Installer-1.0.6-global.exe 2044 TLauncher-2.871-Installer-1.0.6-global.exe 2044 TLauncher-2.871-Installer-1.0.6-global.exe 904 irsetup.exe 904 irsetup.exe 904 irsetup.exe 904 irsetup.exe 904 irsetup.exe 904 irsetup.exe 904 irsetup.exe 904 irsetup.exe 1668 AdditionalExecuteTL.exe 1668 AdditionalExecuteTL.exe 1668 AdditionalExecuteTL.exe 1668 AdditionalExecuteTL.exe 816 irsetup.exe 816 irsetup.exe 816 irsetup.exe 816 irsetup.exe 816 irsetup.exe 816 irsetup.exe 816 irsetup.exe 816 irsetup.exe 1644 opera-installer-bro.exe 1644 opera-installer-bro.exe 616 opera-installer-bro.exe 1644 opera-installer-bro.exe 1012 opera-installer-bro.exe 1644 opera-installer-bro.exe 1348 opera-installer-bro.exe 1348 opera-installer-bro.exe 788 opera-installer-bro.exe 1644 opera-installer-bro.exe 1644 opera-installer-bro.exe 1644 opera-installer-bro.exe 1644 opera-installer-bro.exe 2576 assistant_installer.exe 904 irsetup.exe 1348 opera-installer-bro.exe 1348 opera-installer-bro.exe 2688 jre-windows.exe 1348 opera-installer-bro.exe 2136 installer.exe 2136 installer.exe 2856 installer.exe 2136 installer.exe 1212 1212 1212 1212 1212 1212 1212 2136 installer.exe 2752 launcher.exe 1780 opera.exe 1780 opera.exe 1212 1212 1212 1780 opera.exe 1780 opera.exe 1212 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Registers COM server for autorun 1 TTPs 64 IoCs
Processes:
installer.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}\InprocServer32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}\INPROCSERVER32 installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}\INPROCSERVER32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}\INPROCSERVER32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}\InprocServer32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}\InprocServer32 installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}\INPROCSERVER32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\InprocServer32 installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}\INPROCSERVER32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}\InprocServer32 installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}\INPROCSERVER32 installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}\INPROCSERVER32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}\InprocServer32 installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}\INPROCSERVER32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}\InprocServer32 installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}\INPROCSERVER32 installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}\INPROCSERVER32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}\InprocServer32 installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}\INPROCSERVER32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}\InprocServer32 installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}\INPROCSERVER32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}\INPROCSERVER32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\InProcServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}\InprocServer32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}\InprocServer32 installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}\INPROCSERVER32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}\INPROCSERVER32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}\INPROCSERVER32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\InProcServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}\INPROCSERVER32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}\INPROCSERVER32 installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\INPROCSERVER32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx behavioral1/memory/904-344-0x0000000001150000-0x0000000001538000-memory.dmp upx behavioral1/memory/904-367-0x0000000001150000-0x0000000001538000-memory.dmp upx behavioral1/memory/904-373-0x0000000001150000-0x0000000001538000-memory.dmp upx behavioral1/memory/904-385-0x0000000001150000-0x0000000001538000-memory.dmp upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe upx C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe upx behavioral1/memory/904-461-0x0000000001150000-0x0000000001538000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe upx C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe upx behavioral1/memory/816-473-0x00000000001B0000-0x0000000000598000-memory.dmp upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe upx \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx behavioral1/memory/1644-576-0x0000000000400000-0x0000000000947000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx behavioral1/memory/816-596-0x00000000001B0000-0x0000000000598000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe upx \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe upx C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx behavioral1/memory/904-605-0x0000000001150000-0x0000000001538000-memory.dmp upx behavioral1/memory/616-621-0x0000000000400000-0x0000000000947000-memory.dmp upx behavioral1/memory/1348-619-0x0000000000400000-0x0000000000947000-memory.dmp upx \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx behavioral1/memory/1012-604-0x0000000000400000-0x0000000000947000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx behavioral1/memory/788-1031-0x0000000000400000-0x0000000000947000-memory.dmp upx behavioral1/memory/1644-1032-0x0000000000400000-0x0000000000947000-memory.dmp upx behavioral1/memory/904-1395-0x0000000001150000-0x0000000001538000-memory.dmp upx behavioral1/memory/904-1477-0x0000000001150000-0x0000000001538000-memory.dmp upx behavioral1/memory/904-1639-0x0000000001150000-0x0000000001538000-memory.dmp upx behavioral1/memory/904-1689-0x0000000001150000-0x0000000001538000-memory.dmp upx behavioral1/memory/1348-1917-0x0000000000400000-0x0000000000947000-memory.dmp upx behavioral1/memory/1644-1932-0x0000000000400000-0x0000000000947000-memory.dmp upx behavioral1/memory/904-2436-0x0000000001150000-0x0000000001538000-memory.dmp upx behavioral1/memory/2712-2633-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral1/memory/2712-2696-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral1/memory/2712-2705-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral1/memory/2712-2714-0x0000000000400000-0x0000000000417000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
opera.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Run opera.exe Set value (str) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Run\Opera Stable = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\launcher.exe" opera.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 27 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
installer.exemsiexec.exeopera-installer-bro.exeopera-installer-bro.exedescription ioc process File opened (read-only) \??\D: installer.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\D: opera-installer-bro.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\D: opera-installer-bro.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
Installs/modifies Browser Helper Object 2 TTPs 6 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
installer.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\NoExplorer = "1" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9} installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\NoExplorer = "1" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} installer.exe -
Drops file in System32 directory 1 IoCs
Processes:
installer.exedescription ioc process File created C:\Windows\system32\WindowsAccessBridge-64.dll installer.exe -
Drops file in Program Files directory 64 IoCs
Processes:
installer.exeopera.exedescription ioc process File created C:\Program Files\Java\jre1.8.0_351\legal\javafx\glib.md installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\cmm\GRAY.pf installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\resource.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\legal\jdk\jopt-simple.md installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\ext\localedata.pack installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\dtplugin\deployJava1.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\java-rmi.exe installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\currency.data installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\calendars.properties installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\deploy\messages_fr.properties installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\security\policy\limited\US_export_policy.jar installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\awt.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\java.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\JAWTAccessBridge-64.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\legal\javafx\gstreamer.md installer.exe File created C:\Program Files\Java\jre1.8.0_351\legal\jdk\relaxngcc.md installer.exe File created C:\Program Files\Java\jre1.8.0_351\legal\jdk\dynalink.md installer.exe File created C:\Program Files\Java\jre1.8.0_351\legal\jdk\unicode.md installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\fontconfig.properties.src installer.exe File created C:\Program Files\scoped_dir2216_1011316873\persona.ini opera.exe File created C:\Program Files\Java\jre1.8.0_351\bin\dt_shmem.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\javaws.exe installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\npt.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\sunmscapi.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\deploy.pack installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\fontconfig.bfc installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-core-file-l1-1-0.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\legal\javafx\libffi.md installer.exe File created C:\Program Files\Java\jre1.8.0_351\legal\javafx\libxml2.md installer.exe File created C:\Program Files\Java\jre1.8.0_351\legal\jdk\relaxngdatatype.md installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\cmm\sRGB.pf installer.exe File created C:\Program Files\Java\jre1.8.0_351\THIRDPARTYLICENSEREADME-JAVAFX.txt installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-core-datetime-l1-1-0.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-crt-stdio-l1-1-0.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\classlist installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\ssv.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\WindowsAccessBridge-64.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\legal\javafx\webkit.md installer.exe File created C:\Program Files\Java\jre1.8.0_351\LICENSE installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-core-synch-l1-2-0.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-core-sysinfo-l1-1-0.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-crt-locale-l1-1-0.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\plugin2\msvcp140.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\legal\jdk\mesa3d.md installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\deploy\messages_es.properties installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-core-rtlsupport-l1-1-0.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\javacpl.cpl installer.exe File created C:\Program Files\Java\jre1.8.0_351\legal\javafx\public_suffix.md installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-core-namedpipe-l1-1-0.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\jp2launcher.exe installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\ext\nashorn.jar installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\flavormap.properties installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\psfont.properties.ja installer.exe File created C:\Program Files\scoped_dir2216_1669099127\persona.ini opera.exe File created C:\Program Files\Java\jre1.8.0_351\bin\j2pkcs11.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\legal\javafx\libxslt.md installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\hprof.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\keytool.exe installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\jfr.jar installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\verify.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\legal\jdk\freebxml.md installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-core-debug-l1-1-0.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\jjs.exe installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\security\policy\unlimited\local_policy.jar installer.exe -
Drops file in Windows directory 9 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\Windows\Installer\MSICB9E.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSICA36.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICBED.tmp msiexec.exe File created C:\Windows\Installer\6dc00a.msi msiexec.exe File created C:\Windows\Installer\6dc006.msi msiexec.exe File opened for modification C:\Windows\Installer\6dc006.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIC593.tmp msiexec.exe File created C:\Windows\Installer\6dc008.ipi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
msiexec.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msiexec.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msiexec.exe -
Enumerates system info in registry 2 TTPs 5 IoCs
Processes:
opera.exeopera.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS opera.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName opera.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS opera.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName opera.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer opera.exe -
Processes:
installer.exeirsetup.exejre-windows.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppName = "javaws.exe" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppPath = "C:\\Program Files\\Java\\jre1.8.0_351\\bin" installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Policy = "0" installer.exe Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main irsetup.exe Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main jre-windows.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284} installer.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
installer.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}\InprocServer32 installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}\InprocServer32 installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA} installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA} installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}\ = "Java Plug-in 1.3.1_15" installer.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}\InprocServer32 installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}\InprocServer32 installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}\InprocServer32 installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_03" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}\ = "Java Plug-in 1.3.1_12" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB} installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_11" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}\ = "Java Plug-in 1.3.1_13" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_04" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}\ = "Java Plug-in 1.3.1_04" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_05" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}\InprocServer32 installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_06" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}\ = "Java Plug-in 1.3.1_17" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB} installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}\InprocServer32 installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_17" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_13" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}\ = "Java Plug-in 1.3.1_07" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}\InprocServer32 installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB} installer.exe -
Modifies registry class 64 IoCs
Processes:
installer.exeinstaller.exemsiexec.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\JNLPFile\Shell installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA} installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}\INPROCSERVER32 installer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\.html\OpenWithProgIDs\OperaStable = "0" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640} installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}\INPROCSERVER32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}\ = "Java Plug-in 1.3.1_03" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA} installer.exe Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\OperaStable\shell\open installer.exe Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\http\shell\open\ddeexec\Application installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\.shtml\ = "OperaStable" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4EA42A62D9304AC4784BF2468130150F\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\InprocServer32 installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\JNLPFile\EditFlags = "65536" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA} installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA} installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\https\URL Protocol installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}\INPROCSERVER32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}\ = "Java Plug-in 1.3.1_05" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}\INPROCSERVER32 installer.exe Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\.opdownload installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\https\shell\open\ddeexec\Topic\ installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4EA42A62D9304AC4784BF2468130150F msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\ProgID installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jnlp\Shell\Open installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JavaWebStart.isInstalled.1.8.0.0\ = "isInstalled Class" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}\InprocServer32 installer.exe Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\.htm\OpenWithProgIDs installer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\.htm\OpenWithProgIDs\OperaStable = "0" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}\InProcServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\ftp installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jnlp\Shell installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-java-applet installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB} installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}\INPROCSERVER32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}\InprocServer32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6C5ADB75C34456D42B33823269140800 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}\INPROCSERVER32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\http\shell\open\ddeexec\Application\ installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}\INPROCSERVER32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_07" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\.xhtml\OpenWithProgIDs\OperaStable = "0" installer.exe Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\http\shell\open\command installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\INPROCSERVER32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\InProcServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\InProcServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4EA42A62D9304AC4784BF2468130150F\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA} installer.exe -
Processes:
irsetup.exeopera-installer-bro.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 irsetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 opera-installer-bro.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 opera-installer-bro.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde irsetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 opera-installer-bro.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e opera-installer-bro.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e opera-installer-bro.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 opera-installer-bro.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 opera-installer-bro.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
opera.exepid process 2216 opera.exe 2216 opera.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
opera.exejre-windows.exemsiexec.exedescription pid process Token: SeShutdownPrivilege 2216 opera.exe Token: SeShutdownPrivilege 2216 opera.exe Token: SeShutdownPrivilege 2216 opera.exe Token: SeShutdownPrivilege 2216 opera.exe Token: SeShutdownPrivilege 2852 jre-windows.exe Token: SeIncreaseQuotaPrivilege 2852 jre-windows.exe Token: SeShutdownPrivilege 2216 opera.exe Token: SeShutdownPrivilege 2216 opera.exe Token: SeRestorePrivilege 2680 msiexec.exe Token: SeTakeOwnershipPrivilege 2680 msiexec.exe Token: SeSecurityPrivilege 2680 msiexec.exe Token: SeCreateTokenPrivilege 2852 jre-windows.exe Token: SeAssignPrimaryTokenPrivilege 2852 jre-windows.exe Token: SeLockMemoryPrivilege 2852 jre-windows.exe Token: SeIncreaseQuotaPrivilege 2852 jre-windows.exe Token: SeMachineAccountPrivilege 2852 jre-windows.exe Token: SeTcbPrivilege 2852 jre-windows.exe Token: SeSecurityPrivilege 2852 jre-windows.exe Token: SeTakeOwnershipPrivilege 2852 jre-windows.exe Token: SeLoadDriverPrivilege 2852 jre-windows.exe Token: SeSystemProfilePrivilege 2852 jre-windows.exe Token: SeSystemtimePrivilege 2852 jre-windows.exe Token: SeProfSingleProcessPrivilege 2852 jre-windows.exe Token: SeIncBasePriorityPrivilege 2852 jre-windows.exe Token: SeCreatePagefilePrivilege 2852 jre-windows.exe Token: SeCreatePermanentPrivilege 2852 jre-windows.exe Token: SeBackupPrivilege 2852 jre-windows.exe Token: SeRestorePrivilege 2852 jre-windows.exe Token: SeShutdownPrivilege 2852 jre-windows.exe Token: SeDebugPrivilege 2852 jre-windows.exe Token: SeAuditPrivilege 2852 jre-windows.exe Token: SeSystemEnvironmentPrivilege 2852 jre-windows.exe Token: SeChangeNotifyPrivilege 2852 jre-windows.exe Token: SeRemoteShutdownPrivilege 2852 jre-windows.exe Token: SeUndockPrivilege 2852 jre-windows.exe Token: SeSyncAgentPrivilege 2852 jre-windows.exe Token: SeEnableDelegationPrivilege 2852 jre-windows.exe Token: SeManageVolumePrivilege 2852 jre-windows.exe Token: SeImpersonatePrivilege 2852 jre-windows.exe Token: SeCreateGlobalPrivilege 2852 jre-windows.exe Token: SeRestorePrivilege 2680 msiexec.exe Token: SeTakeOwnershipPrivilege 2680 msiexec.exe Token: SeShutdownPrivilege 2216 opera.exe Token: SeShutdownPrivilege 2216 opera.exe Token: SeRestorePrivilege 2680 msiexec.exe Token: SeTakeOwnershipPrivilege 2680 msiexec.exe Token: SeShutdownPrivilege 2216 opera.exe Token: SeShutdownPrivilege 2216 opera.exe Token: SeRestorePrivilege 2680 msiexec.exe Token: SeTakeOwnershipPrivilege 2680 msiexec.exe Token: SeRestorePrivilege 2680 msiexec.exe Token: SeTakeOwnershipPrivilege 2680 msiexec.exe Token: SeRestorePrivilege 2680 msiexec.exe Token: SeTakeOwnershipPrivilege 2680 msiexec.exe Token: SeShutdownPrivilege 2216 opera.exe Token: SeShutdownPrivilege 2216 opera.exe Token: SeRestorePrivilege 2680 msiexec.exe Token: SeTakeOwnershipPrivilege 2680 msiexec.exe Token: SeShutdownPrivilege 2216 opera.exe Token: SeShutdownPrivilege 2216 opera.exe Token: SeRestorePrivilege 2680 msiexec.exe Token: SeTakeOwnershipPrivilege 2680 msiexec.exe Token: SeRestorePrivilege 2680 msiexec.exe Token: SeTakeOwnershipPrivilege 2680 msiexec.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
irsetup.exeirsetup.exejre-windows.exepid process 904 irsetup.exe 904 irsetup.exe 904 irsetup.exe 904 irsetup.exe 904 irsetup.exe 904 irsetup.exe 816 irsetup.exe 816 irsetup.exe 2852 jre-windows.exe 2852 jre-windows.exe 2852 jre-windows.exe 2852 jre-windows.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
TLauncher-2.871-Installer-1.0.6-global.exeirsetup.exeAdditionalExecuteTL.exeirsetup.exeopera-installer-bro.exeopera-installer-bro.exedescription pid process target process PID 2044 wrote to memory of 904 2044 TLauncher-2.871-Installer-1.0.6-global.exe irsetup.exe PID 2044 wrote to memory of 904 2044 TLauncher-2.871-Installer-1.0.6-global.exe irsetup.exe PID 2044 wrote to memory of 904 2044 TLauncher-2.871-Installer-1.0.6-global.exe irsetup.exe PID 2044 wrote to memory of 904 2044 TLauncher-2.871-Installer-1.0.6-global.exe irsetup.exe PID 2044 wrote to memory of 904 2044 TLauncher-2.871-Installer-1.0.6-global.exe irsetup.exe PID 2044 wrote to memory of 904 2044 TLauncher-2.871-Installer-1.0.6-global.exe irsetup.exe PID 2044 wrote to memory of 904 2044 TLauncher-2.871-Installer-1.0.6-global.exe irsetup.exe PID 904 wrote to memory of 1668 904 irsetup.exe AdditionalExecuteTL.exe PID 904 wrote to memory of 1668 904 irsetup.exe AdditionalExecuteTL.exe PID 904 wrote to memory of 1668 904 irsetup.exe AdditionalExecuteTL.exe PID 904 wrote to memory of 1668 904 irsetup.exe AdditionalExecuteTL.exe PID 904 wrote to memory of 1668 904 irsetup.exe AdditionalExecuteTL.exe PID 904 wrote to memory of 1668 904 irsetup.exe AdditionalExecuteTL.exe PID 904 wrote to memory of 1668 904 irsetup.exe AdditionalExecuteTL.exe PID 1668 wrote to memory of 816 1668 AdditionalExecuteTL.exe irsetup.exe PID 1668 wrote to memory of 816 1668 AdditionalExecuteTL.exe irsetup.exe PID 1668 wrote to memory of 816 1668 AdditionalExecuteTL.exe irsetup.exe PID 1668 wrote to memory of 816 1668 AdditionalExecuteTL.exe irsetup.exe PID 1668 wrote to memory of 816 1668 AdditionalExecuteTL.exe irsetup.exe PID 1668 wrote to memory of 816 1668 AdditionalExecuteTL.exe irsetup.exe PID 1668 wrote to memory of 816 1668 AdditionalExecuteTL.exe irsetup.exe PID 816 wrote to memory of 1644 816 irsetup.exe opera-installer-bro.exe PID 816 wrote to memory of 1644 816 irsetup.exe opera-installer-bro.exe PID 816 wrote to memory of 1644 816 irsetup.exe opera-installer-bro.exe PID 816 wrote to memory of 1644 816 irsetup.exe opera-installer-bro.exe PID 816 wrote to memory of 1644 816 irsetup.exe opera-installer-bro.exe PID 816 wrote to memory of 1644 816 irsetup.exe opera-installer-bro.exe PID 816 wrote to memory of 1644 816 irsetup.exe opera-installer-bro.exe PID 1644 wrote to memory of 616 1644 opera-installer-bro.exe opera-installer-bro.exe PID 1644 wrote to memory of 616 1644 opera-installer-bro.exe opera-installer-bro.exe PID 1644 wrote to memory of 616 1644 opera-installer-bro.exe opera-installer-bro.exe PID 1644 wrote to memory of 616 1644 opera-installer-bro.exe opera-installer-bro.exe PID 1644 wrote to memory of 616 1644 opera-installer-bro.exe opera-installer-bro.exe PID 1644 wrote to memory of 616 1644 opera-installer-bro.exe opera-installer-bro.exe PID 1644 wrote to memory of 616 1644 opera-installer-bro.exe opera-installer-bro.exe PID 1644 wrote to memory of 1012 1644 opera-installer-bro.exe opera-installer-bro.exe PID 1644 wrote to memory of 1012 1644 opera-installer-bro.exe opera-installer-bro.exe PID 1644 wrote to memory of 1012 1644 opera-installer-bro.exe opera-installer-bro.exe PID 1644 wrote to memory of 1012 1644 opera-installer-bro.exe opera-installer-bro.exe PID 1644 wrote to memory of 1012 1644 opera-installer-bro.exe opera-installer-bro.exe PID 1644 wrote to memory of 1012 1644 opera-installer-bro.exe opera-installer-bro.exe PID 1644 wrote to memory of 1012 1644 opera-installer-bro.exe opera-installer-bro.exe PID 1644 wrote to memory of 1348 1644 opera-installer-bro.exe opera-installer-bro.exe PID 1644 wrote to memory of 1348 1644 opera-installer-bro.exe opera-installer-bro.exe PID 1644 wrote to memory of 1348 1644 opera-installer-bro.exe opera-installer-bro.exe PID 1644 wrote to memory of 1348 1644 opera-installer-bro.exe opera-installer-bro.exe PID 1644 wrote to memory of 1348 1644 opera-installer-bro.exe opera-installer-bro.exe PID 1644 wrote to memory of 1348 1644 opera-installer-bro.exe opera-installer-bro.exe PID 1644 wrote to memory of 1348 1644 opera-installer-bro.exe opera-installer-bro.exe PID 1348 wrote to memory of 788 1348 opera-installer-bro.exe opera-installer-bro.exe PID 1348 wrote to memory of 788 1348 opera-installer-bro.exe opera-installer-bro.exe PID 1348 wrote to memory of 788 1348 opera-installer-bro.exe opera-installer-bro.exe PID 1348 wrote to memory of 788 1348 opera-installer-bro.exe opera-installer-bro.exe PID 1348 wrote to memory of 788 1348 opera-installer-bro.exe opera-installer-bro.exe PID 1348 wrote to memory of 788 1348 opera-installer-bro.exe opera-installer-bro.exe PID 1348 wrote to memory of 788 1348 opera-installer-bro.exe opera-installer-bro.exe PID 1644 wrote to memory of 2756 1644 opera-installer-bro.exe _sfx.exe PID 1644 wrote to memory of 2756 1644 opera-installer-bro.exe _sfx.exe PID 1644 wrote to memory of 2756 1644 opera-installer-bro.exe _sfx.exe PID 1644 wrote to memory of 2756 1644 opera-installer-bro.exe _sfx.exe PID 1644 wrote to memory of 2756 1644 opera-installer-bro.exe _sfx.exe PID 1644 wrote to memory of 2756 1644 opera-installer-bro.exe _sfx.exe PID 1644 wrote to memory of 2756 1644 opera-installer-bro.exe _sfx.exe PID 1644 wrote to memory of 2576 1644 opera-installer-bro.exe assistant_installer.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe" "__IRCT:3" "__IRTSS:24771453" "__IRSID:S-1-5-21-3430344531-3702557399-3004411149-1000"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816850 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" "__IRCT:3" "__IRTSS:1840872" "__IRSID:S-1-5-21-3430344531-3702557399-3004411149-1000"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe"C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=05⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exeC:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=96.0.4693.20 --initial-client-data=0x1a4,0x1a8,0x1ac,0x178,0x1b0,0x712cf4a8,0x712cf4b8,0x712cf4c46⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe" --version6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe"C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=1644 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20230227112919" --session-guid=28a56c88-1ada-49ac-893b-561da340a967 --server-tracking-blob=Yjk4NjNjMjExYTZmMjBhNmYzN2Y1ZDNlNmJhODU1NmI5ZDYxNTkxNTUwY2NhY2RjMjRiNzhiNDQxOGEzN2Q3NTp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjciLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNjc3NDkzNzUzLjQ4OTMiLCJ1c2VyYWdlbnQiOiJTZXR1cCBGYWN0b3J5IDkuMCIsInV0bSI6eyJjYW1wYWlnbiI6Ik9wZXJhRGVza3RvcCIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Ik1TVEwifSwidXVpZCI6IjUyNzc2Y2NkLTU1MmItNDdjNi05MTk5LTMzMDMzMDU3NjU0MCJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=0C030000000000006⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exeC:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=96.0.4693.20 --initial-client-data=0x1b0,0x1b4,0x1b8,0x178,0x1bc,0x7082f4a8,0x7082f4b8,0x7082f4c47⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.46\installer.exe"C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.46\installer.exe" --backend --initial-pid=1644 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302271129191" --session-guid=28a56c88-1ada-49ac-893b-561da340a967 --server-tracking-blob=Yjk4NjNjMjExYTZmMjBhNmYzN2Y1ZDNlNmJhODU1NmI5ZDYxNTkxNTUwY2NhY2RjMjRiNzhiNDQxOGEzN2Q3NTp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjciLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNjc3NDkzNzUzLjQ4OTMiLCJ1c2VyYWdlbnQiOiJTZXR1cCBGYWN0b3J5IDkuMCIsInV0bSI6eyJjYW1wYWlnbiI6Ik9wZXJhRGVza3RvcCIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Ik1TVEwifSwidXVpZCI6IjUyNzc2Y2NkLTU1MmItNDdjNi05MTk5LTMzMDMzMDU3NjU0MCJ9 --silent --desktopshortcut=1 --install-subfolder=95.0.4635.467⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.46\installer.exeC:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.46\installer.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=95.0.4635.46 --initial-client-data=0x174,0x178,0x17c,0x148,0x180,0x7fef4faa908,0x7fef4faa918,0x7fef4faa9288⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe"C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe" --start-maximized8⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --start-maximized --ran-launcher9⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.46\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.46\opera_crashreporter.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=95.0.4635.46 --initial-client-data=0x15c,0x160,0x164,0x130,0x168,0x7feef4b3a18,0x7feef4b3a28,0x7feef4b3a3810⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:extended-unstoppable-domains=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1064 --field-trial-handle=1184,i,4094765132568642054,8619242500326364252,131072 /prefetch:210⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:extended-unstoppable-domains=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=1356 --field-trial-handle=1184,i,4094765132568642054,8619242500326364252,131072 /prefetch:810⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302271129191\assistant\_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302271129191\assistant\_sfx.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302271129191\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302271129191\assistant\assistant_installer.exe" --version6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302271129191\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302271129191\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x148,0x14c,0x150,0x11c,0x154,0x4c2dc0,0x4c2dd0,0x4c2ddc7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jre-windows.exe"C:\Users\Admin\AppData\Local\Temp\jre-windows.exe" STATIC=13⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\jds7168199.tmp\jre-windows.exe"C:\Users\Admin\AppData\Local\Temp\jds7168199.tmp\jre-windows.exe" "STATIC=1"4⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --start-maximized --ran-launcher --flag-switches-begin --flag-switches-end --enable-quic --lowered-browser1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.46\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.46\opera_crashreporter.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=95.0.4635.46 --initial-client-data=0x15c,0x160,0x164,0x130,0x168,0x7feef4b3a18,0x7feef4b3a28,0x7feef4b3a382⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:extended-unstoppable-domains=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1028 --field-trial-handle=1148,i,11053850040360200190,16715080762476979850,131072 /prefetch:22⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --start-stack-profiler --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:extended-unstoppable-domains=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=1364 --field-trial-handle=1148,i,11053850040360200190,16715080762476979850,131072 /prefetch:82⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:extended-unstoppable-domains=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=1456 --field-trial-handle=1148,i,11053850040360200190,16715080762476979850,131072 /prefetch:82⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:extended-unstoppable-domains=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=2020 --field-trial-handle=1148,i,11053850040360200190,16715080762476979850,131072 /prefetch:82⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:aliexpress-modal=off --with-feature:automatic-video-popout-expanded=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:extended-unstoppable-domains=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:partner-dropdown-suggestions-boost=on --with-feature:personalized-speeddials=on --with-feature:sd-suggestions-external=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner=on --with-feature:tiktok-panel=off --with-feature:yandex-zen-iframe-scroll=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=off --with-feature:installer-one-version-one-subfolder=off --mojo-platform-channel-handle=2032 --field-trial-handle=1148,i,11053850040360200190,16715080762476979850,131072 /prefetch:82⤵
-
C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.46\opera_autoupdate.exe"C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.46\opera_autoupdate.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" --pipeid=oauc_pipe2906202b27b41e4bd66c9238c4b575c12⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.46\opera_autoupdate.exeC:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.46\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=95.0.4635.46 --initial-client-data=0x138,0x13c,0x140,0x10c,0x144,0x13fcacbd8,0x13fcacbe8,0x13fcacbf83⤵
- Executes dropped EXE
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding 7696C149D4BB52F47426345124B7C0BA2⤵
-
C:\Program Files\Java\jre1.8.0_351\installer.exe"C:\Program Files\Java\jre1.8.0_351\installer.exe" /s INSTALLDIR="C:\Program Files\Java\jre1.8.0_351\\" STATIC=1 INSTALL_SILENT=1 REPAIRMODE=0 ProductCode={26A24AE4-039D-4CA4-87B4-2F64180351F0}2⤵
- Executes dropped EXE
- Registers COM server for autorun
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\ProgramData\Oracle\Java\installcache_x64\7198900.tmp\bspatch.exe"bspatch.exe" baseimagefam8 newimage diff3⤵
- Executes dropped EXE
-
C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/plugin.pack" "C:\Program Files\Java\jre1.8.0_351\lib/plugin.jar"3⤵
- Executes dropped EXE
-
C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/javaws.pack" "C:\Program Files\Java\jre1.8.0_351\lib/javaws.jar"3⤵
- Executes dropped EXE
-
C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/deploy.pack" "C:\Program Files\Java\jre1.8.0_351\lib/deploy.jar"3⤵
- Executes dropped EXE
-
C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/rt.pack" "C:\Program Files\Java\jre1.8.0_351\lib/rt.jar"3⤵
- Executes dropped EXE
-
C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/jsse.pack" "C:\Program Files\Java\jre1.8.0_351\lib/jsse.jar"3⤵
- Executes dropped EXE
-
C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/charsets.pack" "C:\Program Files\Java\jre1.8.0_351\lib/charsets.jar"3⤵
- Executes dropped EXE
-
C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/ext/localedata.pack" "C:\Program Files\Java\jre1.8.0_351\lib/ext/localedata.jar"3⤵
- Executes dropped EXE
-
C:\Program Files\Java\jre1.8.0_351\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_351\bin\javaw.exe" -Xshare:dump -Djdk.disableLastUsageTracking3⤵
- Executes dropped EXE
-
C:\Windows\system32\taskeng.exetaskeng.exe {B8AC674B-B6BC-452A-A081-D6499313C9C7} S-1-5-21-3430344531-3702557399-3004411149-1000:WFSTZEPN\Admin:Interactive:[1]1⤵
-
C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exeC:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe --scheduledautoupdate --autoupdaterequesttype=automatic --autoupdateoperaversion=95.0.4635.46 --newautoupdaterlogic2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe" --version3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jre1.8.0_351\bin\javacpl.exeFilesize
103KB
MD57a9d69862a2021508931a197cd6501ec
SHA1a0f7d313a874552f4972784d15042b564e4067fc
SHA25651ff63cbac78bd133333e98d91b02b652c88cd57cedd0052519051a17be77856
SHA5125c331e6deefc8256ea203d63770484f6b485d4c3832a60ecf4a540dff3cb75a76dbde37980fe1763ca487401b68126f58f8d1a4c72ee610f5144c624c4736850
-
C:\Program Files\Java\jre1.8.0_351\bin\javaws.exeFilesize
446KB
MD524ccb37646e1f52ce4f47164cccf2b91
SHA1bc265e26417026286d6ed951904305086c4f693c
SHA256adf2d659c2b2a4afff1ca58f3a742d27d767d27eabeca6a8b6ee243e9c913a39
SHA512cb174e7a219f6ffae3715e37beb428979bc1462202729c05a25fa7b8da90e2dd6faa92c03cd9ca21567d354dce7acc1852669f4071298e953d6a286243794e32
-
C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exeFilesize
216KB
MD5691f68efcd902bfdfb60b556a3e11c2c
SHA1c279fa09293185bddfd73d1170b6a73bd266cf07
SHA256471d70ebf91bdc762dcacbea9f6ca883f97921938e83269fef911dbf83598a70
SHA512a4816ae0654f41bd130d56e44839d9f29ab48bd2f99c3d6db38ce3358ac46c1cef09da09184c6291dd378018a49f9e56173c35d780d3eaefcce459592c75de3f
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit\Reference Documentation.lnkFilesize
197B
MD5b5e1de7d05841796c6d96dfe5b8b338c
SHA1c7c64e5b35d0cca1a5c98a1c68e1e5d4c8b72547
SHA256062cb9dec2b2ce02c633fc442d1a23e910e602548a54a54c8310b0dde9ae074d
SHA512963a89b04f34bc00fea5b8e0f9648596c428beac2db30d8b0932974b15c0eb90b7c801ba6fa1082ea9d133258f393ae27e61f27fd3b3951f5c2e4b8c6a212c2d
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Get Help.urlFilesize
182B
MD57fadb9e200dbbd992058cefa41212796
SHA1e2525d7ba66bb07bc1cd5ba93f88c54e7e2042b4
SHA256b05abacd15117b1ffcd2a288308f50c0542214d264b852eddfa9025307ac401b
SHA51294b7bf1f1f5cea2a74f8c326113dd25652cb14e5fa356ac83d16b6ac5a5cac26c9d2b20259f5c2cf8ebc1e022490511e2996335a5d8dd7f5b64dce429fb6dfb1
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Visit Java.com.urlFilesize
178B
MD53b1c6b5701ef2829986a6bdc3f6fbf94
SHA11a2fe685aba9430625cba281d1a8f7ba9d392af0
SHA2566a2cdce88637830202e1031bc8c11f083103a6bbb8c1ce16fb805671a46633c8
SHA512f3391d790bb6acb1c25b82253b19c334e7cd73648e9821b7050fefbd5b0bc4b48a0cedd97e425a83c788f9b798337d33dee2e989771604c4f886da46d2debea0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565Filesize
471B
MD53c504222fb6dc4d86bdc2623ed0e2b80
SHA102446d509fcdf97e3d73dda615fd5047f43b1f1a
SHA2569af8188fc30722c79d056cdea31037bdedf87ecbe24b9ecc3394f1294dd05798
SHA5129459e3138459a7cc1cf4dece0e65e3df44c606410275b5af591b8b81e289cabcc7e3ccdb4c78a60156ad89253a82190d886b1a27b6d1bf28eba374e7e1f8172a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD53d1d5019bacacdde0c697f6a19203435
SHA1568787e4719cfef0a2d76f0d2bd29d6a8208cc9d
SHA256faf9fa0e77d9f5c3e05a6590104972bb12d81009177c0cb675233c2faf66fbdc
SHA5128b13071194ad27e96aad1d33bc862530a8a953551b01daa5b67ba183bd4cf64f82ce96578da56e1c43734994f21904277b95d54937a743b55712d4757917ea43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5e4f5f17f29040c1c4a0e3e5bdb9a0996
SHA15b31a4ab8341730d61bd604a93598e560acfab3c
SHA256307f611ba9833600689a45d2d63d0f99995612755b876c532f3c4e4fccbd5fb9
SHA5124f9ca3388fd2e62d6f6434de5cdd84a3ee690e4588923359f2a3f12f2bdb57047ee1cfe179e6ab2228e47205cacac64bbfefc3db9375267b1d822b2efc453251
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5bcd1347460bb542ff32fef0563c4f522
SHA1e11715e73f6885c83e3e1c8186b54d5082f0695f
SHA2568c830bb47c9702a13237efe08498ae6ebb024e34936541c183284f77e492ed36
SHA5129f2d96dca0a4a07678f36ff613bceed9ff3e92f600bcbea15c461f1f4363e18791f1747421f3c43fcf5e2c23d0739d66213c8fa724579d4c322f882ce619e825
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD539115b67a45b37a3409af66453da96dc
SHA1c2bdc7e55d37ad303f92446a6d46e60015402ec7
SHA256cd6b7c35243d0461224ad3f680fc4b125ea31e7ef1e5d978ef6e7786e5be5319
SHA512074426a4a45a5921c7e144e457753ef4b058f6d02a2faec3ab15f982171318b29c7a820023087c7b6c6d7f21745364687185bfeaa90ac22365f02eef4f993344
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565Filesize
404B
MD53385059ae69caf7c969b5c38fe44bf7c
SHA18fa8ff51f585976a6e5a7f05cb9dee1cca8b810c
SHA256bc48520fe8eba395eae859a11b2f57a5fb5a9be48f85b580ba259ef73d846820
SHA51246d90396b0838e8786addd03664301330a5b96347400d2a4c0ff5e213e23a290eb6b442a6e10be2787292d9d1fac3215dbf140c9e36425b911fc71bf89f11df3
-
C:\Users\Admin\AppData\Local\Opera Software\Opera Stable\Cache\Cache_Data\data_0Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
C:\Users\Admin\AppData\Local\Opera Software\Opera Stable\Cache\Cache_Data\data_2Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
C:\Users\Admin\AppData\Local\Opera Software\Opera Stable\Cache\Cache_Data\data_3Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
C:\Users\Admin\AppData\Local\Programs\Opera\installer_prefs.json.backupFilesize
1KB
MD5c58cc658c0e062209c4b5d5f0e9f3143
SHA18d4f95a3bf5d9c419e66a4bf545215d00feeab47
SHA256e3fb2f5992c7eb385941e0a7f3377c498df2179d1ea6e52c4717d9984082ff06
SHA512b55d8994620fa2ab6dd95bfd2a2fe61233d0d3fc7247c659872c9b6ffcb969c4f1fba71068b8309184664da477b8bf7dff197539c201d170a53d80618dcc0d9b
-
C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exeFilesize
2.5MB
MD55cb367763221dbd12ccebb135df39901
SHA164ff8e84ce7d61abd83d7258de9014765e1c9a09
SHA2562041f38a5e4293dcc077a9b47f0057d7cfb68db5acd4f0788e00df058ba4cca2
SHA512de0513ede0bd856c24f18d9318b1de24814d7f974f288a594989f43525e79d4f63a1228bfe7908cc8f555856436c1bd0f469325aae39ce25f3b52de01585b78f
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exeFilesize
2.7MB
MD5e2d9237cd84367301a506890ced54971
SHA1767dc2158c0cc664613a77674182d66057c35896
SHA2565f112829cbcd1325e154bc421c8220114f2c7188226b4f4777f4e0215546a9e0
SHA512dad4e495cee779addc73b088bf782d6379bc7a461bf76a49769c4511cf60400b32840320b35d8cc63bb51c1b832923f3cd544739374c419878cd9d9dc4144533
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302271129191\additional_file0.tmpFilesize
1.7MB
MD50238df215bf6943892daf85de8ad433a
SHA13d905e4e2c0e9170df61b7a199321847691f945e
SHA256a7818aca6acbe347df13d51d9750f6a852c5aa2a58580f7f2015113e0a3e06d7
SHA512fc6c12e359b9a4ce84ef878f29648a4c97c38fd12ed80996c5e03829833220010fff9c751a99f399dad3529bda6438424194ed18236addfbe430343807aaad69
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302271129191\assistant\_sfx.exeFilesize
1.7MB
MD50238df215bf6943892daf85de8ad433a
SHA13d905e4e2c0e9170df61b7a199321847691f945e
SHA256a7818aca6acbe347df13d51d9750f6a852c5aa2a58580f7f2015113e0a3e06d7
SHA512fc6c12e359b9a4ce84ef878f29648a4c97c38fd12ed80996c5e03829833220010fff9c751a99f399dad3529bda6438424194ed18236addfbe430343807aaad69
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302271129191\assistant\_sfx.exeFilesize
1.7MB
MD50238df215bf6943892daf85de8ad433a
SHA13d905e4e2c0e9170df61b7a199321847691f945e
SHA256a7818aca6acbe347df13d51d9750f6a852c5aa2a58580f7f2015113e0a3e06d7
SHA512fc6c12e359b9a4ce84ef878f29648a4c97c38fd12ed80996c5e03829833220010fff9c751a99f399dad3529bda6438424194ed18236addfbe430343807aaad69
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302271129191\assistant\assistant_installer.exeFilesize
2.1MB
MD59df6e2fbb7e38964f35016bf91ef7424
SHA1d0c1266dc46814bc6165cf6a69e90581228989a7
SHA2563573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d
SHA512b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302271129191\assistant\assistant_installer.exeFilesize
2.1MB
MD59df6e2fbb7e38964f35016bf91ef7424
SHA1d0c1266dc46814bc6165cf6a69e90581228989a7
SHA2563573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d
SHA512b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302271129191\installer_prefs_include.jsonFilesize
241B
MD57fc1b2ca7fcbc427e880cd96f7d28c10
SHA16661a5193ec9d2e8274c5619af440988e7f62a29
SHA256c4357d9d7b286a62aa0edf366c2a96beb6ad915187de0b4206ee089d94533a4a
SHA5123e477fd1390486d165f6436cba9b764ec08f9b4cc60d668ca250619976b00c476b8bcbd385558dd7129bebb5806eb72c5816d68f63137b1a31fde0fb839e834b
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302271129191\installer_prefs_include.json.backupFilesize
226B
MD5dcc2d69f1839f7f3b156e8711ea49291
SHA1d980000b3dafde344ab8382b599a6b392a543689
SHA2564b755aa1f0f415f6104681e0052ef44c4bea619e7d5ddaccf44b1e524ca92452
SHA5128807334e89312113f1b6fa5d84791cadcd2d2d2f268ee0b6b5ae875da83b61848eb3f9b4eefca43c205ba9f5fc79dca8a5c130f4a26e45ab8d2632647dc52ecd
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302271129191\installer_prefs_include.json.backupFilesize
1KB
MD5ad7f09b21fb660d56e3a06317b96e603
SHA115818b9e001fa7cf3ef0e9e2dfe5ce2fcd778f9c
SHA256b347b0ae419d62b01e709c29459b22457048e4e207fb0359141c48ea18317314
SHA51210f2fabf35c6173db0448ffd70e642d995b3ddb3a579dacee273d90a09f0f74b8d9749ff95ad5fff44c9e85709619c4d309ab16ca704656078f4d7c6fa704584
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302271129191\opera_packageFilesize
86.9MB
MD552059f9908aca2af15df265bfb73517f
SHA1141ce7239b067ee7b266594ea6bb23e730f73621
SHA2567b8ee89686128fb3e73542395e49eec5da3f730039de32ac2cfe58a4e7525b73
SHA512191df166c778d6ddd9cbb4ba17d24945aeb6554183eff1084dfa07221114f3d420074176a329fb561fe75600ee874e115b7c32a4ca3f795096e907ca3f601266
-
C:\Users\Admin\AppData\Local\Temp\CabE8CA.tmpFilesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2302271129159191012.dllFilesize
4.6MB
MD59d88a4017f68b70eda415f609c3cd868
SHA17ada7e5fddee3094f47334795f866829446262d0
SHA25606325e1b492fd86cac40bc417eeed0680367e87b4757bc357464124559304f4c
SHA5121794f964bd4914b387e12e4e02fc1b117eee25b11c13d7cb0da8e63defb67dd341b9bdd5c1819f0f0ab98bb7daad6119f3434e357755df3a04ac4234b70cd77d
-
C:\Users\Admin\AppData\Local\Temp\TarE8FC.tmpFilesize
161KB
MD573b4b714b42fc9a6aaefd0ae59adb009
SHA1efdaffd5b0ad21913d22001d91bf6c19ecb4ac41
SHA256c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd
SHA51273af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.icoFilesize
116KB
MD5e043a9cb014d641a56f50f9d9ac9a1b9
SHA161dc6aed3d0d1f3b8afe3d161410848c565247ed
SHA2569dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946
SHA5124ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exeFilesize
1.8MB
MD5aa4de04ccc16b74a4c2301da8d621ec1
SHA1d05c6d8200f6e6b1283df82d24d687adc47d9664
SHA256e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b
SHA51228d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exeFilesize
1.8MB
MD5aa4de04ccc16b74a4c2301da8d621ec1
SHA1d05c6d8200f6e6b1283df82d24d687adc47d9664
SHA256e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b
SHA51228d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exeFilesize
1.8MB
MD5aa4de04ccc16b74a4c2301da8d621ec1
SHA1d05c6d8200f6e6b1283df82d24d687adc47d9664
SHA256e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b
SHA51228d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.PNGFilesize
339B
MD534b9382484083844ad9cd96c0e1f134d
SHA1c28807c9ec77bb3f1dad8812114ddf493825788e
SHA2562474e205be32a614539fadcbb14104fb1fef84c26dfb6b393afa5d0583ac41b4
SHA512744e0f1f38e7891e82c893a732d81f61b2f6584100e5df5ffcdbf154f101b2afd844b71641d5bd3d5e9422b466a0bd5384adcf71150ab2432aedd22ef98ae7cb
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG104.PNGFilesize
644B
MD5ca6d82e8421520272d3bc4f04fde8c11
SHA1dea5fcd58380bfcc889d517d750103c633f0cd28
SHA256c25b403d58ec98cf47d5e8593586b62a76db69efd52fb39983c5cb8928b2df95
SHA5125d8facc2dc7a595072d4bd0f0766413327ce58301c6bfecd143925fa3a63612da74bcdf8d2f363da538b133d81c8aec03da2cd856184330be62a8d8110b669a9
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG109.PNGFilesize
2KB
MD5fc38fc157b9cbf7ab02910c4ed55c2b8
SHA11dff59d4ac74fb9070a45a0b5b31668e3cdef00f
SHA2564802d86138d1af69ed0c8bf4b92fda816123650c616284215a24b9949731e78c
SHA5129a7c17d5ef703f1fe8804def77092f73c0e232b70da4a525f0e520557d59de3ebfd7317ef283d7f17bd6402848dbffe90e140c3a7a465ae4f448329e0b367efa
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.PNGFilesize
280B
MD51fb45f663376095db9e36f932fe43360
SHA119cc5e4cb194b21aff5dab730240ebd16271479f
SHA2565fe2cc4e72140634efea1f4ceda1b33d95f8b7733adeefd57a4fe716da7802d8
SHA5129a270426ea86d7ea258151017edc18071a1d755e34d073ea56215ddb5bb73fb52bbdfc1ef9aaad2b65ee77ad69385d14657ea08ed1a21a40397c3403e10d7e82
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG22.PNGFilesize
1KB
MD5d807ce818485dac7591c7d3086ab04ed
SHA190d9ec0448fe7b479a26aaec78e50f7b97069b44
SHA256eaa07be3dd865be9a2588b03689a3e524f0acfd8b9ffb0976202e82f5b050951
SHA512698f998a04b73ad3f0ac92ff6218f18c57a81a00104642e90b28002319bbeaf16976d2a8631c525b8b21662c2c527950cf4e7303f20b9c56ef47dc0b315fc082
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.PNGFilesize
281B
MD586f8a0a9d3c46bae28bd9fb545a7843e
SHA18eac29774c722c091557d85a1aa2a8226f882455
SHA256d31c557422c73f37b744ba6a21a395e7e371e1e2595b0ca231f449d5e8acfef8
SHA512285e43b0b5b4942b415de58e897c87de60334a905bf2253375bdae90d74aef503d795da2e528d16ceab0f11ebace777c43ea697e7dd193ba24a3ae5f35909490
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG85.PNGFilesize
43KB
MD51af3e2e782b622c3d42144e67f54aa27
SHA125e254fe1dbd0bce5410834cb426eb6ba086af54
SHA256ed56950fad13c267311244503fd20ab88d2b5aa4a94af5f17b3ffe5920d5e7d0
SHA51251c6ace93e363bf8d6034a00480ca1f19c993bca9053f3d6336a76572c9b1789889db4604d77021fba3435a4d0554b535c270dde477967aba8b188627565e6cb
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG86.PNGFilesize
1KB
MD5e29f528351d36605277ebc88bcadda23
SHA104dc938f856e1881257ba967c76083dded5e5ba9
SHA25607849d1ae7312dd8280412ad1d7444cddbff2d5157339b54e2cb9dc175c4da9c
SHA51269994bc90e8bd45bb9e41db1027f02fb694652d169408b0ee7c6fe5b0ba97f3f2ad3c03245dade3ffe40a01bf996050cdb52822b798863bcf63c1f6cee9c4b4d
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmdFilesize
1.7MB
MD51bbf5dd0b6ca80e4c7c77495c3f33083
SHA1e0520037e60eb641ec04d1e814394c9da0a6a862
SHA256bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b
SHA51297bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmdFilesize
97KB
MD5da1d0cd400e0b6ad6415fd4d90f69666
SHA1de9083d2902906cacf57259cf581b1466400b799
SHA2567a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575
SHA512f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exeFilesize
1.3MB
MD57e08af319c9eb3297e09ca7bb8387de4
SHA14cf091f77a3eb9437ef33985e64bd10c1257284f
SHA2566c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8
SHA512bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exeFilesize
1.3MB
MD57e08af319c9eb3297e09ca7bb8387de4
SHA14cf091f77a3eb9437ef33985e64bd10c1257284f
SHA2566c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8
SHA512bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exeFilesize
1.3MB
MD57e08af319c9eb3297e09ca7bb8387de4
SHA14cf091f77a3eb9437ef33985e64bd10c1257284f
SHA2566c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8
SHA512bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dllFilesize
326KB
MD580d93d38badecdd2b134fe4699721223
SHA1e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA5129f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.datFilesize
106KB
MD551be149c8e20df63087c584165516ecd
SHA1feabbb95b65e6929f086266b06ee1cfef83539a7
SHA256b949eb246d81688efea07a7655652107ad435f37d493d93dd68c88a9fe6f3e33
SHA5126f24e4caafd6af85c2f8641d7f2b066dfafa7d6abb512fa62f3642eaa42b549692b15043a3bf0e13cb1fae377fc1d3139dcf5cea3d4def24de197f75297e17f0
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exeFilesize
1.3MB
MD5e801c5847f5f9d207db53aaaf5c6f3a2
SHA18e6818ce66555e2cca92e5c5f32551fb4a91645e
SHA256196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03
SHA512303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exeFilesize
1.3MB
MD5e801c5847f5f9d207db53aaaf5c6f3a2
SHA18e6818ce66555e2cca92e5c5f32551fb4a91645e
SHA256196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03
SHA512303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exeFilesize
1.3MB
MD5e801c5847f5f9d207db53aaaf5c6f3a2
SHA18e6818ce66555e2cca92e5c5f32551fb4a91645e
SHA256196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03
SHA512303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dllFilesize
326KB
MD580d93d38badecdd2b134fe4699721223
SHA1e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA5129f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4
-
C:\Users\Admin\AppData\Local\Temp\jusched.logFilesize
3KB
MD546af2d35f8d5b9b680c978136c1d498e
SHA1ace312b5f881c8feb8f7d51a34c58d8806c3f707
SHA256109b52362eaa0fabb97d55f811b3eecff801406294fcc4c1b14ccea89a0e190c
SHA51223c0a1c4ba639b7a5572c5fa972031b61ed45f4b091d1de189ea14658e490e92fb6caa544ef82f1b95bb615ee0cdb82227f7aa8e8c27349987a9faf03e02eff5
-
C:\Users\Admin\AppData\Local\Temp\jusched.logFilesize
5KB
MD5c7b94ec1c24b6f7977ba48a657d9134f
SHA15196cc31852f739f7199796f4942bfc6f75364b5
SHA256270dfc78b829cb17d23b5210b3a600bc532c7de548c359d66d394d05eee822bb
SHA5125a6485d2b341819e350e96426fff1cd70c4100f6d0937f1dc6e384b3d3f4d45f7dfa722851816d5345e9748c2d2800344457e3b666d7b7d78e6cbd6a09d26ce9
-
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exeFilesize
2.7MB
MD5e2d9237cd84367301a506890ced54971
SHA1767dc2158c0cc664613a77674182d66057c35896
SHA2565f112829cbcd1325e154bc421c8220114f2c7188226b4f4777f4e0215546a9e0
SHA512dad4e495cee779addc73b088bf782d6379bc7a461bf76a49769c4511cf60400b32840320b35d8cc63bb51c1b832923f3cd544739374c419878cd9d9dc4144533
-
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exeFilesize
2.7MB
MD5e2d9237cd84367301a506890ced54971
SHA1767dc2158c0cc664613a77674182d66057c35896
SHA2565f112829cbcd1325e154bc421c8220114f2c7188226b4f4777f4e0215546a9e0
SHA512dad4e495cee779addc73b088bf782d6379bc7a461bf76a49769c4511cf60400b32840320b35d8cc63bb51c1b832923f3cd544739374c419878cd9d9dc4144533
-
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exeFilesize
2.7MB
MD5e2d9237cd84367301a506890ced54971
SHA1767dc2158c0cc664613a77674182d66057c35896
SHA2565f112829cbcd1325e154bc421c8220114f2c7188226b4f4777f4e0215546a9e0
SHA512dad4e495cee779addc73b088bf782d6379bc7a461bf76a49769c4511cf60400b32840320b35d8cc63bb51c1b832923f3cd544739374c419878cd9d9dc4144533
-
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exeFilesize
2.7MB
MD5e2d9237cd84367301a506890ced54971
SHA1767dc2158c0cc664613a77674182d66057c35896
SHA2565f112829cbcd1325e154bc421c8220114f2c7188226b4f4777f4e0215546a9e0
SHA512dad4e495cee779addc73b088bf782d6379bc7a461bf76a49769c4511cf60400b32840320b35d8cc63bb51c1b832923f3cd544739374c419878cd9d9dc4144533
-
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exeFilesize
2.7MB
MD5e2d9237cd84367301a506890ced54971
SHA1767dc2158c0cc664613a77674182d66057c35896
SHA2565f112829cbcd1325e154bc421c8220114f2c7188226b4f4777f4e0215546a9e0
SHA512dad4e495cee779addc73b088bf782d6379bc7a461bf76a49769c4511cf60400b32840320b35d8cc63bb51c1b832923f3cd544739374c419878cd9d9dc4144533
-
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exeFilesize
2.7MB
MD5e2d9237cd84367301a506890ced54971
SHA1767dc2158c0cc664613a77674182d66057c35896
SHA2565f112829cbcd1325e154bc421c8220114f2c7188226b4f4777f4e0215546a9e0
SHA512dad4e495cee779addc73b088bf782d6379bc7a461bf76a49769c4511cf60400b32840320b35d8cc63bb51c1b832923f3cd544739374c419878cd9d9dc4144533
-
C:\Users\Admin\AppData\Local\Temp\setuparguments.iniFilesize
602B
MD5efe450515cbacc1e546ec1eeae6dfd52
SHA1eadd57be31ff9aa68fde3d2351c6c080af640306
SHA256f4716216c52eccb8d07f987e82cf1f58412156c67e38624f95e4fcacf24a1e72
SHA51247b229fe6e974cab9a2e4887df913e87c344323df12bfb7e67227ccf97e04b8bd19f0694996ee9daae0c874119aeb45329ef49d9bbec66188c254f14fd0e0fb5
-
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exeFilesize
5.2MB
MD558e22c0ee91280156cdaadacac7acddb
SHA1189c552c94a9b0ae0208763bca77f2801debc224
SHA256765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714
SHA5129f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6
-
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.BMPFilesize
451KB
MD50b445ace8798426e7185f52b7b7b6d1e
SHA17a77b46e0848cc9b32283ccb3f91a18c0934c079
SHA2562bbf97ccba3f87d469eac909c4ce8a3f13ed29c8f31b611e7d5cf89a0619eda6
SHA51251523d5b711481293305465a3a3c6a3a50dca984cdc8cca1f4c44f3c21bfa430cd9aac1a8782d9605e6954cbafb307beb6b1a52e9785de1bc3f71067d80c6b6e
-
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG23.PNGFilesize
1KB
MD52684a1ed513d8adcabc3bd1cd7e473cd
SHA10690eb4427754fe55cce82db82fcaa422ea7bd55
SHA256eccf440f384eb9054baaaf1131f636d051942386650bb9ee31f78cd548d75d29
SHA512b2d3bc45ba4e17ad3ed1ac176f5fd525b299ec8df9f286dd0057b67e38b932d36839af2ed3c4c5a6e5e8f01b20b7776fd8bb7a4864e8a4fc36402367d6c56e61
-
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNGFilesize
45KB
MD57ccd3fc84935804f0f526cc0a6363349
SHA1ac0d2026c8812b7909c9fc5c27e1132c95d7a10f
SHA25673fa75e621b6cf62090399d7832f08f37e991148f15d7606aedbf923ec833c36
SHA512ab496b6ca26fed184e00b2374ed2fcf5f7195ae886692d585f685dc370b6485ef804f180f974b84cbc174c529b6eb6e0ae4f61ddf8e7828042fb8403da9e91e1
-
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG41.PNGFilesize
457B
MD582f9d4d69207053f21d3032b3b4a5665
SHA10d490c22242ee953ac1d4b34c7568dcb289e8241
SHA25660773aa4f64d139a8c6d44fa0d027a401a2dcef1f44de48bba104359a86b9b31
SHA512f9a78b440eac00ede67d539899f9472de51b31c88c2e5f83b752dedbfcd7ca0f9a827c78103ef02a8201420603b421204cb8fe821a24d858c64ef6457c052fe5
-
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG42.PNGFilesize
352B
MD55152c9182cde951170e38aa8477943c8
SHA1d1753dfab280ffb6dde5cdcd3ebfa10c01b337f6
SHA256d76a808ac0bca36c95cc236e9ac2a14ff55e0257db19be95e7d084ee917dd4aa
SHA512eb1e0ad4dfad344d6d9cb185bc5a3fd9d98f9ce1a30a0a9dffda7fbab83d945ad501f3008607a26006396c24cba211a629f24a244d3b664cbd33346d8fad15a9
-
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG45.PNGFilesize
438B
MD5e65fa73caf1c2ba69052baaf86873db3
SHA1e13e1e53b05365b93dd2092b1350ed1c2973eb01
SHA2561f08862ef6969b8819a6307378dde0926854daca82f0ab9972100e5f92b96fda
SHA512cfcdd2ebfa0d83bda0725f6af8f2b4163d82b4c9f26cf01de48f9a3ae69c6b9283404240e0365d3c746b2b51b2755e41395b3b78bab8e6c713371ef4a60c6a52
-
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG46.PNGFilesize
206B
MD56182adf3942819a755e1c2d55ff5af0c
SHA1c2eb79e7b308ef87be3095c954bdd4758ed8334e
SHA256e96cf2d137a32c95499af9f9fdd6bcbec0541dfd796ba66ada600dbe3728fa56
SHA512e2ef7111e080760391069f014f997c91f9d5aef63144424aca4b612f7e555956f40f7f0faee7db68ca61d8d2900189f91135b00463bcf70153d624c2a3e8d834
-
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG48.PNGFilesize
1KB
MD57bb97ea0561e147e5c859a184e724101
SHA1b48e79f96f22c8bbd9b0a0cb3b33d476fcf245fc
SHA256dc69aa58a2261c5629b5aa5e38169ed4190c651fddae856f09d3216e5ba694d7
SHA512a9a23f9677b96ebb041598ff3dc8a2c53e3c36bfca1665af69b4c188b01ad2b37501039b41f2c80c37171073f1b6be5b28d23b8cbbdd399008ac9fa265fb0e7c
-
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG5.PNGFilesize
1KB
MD5c33494962486b6c66753033da0637e7f
SHA159c6b4bb862adcb24abcc3660aabbc36c4ac797a
SHA256caa23e63c2e9c0a6572f0db25c8e3490b9c866ede63315cd4688ba297404a838
SHA5121cb4b7cf8224f01d2ca2667a0762c529913157d38209d04801c09880a3bfb8dec14c696e477827f144f992483a216e1d5b430a16244b9ce85cb24b8e2a57effa
-
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG66.PNGFilesize
41KB
MD52ad8515432fc7c39b4aa6769bd91fff2
SHA1f450f078cc7ad04373bc6e7c30f19aedf24bb1d5
SHA256c4e842fce8568dd11cce378e5208ff344b5ad36055504853ea0ce307455a26d7
SHA51204e007aad7c07edaff7d3add4def6378c1488155e3dda3ebfd0e3371dd898649a67a468f3c29b5a8db0ab3640015e866d2b4deb6caaef7305c564d2fe637000c
-
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG67.PNGFilesize
1KB
MD531138426dfa172edca26189a966c47e3
SHA1fd7805dc98639e2c7cad028a0643310fd2fd3321
SHA25621facdf3388ec5cbbf0f4e2e283cb8dd5e6e22f4649284c2b6531ba60ed42159
SHA5129a09815e02ff59140fba8b92594210bc8bcfddee461a6a7dd8280264e79e305d4535bb022083282807d1d0e0eaca342a015745ec6587d0421e415bb986338293
-
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xmlFilesize
34KB
MD5ba1102e6618acde417b4d5ddbe8ea6df
SHA14d6f6a6ec58503e82c1dcebb9d7e2c55dd0670f8
SHA256deb64c3d53fdf963189acd2843e9f146f6dbd22b9af25f3fb34e6bbb5ac6cc25
SHA512edf19ff2c8e7a9accf4e26a62febe653d6b313dff9c77253e689f1f02f31c44143aeee55a71aaeea0d6e1ceb2e3afc8568a39de2982ba81779ce6761c87bd96c
-
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xmlFilesize
14KB
MD5997e71a5c3c435f71a8a65f2ce9de723
SHA11956ce5747e69b33eb3bd099be16fe575a0fbdd9
SHA256f28798312905e80c272a202abd9a8575f43cffa7ddff2f32f6421fd76714be29
SHA512420a47050af5b403169b43d4bf19eb485b0906996254c420cd700a683ea5b2956e85a7c7dff6de227dee7b5c010dea98bc5f82fec1c35d922f8f29c566ea5cf8
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Opera Browser.lnkFilesize
1KB
MD5392cf04a270447f4920f9b6637d2ef44
SHA1dbe406909936229939d2907191def68fe6b7dc3e
SHA256f2352070e02b8086fa51cc7be102cfc9b97a053311aac4ceaf2b15920bb0f534
SHA512300fbcd455aab3a16b4d7f9eefca4a3a0304f9c32c2ae5605529e0ebba7d7d21ed861f88b266ba9b55480b00ceb1004f5057bbb4c42c79e103fc3b725a0514c3
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\2fad9064-240a-4bf3-9afc-9a97ce19c90f.tmpFilesize
506B
MD560a8880161865332fd8a4c36f5bf23f5
SHA168dc0788d7997498ed2a1d370259aa46b23dfc39
SHA2562ddd43335111b0ddaae8769c4163bba5b161fab03d253adfde9e1a5b81974009
SHA51222c149ccb69b8cfd75802ee1fbb9fe87e2173f3a602ac6ee264907b597b85ddcf0a61ac8f6fc3418e6a8a3d4d78ad64cf1ec0626ce573ec52b0c4e2731dc2506
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.datFilesize
40B
MD5093312c53f2c3749cb28e9a2f32e7f1d
SHA163d7e4805b180d26de050ebbf32cdfedd5c16286
SHA2560060f97c9ab385ed41e9359cd96b6363f0bc6534869739bab36072fef63397f2
SHA51233a9d7f572bef1091d02077bf7f0fea5ef66a2bd119ff9fce6938f3289b82cc40c9b0d7e8e15b00301e2356db1b389afc1ea13adbad5cddd345c6074ce49f351
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.datFilesize
40B
MD5093312c53f2c3749cb28e9a2f32e7f1d
SHA163d7e4805b180d26de050ebbf32cdfedd5c16286
SHA2560060f97c9ab385ed41e9359cd96b6363f0bc6534869739bab36072fef63397f2
SHA51233a9d7f572bef1091d02077bf7f0fea5ef66a2bd119ff9fce6938f3289b82cc40c9b0d7e8e15b00301e2356db1b389afc1ea13adbad5cddd345c6074ce49f351
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\DawnCache\data_1Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Local StateFilesize
1KB
MD5f34d82d7c89ea9c56523c69c69ab8252
SHA1005c6e14e9d941838100176dd69b4f0aae38e43d
SHA2567d495b4e328071007a861d3d967621f6bdac5686334c077433f8efbff22040e9
SHA512d903d9cc9379f4e86c104e7fa00bc75e180585b9c2d0c7467a1fe65365e8638e5f3c35eff6ffee5c25d94c92f726afbbcb1544ff9ab9722d146e40699e4677cd
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\PreferencesFilesize
6KB
MD5aa793fb52c5178e27ca3302543ffbadb
SHA188a17a8862fc101b8c12b629434752104662e5c6
SHA2569fed7cf5eab7cdb51dcc42d631f6103c657cdace4c20dc6fd556069340746e1a
SHA51293abce2e15e162e323485c4b017e97baef14668efabb426e44baec9a617c9d127b0f7dfcfcc985834d4ce673add0983c5f81eacd41cc0d301fea69791b7557b5
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Site Characteristics Database\000002.dbtmpFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\StatsSessions\session_46ffecc6-1713-48a2-bf1e-34ac7280dbb0.rawFilesize
461B
MD5655ed081cc6a640976687cec2914325d
SHA12db0ffd1453c945c82dcf77bdd021489f1e89981
SHA256b879494190c6d9bc05ea009386c5af1af1ec9c356169f22248739bff36316c39
SHA512ba0e1bb15998febec3e0a437df40cc934860e6560744cd0f029df6cf61143527a0075e851641c509b836c12b9d4519320374fc6d303270271cc7bc89ad203251
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\StatsSessions\session_46ffecc6-1713-48a2-bf1e-34ac7280dbb0.rawFilesize
557B
MD558b8bc648342d8db5fed943b50239188
SHA11730100fa061e968830fdb9396fa0bdf3ed4c5c4
SHA256b1070c8ff639ef138a3168764918f919d63bbd656d0ca99ceda981bd9aa755b5
SHA5121efc3d66fed92246c5a3e007115f9ff82d1f3a348853cffc781025deb3d59c052a60e775a3e0012e185596d64a6aa3cd7e386987239cef2d9023d388e2e72db4
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\StatsSessions\session_46ffecc6-1713-48a2-bf1e-34ac7280dbb0.rawFilesize
717B
MD560a60359c746c763614ea849a5ac7862
SHA1cac4765dd5236ab396b17092202fe1e5161ff3a2
SHA256a18608bc8fa2b227021cad14185071f0e038fc20f46891e1d5bb37df296ce8ab
SHA512673fd0a8291baff45497cb4000599623a4ad336f5bac8c6c4db58e9064f08d41d6b824843043a4a09ed850f089a431b5c62ed030619628007209073511acf227
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\StatsSessions\session_46ffecc6-1713-48a2-bf1e-34ac7280dbb0.rawFilesize
941B
MD593730b7d30ae1ddc5892f128414f7952
SHA1e61276928d423b766015c523de08cc448b61339a
SHA256820aafee4237fcefb4d41b5ce13a1412d128cc6ca1e1cfaa0659676e6bd977b1
SHA51202e6d3298bebe2b3e6acf702ae9c98362392f4c2704f9af274e6d0050a36d7c0d6a78d2b43228be3afb06af120034a48cdfe17391f93beb1a38f9337630f4749
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\StatsSessions\session_46ffecc6-1713-48a2-bf1e-34ac7280dbb0.rawFilesize
1KB
MD5fd28676ea678f5bb4c87c80108605e89
SHA1e305a995d88feb50665f4f817936e38574a43009
SHA2562e8c8828d6c742ccafd4a408e820de7407933c857098098f88b268a500e63dff
SHA512a82430f843dbcbb330783ff086a5729343dd838b436e4b972b88c884482c2f3947748b02393a47da5a309e5ef87b16e56f78bba1307abc5fbff46967e07479e6
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\StatsSessions\session_46ffecc6-1713-48a2-bf1e-34ac7280dbb0.rawFilesize
1KB
MD5f72261569d205516c59da09263b17216
SHA1415fed8cca1dcb1e97ef8c93499405253a47a9ed
SHA25635e556dc0771939cf5b0db130df53fd029541d264094db6f9c87a9013475131a
SHA51213cc7038a79a6306c212a3e0b87328b21dff583cbfd5b6e0b4a9fe75fc11ed1d5fa3c789f951122086340d67b74b18774bd9239493390b6dc3c0109bfdcbcea0
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\StatsSessions\session_46ffecc6-1713-48a2-bf1e-34ac7280dbb0.rawFilesize
1KB
MD56233dc80112b479bc78b8772a512bcfd
SHA1dab1b34479f548b1eaa2cebccb165c1c05844842
SHA256925fee225c6f9ea1db43fb2c16dd233998c4e3a139d489dec0a518f79e581064
SHA512bd9aa85e09aedea7190eb9f67d989dbf15d739e017b43c1a94874abe1ba0c2ff24d20b3c2c9ef14b7a08fef77bd9b1174a70b46362bb85c5dca4539e73104f74
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\StatsSessions\session_46ffecc6-1713-48a2-bf1e-34ac7280dbb0.rawFilesize
2KB
MD58cb54098db3885303f4b734d33f7d4c5
SHA1a1e3fd5e68fce2dd637efe36363251534ce72811
SHA256d1ead74a86547fad2de41df020c85333320342c71ad07e7fd171a6233116aacd
SHA5120ab539f34cf0f2ad998ef37f56a78f206947f3ffd8b4cda25347dfb40c08778410121bbdea17a7c95b105cc5c263b92f3368b718a5108f23b2efbbc2e96a6f97
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\StatsSessions\session_46ffecc6-1713-48a2-bf1e-34ac7280dbb0.rawFilesize
2KB
MD5376130c38df83b19b8f65635edf1b427
SHA1d6ecd34aba23f27f985ed50c34637308f3399632
SHA256355f4a56d8a26cce30851b23192e59e6c950e724eb7ed918114cbf8a7a0c30c1
SHA5120be7fa28505511c1318217009abd223d5af172441f3be0fd1af5525963d7a1224c3a9408de6885ac82bbb917464ae8f16139830a6d2e2d1bc1682671d3f3d993
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\StatsSessions\session_46ffecc6-1713-48a2-bf1e-34ac7280dbb0.rawFilesize
669B
MD5041901da2c09bbc47779785e4cd3b393
SHA15215e4c88fb39b653e2980f45899d7f6fe37a031
SHA256f96eb80ff8ec9ba76f393b570de3747e1b491fe1cbec0ee456fffcad7cbb5b8b
SHA51227b4df72cf504733746f4d0f1412d3d9fb126a5738c3afe7d6cb4277420d494105e0bceec42c3fe69ae1fd60611df28a20f15254a7267546bac50d838bf71ee5
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\StatsSessions\session_46ffecc6-1713-48a2-bf1e-34ac7280dbb0.rawFilesize
749B
MD5ea1407748c07adb3b516fb8d509a41cf
SHA194d49d65dcfa659407bbc8e0ae836aacff853073
SHA256941725c46ae581cce377ce1a8921bad99069ef0367a18ed7d72233496f032e76
SHA512ae36a7c68e870d7b9582216cb340f296435b159c4994a8c9755691f7c7c6eb6ace040d642cbc656491100d43e88b7769c02315b584dde076e00ff84766f36cfb
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\StatsSessions\session_46ffecc6-1713-48a2-bf1e-34ac7280dbb0.rawFilesize
845B
MD5a89f4090d78604f2df1b7744b47224df
SHA16335b1eb01b5f62b26bbcde6860453e33518ab7a
SHA25673b4ffebaef4251ca9413f331a578ca7b516ca02570d11b182f664070ec679a1
SHA512351db71c1492c79041ee4b3ac8dcf1b53bd8f84dc4d8f2529f21671683703e7b634ce992803bd505775a9dee6e27de43b62c0269783d5d16a6f6b0fd6f7f66fd
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\StatsSessions\session_46ffecc6-1713-48a2-bf1e-34ac7280dbb0.rawFilesize
1KB
MD53e36a58835468c2c90574954ee7e3e76
SHA10ac49a7e960f9390dc7e2d82ada210f12b295920
SHA25606de34f4ccd495b51663060df74ec830ef1eba988ac80fa3fec762396db3e896
SHA512e607e07f9c5a3689ec759c3a0666e900a23e473bfa31c7d294e6b688bfaf4a2efe2298e0c41265791e76749ef726e03c3021a9a3c930507be46de3977b1e9ba0
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\StatsSessions\session_46ffecc6-1713-48a2-bf1e-34ac7280dbb0.rawFilesize
1KB
MD55d59ae66ae2da0659a4eff3b47efbf52
SHA160a68f8d8ab1f3dca40ceca9a08402868291d84d
SHA2564cddf2d90b377a0110d289edfd67de4109a3cdad0994be8d972564bd2a9215ba
SHA512cf7b23c5d6d887a2d7317b9accb61939dc36c8e4569d7920054a7cbb7ff74bd8c8c1c6fda4fde8407c0fade16f56ed47d8932916218bbab6c9cea79751a4abaa
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\StatsSessions\session_46ffecc6-1713-48a2-bf1e-34ac7280dbb0.rawFilesize
2KB
MD5470ebe9749fa8883cde9f5f859e019e6
SHA18c8a4635ec737b083fec308b1996d80f4f2b6646
SHA256d5b97a2bdcc14938b41cb552b2adfb9e34bf295104075f098e02683aceef3806
SHA512d76e990e160afb6303ea070e3e8706a76abca058682cfc2e3039c64f1b7127a2ef3965fd3fd6bbe8e25c39e59c04d3a792483ecfeee2aed9d92c0a301c188154
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\StatsSessions\session_46ffecc6-1713-48a2-bf1e-34ac7280dbb0.rawFilesize
2KB
MD5b37f45fc3de3fd64edbc628917dbc5b5
SHA11230cdbb4e0ef61d0d8ddaff6223df4a952d1a13
SHA256ce586ef673ab4b7eb23867f248ce97fce07235418de42bead21679f56c5a5364
SHA512282c3f2589c334b955c1428f9bb1e62437cdd4f11140fb3da23f8dbef9026d0d8d8e59a9c982a736705cc018ae89486e766b63c3a84714f1803868e317bf5ee3
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Sync Data\LevelDB\CURRENT~RF6dae1b.TMPFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\shared_proto_db\metadata\MANIFEST-000001Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\ssdfp2216.0.150531650Filesize
445B
MD58fd189cac7d6a2aefb060208e8be2eaf
SHA1c0cf22851ea651f484e197193bfc1fc2d9807de2
SHA256205c896542637d09e573713b40bd1b803476dd0c7103379d6fc4fa4d4f25294f
SHA512cc36d1609747c9357dcc03edf404c3721c46a81d062fae3e966a71a1e43a5f5228dbadf5ed06dc6e790698fbee99ce6ff8cd397e819f660f36c4fc2c41628c86
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\ssdfp2216.0.150531650Filesize
1KB
MD553680fee91d89b7b9d3c91dad97db514
SHA130500859cddbc8f161418151de003bca58cd20d8
SHA2561675bd6d24a529c9b85fe46863b8fcef174ff06ea15490c12753dad509b78ef3
SHA512dc3146678078c9e48d151cb0657c5abe9f2d7475a82910d458d15471bc30c57a0670e25ea2a8ed85f931af1eb1bddf6d7cf2d971c4558201e2b59a0fe25a9ed6
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\ssdfp2216.0.150531650Filesize
2KB
MD5320f93811fa10eeb4f1d426f10e0ba98
SHA1b01a7a7af7786a013cf2e5a8dda45a87ec29e837
SHA25692a46de863477074b506e935f41604575de7eddea0919ce091bb3b9e6ef1d3c6
SHA5127e53c64ea79a38247aee8be30a9b703872466a69920d731684f4c06771791aa411b22a709d5d9a23bce21d09d226c41b63d26b34586613c7b9a4e92dd31733dd
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\ssdfp2216.0.150531650Filesize
2KB
MD525073a421798135712de4f12d4bedca2
SHA1f51e549388b47e7b47e9a2d0f2fe985a70fb0c61
SHA2562c3398f9016b6c20086da5c152f63027f583656ad708778f5d47ff0a3e09e66b
SHA512f516516e70840f9348dd33aa338b1709c0410a3069507167d7fef9f9ad3fbcc28882f02973e546e1b3bc62dc4ea03feee43c8e89154ec25dfeb0ca378edb395a
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\ssdfp2216.0.150531650Filesize
2KB
MD521118666591c2a2378ecbb3aaf1a8bee
SHA19a1a0d7640b413eb84d47bc97fb471123c0c33c6
SHA25668254d3b8735f94f95ab04e9063763773c510b56a0caa131bbbaf89b84e0da47
SHA5124d1bf9f22bea4b21ef5cb665d82b59a13d0f196edfd92ddfc69a381d836b68a794f49545787f0fe694702ee6d4fc08588aec9ed4d543f1adfc851e83b2dc02c4
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\ssdfp2216.0.150531650Filesize
2KB
MD5987dc54b0d007b0ec37c29d294b897b7
SHA127a6f97e5297d96d13ca0387ef250d2125d32c5f
SHA256ee0871836dd92918338af18b4283d10573b4a9f6b3735be755990b3be7608c32
SHA51240b76e69a6371b15762034ea11f61ca7fd8e7f26bee29b06fd8c24ceb524f2edba4f686fccea28ebea2c232e242227157b1164932a8f61f4a78c7fdec7af2313
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\ssdfp2216.0.150531650Filesize
2KB
MD5b89ac671a29c2560bd3bf170d1390ff2
SHA11742f0ebfab16047904c24ebd0aa9d8f186c8efd
SHA256de23d32311215188a8d9dfd832c0c686baf8c0da0412ce8166fbaf8ea0b2c895
SHA51235ee2a49d95b0b928a365235899ba39581e5e043c226d0445571aa0860135437839ea3a158b5e5b19d8471fe0ca3c0790b8723e225863865ae6624a80ca4814e
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\ssdfp2216.0.150531650Filesize
3KB
MD5bbe95c47bc52ac7e1d7dad1bb7977a3f
SHA1b76d0d83e859619c5e2ca7c44db0dc248ab52455
SHA25676155e8b031fdf36bcdc041efdfc4d325090212e1ab69aa9a116625daa6e7784
SHA512fee90f0f911618789b9d991b2313e296767306fc0b4061dddb62869247cefd2ef72083f03cbd017ac67a95ab121751365bc5c4ba6ab86a4cba9f882bbfe6ed35
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\ssdfp2216.0.150531650Filesize
3KB
MD5710d67cefd68138bd4f4c54ffb8d267b
SHA13601715db05f66dff85e8631ef71a0a14597a005
SHA256b4a6786bf0c8636940119e1e0e5511e0538cd997ec694e6dfcaeb8596f9f144f
SHA512d0f19205b811e41c707c0c4041ce61d7e45e2dc8d04e6a2fc2886cb88eb3927bcbe7c84784c301f703e4905138fcf40255ab3f41ef4635d352663e0370815822
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\ssdfp2216.1.611334027Filesize
292B
MD54a49d54c32acd290913785314c931dba
SHA10ddca1503efe1c4ffb0aef73f619e8013ea800f8
SHA2560a25da373363c3cabd9737e430474b9f9d9c22d4b82f09c44ba60726a4b2028f
SHA512087c19f9f183375249b78855c172a4a8aca861e8f59f493aae2309a2db7a4de35a90ad76c24f27ef669a2b4e7e6a288818f6e979a0259f8dc81da365c12bfe64
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\ssdfp2216.1.611334027Filesize
224B
MD586a8a11f61ee4def09eaece69ba98b2f
SHA1fa1f669024b60143078b5081ca832b7e2192414e
SHA256234d003e6886c802098c4ffa0a19a17ffdc32d528deae9a42af0b6014af1eb3f
SHA512e9ad2f8f314a333be1dc6fd524c596352ca0eb3a9724df02dde518ba66bed00f9c50052a0347de3c4194db4ce0d7cc1a2296d574135663533779990edc0093bd
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\ssdfp2216.1.611334027Filesize
292B
MD563cc5eb246b9f5ff89c64f3e7f72c7c7
SHA1b1327b24788ddaf87b4f5e6c59f2026e6266bc48
SHA256471e0b589a5d1d61a924f6220c6ac61e180b3649852a68ce3ed29de2f770110b
SHA5123b80cda184959a3af4abc8acdd727e17b91385334f08561116fdb7e33a9d88fdfcf5eccc0102b44b9cac9d4f3a8783cb342d2f0fb0c351a41c5ee8743aadd178
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\ssdfp2216.1.611334027Filesize
200B
MD5277cc7542b4f26b235db032c9a8bed40
SHA149a46203ca97a2708b5f003cbd963d22a8ab417b
SHA256b86d1b476a620b4afe5a51f5d224a53411f18afd48a380d6cafb201279675751
SHA512de4ed93243cfd9707c639f862275a10002d9b4b1bde9a43b50b81f5c29f1237d585c4daf2276f2baed56ab4c83d5fb3d2fda7b0962845b4e846a878bf9d483da
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\ssdfp2216.1.611334027Filesize
224B
MD50143ef149cdc99b580bb9656c4a6d60b
SHA15bd467d043f619261cc7c9f52396a0ffa0259f29
SHA256c8546c75f3096c4ce9a9bc93d9b70844671eeb8f85e10a9ace349c2ef1b0c8c1
SHA512a33ba38fe25f407354a8948b0bf397f1908531a75712b2c3204c258bcab9f92927be90c8e7eb31448bb232bb2a9071e158318b06720048081d36a4ddd8e20df6
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\ssdfp2216.1.611334027Filesize
224B
MD56bba539d4800ca7936ae067580be227b
SHA194c68ddff3dff47e6557fcb826159793e506ba77
SHA25619a3f82aaf1b578b6fdd63d3dce3e42f65586966bae3e268a4130b040fbf2638
SHA512f756dff5e27df910fcada0cce303210843d096d48a8f5d27caef3f30cea3acf128548730a1151bfa875a7619576cedc4cdd1ee80aa1a753d588f648bd00942c0
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\ssdfp2216.1.611334027Filesize
255B
MD58419a5ddf3c9c0895b4098f43417d823
SHA134e8541fbbc11c1acac89c4d8b36f1a166bbde0f
SHA256f669ce8231cec8c64c89c705ef57a8ca1bcd84f915f5b3a7851b4b154b36a9b4
SHA512db72bd6e0681d630e0b4f00eadc2d5e5916cfc87cd56df2441a311f5f6fac4fc006cca4dfc5161484748f4aee830873a2ae64254f01acc3301215709ef188548
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\ssdfp2216.1.611334027Filesize
292B
MD51d93782904812011157f483f0e6631b8
SHA1c7c1a262c5087ec43ca5b1c85c23c1dd0fbfe905
SHA256896e9194be24895690350d53269a0ac35d09cfe569bf0e868cc9604450782e33
SHA5125fbf2fdcd1722a9156437326507882132e92f4a909ee2e32bd31e59f9dc134e59537421d70de4cd57fa1f6c310e007c0ff379846867896ca5af9cd3930b76936
-
C:\Windows\Installer\6dc006.msiFilesize
81.0MB
MD51794aaa17d114a315a95473c9780fc8b
SHA17f250c022b916b88e22254985e7552bc3ac8db04
SHA2567682233d155e6d19f30cf61b185a02055be0dbcacd2c9accf90a99de21547eb4
SHA512fb9defdf73786528e82ffc7e1ccfa03cfb687365ec740e9620993da785414306f03a7e1fa523192a9d690a882b012d1e426afd1757639f3ef5f1e612c01e6516
-
C:\Windows\Installer\MSICBED.tmpFilesize
757KB
MD562cfeb86f117ad91b8bb52f1dda6f473
SHA1c753b488938b3e08f7f47df209359c7b78764448
SHA256f06cba20bd40e9d841add1877cf8d3b406f0acfa4800b80ae041ed3cc374eb7e
SHA512c1b0e76cee4e2c3ca604dcc8f5665e72e70008acc824e20d89404f139d7e7e789e99dff131dafd76409f6ea0a813aa136f96089fbdadcf90d6485b1807762e4e
-
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exeFilesize
2.7MB
MD5e2d9237cd84367301a506890ced54971
SHA1767dc2158c0cc664613a77674182d66057c35896
SHA2565f112829cbcd1325e154bc421c8220114f2c7188226b4f4777f4e0215546a9e0
SHA512dad4e495cee779addc73b088bf782d6379bc7a461bf76a49769c4511cf60400b32840320b35d8cc63bb51c1b832923f3cd544739374c419878cd9d9dc4144533
-
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302271129191\assistant\_sfx.exeFilesize
1.7MB
MD50238df215bf6943892daf85de8ad433a
SHA13d905e4e2c0e9170df61b7a199321847691f945e
SHA256a7818aca6acbe347df13d51d9750f6a852c5aa2a58580f7f2015113e0a3e06d7
SHA512fc6c12e359b9a4ce84ef878f29648a4c97c38fd12ed80996c5e03829833220010fff9c751a99f399dad3529bda6438424194ed18236addfbe430343807aaad69
-
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302271129191\assistant\assistant_installer.exeFilesize
2.1MB
MD59df6e2fbb7e38964f35016bf91ef7424
SHA1d0c1266dc46814bc6165cf6a69e90581228989a7
SHA2563573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d
SHA512b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e
-
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302271129191\assistant\assistant_installer.exeFilesize
2.1MB
MD59df6e2fbb7e38964f35016bf91ef7424
SHA1d0c1266dc46814bc6165cf6a69e90581228989a7
SHA2563573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d
SHA512b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e
-
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302271129191\opera_packageFilesize
86.9MB
MD552059f9908aca2af15df265bfb73517f
SHA1141ce7239b067ee7b266594ea6bb23e730f73621
SHA2567b8ee89686128fb3e73542395e49eec5da3f730039de32ac2cfe58a4e7525b73
SHA512191df166c778d6ddd9cbb4ba17d24945aeb6554183eff1084dfa07221114f3d420074176a329fb561fe75600ee874e115b7c32a4ca3f795096e907ca3f601266
-
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302271129191\opera_packageFilesize
86.9MB
MD552059f9908aca2af15df265bfb73517f
SHA1141ce7239b067ee7b266594ea6bb23e730f73621
SHA2567b8ee89686128fb3e73542395e49eec5da3f730039de32ac2cfe58a4e7525b73
SHA512191df166c778d6ddd9cbb4ba17d24945aeb6554183eff1084dfa07221114f3d420074176a329fb561fe75600ee874e115b7c32a4ca3f795096e907ca3f601266
-
\Users\Admin\AppData\Local\Temp\Opera_installer_2302271129148431644.dllFilesize
4.6MB
MD59d88a4017f68b70eda415f609c3cd868
SHA17ada7e5fddee3094f47334795f866829446262d0
SHA25606325e1b492fd86cac40bc417eeed0680367e87b4757bc357464124559304f4c
SHA5121794f964bd4914b387e12e4e02fc1b117eee25b11c13d7cb0da8e63defb67dd341b9bdd5c1819f0f0ab98bb7daad6119f3434e357755df3a04ac4234b70cd77d
-
\Users\Admin\AppData\Local\Temp\Opera_installer_230227112915498616.dllFilesize
4.6MB
MD59d88a4017f68b70eda415f609c3cd868
SHA17ada7e5fddee3094f47334795f866829446262d0
SHA25606325e1b492fd86cac40bc417eeed0680367e87b4757bc357464124559304f4c
SHA5121794f964bd4914b387e12e4e02fc1b117eee25b11c13d7cb0da8e63defb67dd341b9bdd5c1819f0f0ab98bb7daad6119f3434e357755df3a04ac4234b70cd77d
-
\Users\Admin\AppData\Local\Temp\Opera_installer_2302271129159191012.dllFilesize
4.6MB
MD59d88a4017f68b70eda415f609c3cd868
SHA17ada7e5fddee3094f47334795f866829446262d0
SHA25606325e1b492fd86cac40bc417eeed0680367e87b4757bc357464124559304f4c
SHA5121794f964bd4914b387e12e4e02fc1b117eee25b11c13d7cb0da8e63defb67dd341b9bdd5c1819f0f0ab98bb7daad6119f3434e357755df3a04ac4234b70cd77d
-
\Users\Admin\AppData\Local\Temp\Opera_installer_2302271129200221348.dllFilesize
4.6MB
MD59d88a4017f68b70eda415f609c3cd868
SHA17ada7e5fddee3094f47334795f866829446262d0
SHA25606325e1b492fd86cac40bc417eeed0680367e87b4757bc357464124559304f4c
SHA5121794f964bd4914b387e12e4e02fc1b117eee25b11c13d7cb0da8e63defb67dd341b9bdd5c1819f0f0ab98bb7daad6119f3434e357755df3a04ac4234b70cd77d
-
\Users\Admin\AppData\Local\Temp\Opera_installer_230227112921177788.dllFilesize
4.6MB
MD59d88a4017f68b70eda415f609c3cd868
SHA17ada7e5fddee3094f47334795f866829446262d0
SHA25606325e1b492fd86cac40bc417eeed0680367e87b4757bc357464124559304f4c
SHA5121794f964bd4914b387e12e4e02fc1b117eee25b11c13d7cb0da8e63defb67dd341b9bdd5c1819f0f0ab98bb7daad6119f3434e357755df3a04ac4234b70cd77d
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exeFilesize
1.8MB
MD5aa4de04ccc16b74a4c2301da8d621ec1
SHA1d05c6d8200f6e6b1283df82d24d687adc47d9664
SHA256e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b
SHA51228d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exeFilesize
1.8MB
MD5aa4de04ccc16b74a4c2301da8d621ec1
SHA1d05c6d8200f6e6b1283df82d24d687adc47d9664
SHA256e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b
SHA51228d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exeFilesize
1.8MB
MD5aa4de04ccc16b74a4c2301da8d621ec1
SHA1d05c6d8200f6e6b1283df82d24d687adc47d9664
SHA256e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b
SHA51228d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exeFilesize
1.8MB
MD5aa4de04ccc16b74a4c2301da8d621ec1
SHA1d05c6d8200f6e6b1283df82d24d687adc47d9664
SHA256e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b
SHA51228d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exeFilesize
1.8MB
MD5aa4de04ccc16b74a4c2301da8d621ec1
SHA1d05c6d8200f6e6b1283df82d24d687adc47d9664
SHA256e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b
SHA51228d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exeFilesize
1.8MB
MD5aa4de04ccc16b74a4c2301da8d621ec1
SHA1d05c6d8200f6e6b1283df82d24d687adc47d9664
SHA256e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b
SHA51228d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmdFilesize
1.7MB
MD51bbf5dd0b6ca80e4c7c77495c3f33083
SHA1e0520037e60eb641ec04d1e814394c9da0a6a862
SHA256bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b
SHA51297bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmdFilesize
97KB
MD5da1d0cd400e0b6ad6415fd4d90f69666
SHA1de9083d2902906cacf57259cf581b1466400b799
SHA2567a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575
SHA512f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exeFilesize
1.3MB
MD57e08af319c9eb3297e09ca7bb8387de4
SHA14cf091f77a3eb9437ef33985e64bd10c1257284f
SHA2566c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8
SHA512bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exeFilesize
1.3MB
MD57e08af319c9eb3297e09ca7bb8387de4
SHA14cf091f77a3eb9437ef33985e64bd10c1257284f
SHA2566c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8
SHA512bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exeFilesize
1.3MB
MD57e08af319c9eb3297e09ca7bb8387de4
SHA14cf091f77a3eb9437ef33985e64bd10c1257284f
SHA2566c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8
SHA512bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exeFilesize
1.3MB
MD57e08af319c9eb3297e09ca7bb8387de4
SHA14cf091f77a3eb9437ef33985e64bd10c1257284f
SHA2566c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8
SHA512bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exeFilesize
1.3MB
MD57e08af319c9eb3297e09ca7bb8387de4
SHA14cf091f77a3eb9437ef33985e64bd10c1257284f
SHA2566c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8
SHA512bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dllFilesize
326KB
MD580d93d38badecdd2b134fe4699721223
SHA1e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA5129f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exeFilesize
1.3MB
MD5e801c5847f5f9d207db53aaaf5c6f3a2
SHA18e6818ce66555e2cca92e5c5f32551fb4a91645e
SHA256196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03
SHA512303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exeFilesize
1.3MB
MD5e801c5847f5f9d207db53aaaf5c6f3a2
SHA18e6818ce66555e2cca92e5c5f32551fb4a91645e
SHA256196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03
SHA512303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exeFilesize
1.3MB
MD5e801c5847f5f9d207db53aaaf5c6f3a2
SHA18e6818ce66555e2cca92e5c5f32551fb4a91645e
SHA256196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03
SHA512303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exeFilesize
1.3MB
MD5e801c5847f5f9d207db53aaaf5c6f3a2
SHA18e6818ce66555e2cca92e5c5f32551fb4a91645e
SHA256196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03
SHA512303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exeFilesize
1.3MB
MD5e801c5847f5f9d207db53aaaf5c6f3a2
SHA18e6818ce66555e2cca92e5c5f32551fb4a91645e
SHA256196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03
SHA512303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dllFilesize
326KB
MD580d93d38badecdd2b134fe4699721223
SHA1e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA5129f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4
-
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exeFilesize
2.7MB
MD5e2d9237cd84367301a506890ced54971
SHA1767dc2158c0cc664613a77674182d66057c35896
SHA2565f112829cbcd1325e154bc421c8220114f2c7188226b4f4777f4e0215546a9e0
SHA512dad4e495cee779addc73b088bf782d6379bc7a461bf76a49769c4511cf60400b32840320b35d8cc63bb51c1b832923f3cd544739374c419878cd9d9dc4144533
-
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exeFilesize
2.7MB
MD5e2d9237cd84367301a506890ced54971
SHA1767dc2158c0cc664613a77674182d66057c35896
SHA2565f112829cbcd1325e154bc421c8220114f2c7188226b4f4777f4e0215546a9e0
SHA512dad4e495cee779addc73b088bf782d6379bc7a461bf76a49769c4511cf60400b32840320b35d8cc63bb51c1b832923f3cd544739374c419878cd9d9dc4144533
-
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exeFilesize
2.7MB
MD5e2d9237cd84367301a506890ced54971
SHA1767dc2158c0cc664613a77674182d66057c35896
SHA2565f112829cbcd1325e154bc421c8220114f2c7188226b4f4777f4e0215546a9e0
SHA512dad4e495cee779addc73b088bf782d6379bc7a461bf76a49769c4511cf60400b32840320b35d8cc63bb51c1b832923f3cd544739374c419878cd9d9dc4144533
-
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exeFilesize
2.7MB
MD5e2d9237cd84367301a506890ced54971
SHA1767dc2158c0cc664613a77674182d66057c35896
SHA2565f112829cbcd1325e154bc421c8220114f2c7188226b4f4777f4e0215546a9e0
SHA512dad4e495cee779addc73b088bf782d6379bc7a461bf76a49769c4511cf60400b32840320b35d8cc63bb51c1b832923f3cd544739374c419878cd9d9dc4144533
-
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exeFilesize
2.7MB
MD5e2d9237cd84367301a506890ced54971
SHA1767dc2158c0cc664613a77674182d66057c35896
SHA2565f112829cbcd1325e154bc421c8220114f2c7188226b4f4777f4e0215546a9e0
SHA512dad4e495cee779addc73b088bf782d6379bc7a461bf76a49769c4511cf60400b32840320b35d8cc63bb51c1b832923f3cd544739374c419878cd9d9dc4144533
-
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exeFilesize
2.7MB
MD5e2d9237cd84367301a506890ced54971
SHA1767dc2158c0cc664613a77674182d66057c35896
SHA2565f112829cbcd1325e154bc421c8220114f2c7188226b4f4777f4e0215546a9e0
SHA512dad4e495cee779addc73b088bf782d6379bc7a461bf76a49769c4511cf60400b32840320b35d8cc63bb51c1b832923f3cd544739374c419878cd9d9dc4144533
-
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exeFilesize
2.7MB
MD5e2d9237cd84367301a506890ced54971
SHA1767dc2158c0cc664613a77674182d66057c35896
SHA2565f112829cbcd1325e154bc421c8220114f2c7188226b4f4777f4e0215546a9e0
SHA512dad4e495cee779addc73b088bf782d6379bc7a461bf76a49769c4511cf60400b32840320b35d8cc63bb51c1b832923f3cd544739374c419878cd9d9dc4144533
-
memory/316-1878-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/616-621-0x0000000000400000-0x0000000000947000-memory.dmpFilesize
5.3MB
-
memory/788-1031-0x0000000000400000-0x0000000000947000-memory.dmpFilesize
5.3MB
-
memory/816-473-0x00000000001B0000-0x0000000000598000-memory.dmpFilesize
3.9MB
-
memory/816-573-0x0000000005760000-0x0000000005CA7000-memory.dmpFilesize
5.3MB
-
memory/816-574-0x0000000005760000-0x0000000005CA7000-memory.dmpFilesize
5.3MB
-
memory/816-572-0x0000000005760000-0x0000000005CA7000-memory.dmpFilesize
5.3MB
-
memory/816-596-0x00000000001B0000-0x0000000000598000-memory.dmpFilesize
3.9MB
-
memory/816-575-0x0000000005760000-0x0000000005CA7000-memory.dmpFilesize
5.3MB
-
memory/816-571-0x00000000027B0000-0x00000000027C0000-memory.dmpFilesize
64KB
-
memory/904-465-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/904-368-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/904-1690-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/904-1689-0x0000000001150000-0x0000000001538000-memory.dmpFilesize
3.9MB
-
memory/904-386-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/904-1639-0x0000000001150000-0x0000000001538000-memory.dmpFilesize
3.9MB
-
memory/904-1640-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/904-373-0x0000000001150000-0x0000000001538000-memory.dmpFilesize
3.9MB
-
memory/904-1478-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/904-1477-0x0000000001150000-0x0000000001538000-memory.dmpFilesize
3.9MB
-
memory/904-461-0x0000000001150000-0x0000000001538000-memory.dmpFilesize
3.9MB
-
memory/904-1446-0x0000000003020000-0x0000000003030000-memory.dmpFilesize
64KB
-
memory/904-2436-0x0000000001150000-0x0000000001538000-memory.dmpFilesize
3.9MB
-
memory/904-344-0x0000000001150000-0x0000000001538000-memory.dmpFilesize
3.9MB
-
memory/904-374-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/904-466-0x0000000003020000-0x0000000003030000-memory.dmpFilesize
64KB
-
memory/904-1395-0x0000000001150000-0x0000000001538000-memory.dmpFilesize
3.9MB
-
memory/904-365-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/904-367-0x0000000001150000-0x0000000001538000-memory.dmpFilesize
3.9MB
-
memory/904-385-0x0000000001150000-0x0000000001538000-memory.dmpFilesize
3.9MB
-
memory/904-366-0x00000000008E0000-0x00000000008E3000-memory.dmpFilesize
12KB
-
memory/904-605-0x0000000001150000-0x0000000001538000-memory.dmpFilesize
3.9MB
-
memory/1012-604-0x0000000000400000-0x0000000000947000-memory.dmpFilesize
5.3MB
-
memory/1348-1917-0x0000000000400000-0x0000000000947000-memory.dmpFilesize
5.3MB
-
memory/1348-619-0x0000000000400000-0x0000000000947000-memory.dmpFilesize
5.3MB
-
memory/1348-937-0x0000000002850000-0x0000000002D97000-memory.dmpFilesize
5.3MB
-
memory/1348-1632-0x0000000002850000-0x0000000002D97000-memory.dmpFilesize
5.3MB
-
memory/1644-1032-0x0000000000400000-0x0000000000947000-memory.dmpFilesize
5.3MB
-
memory/1644-622-0x0000000003110000-0x0000000003657000-memory.dmpFilesize
5.3MB
-
memory/1644-618-0x00000000037B0000-0x0000000003CF7000-memory.dmpFilesize
5.3MB
-
memory/1644-576-0x0000000000400000-0x0000000000947000-memory.dmpFilesize
5.3MB
-
memory/1644-620-0x00000000028B0000-0x0000000002DF7000-memory.dmpFilesize
5.3MB
-
memory/1644-1932-0x0000000000400000-0x0000000000947000-memory.dmpFilesize
5.3MB
-
memory/1668-471-0x0000000002D30000-0x0000000003118000-memory.dmpFilesize
3.9MB
-
memory/1668-472-0x0000000002D30000-0x0000000003118000-memory.dmpFilesize
3.9MB
-
memory/1668-468-0x0000000002D30000-0x0000000003118000-memory.dmpFilesize
3.9MB
-
memory/1668-467-0x0000000002D30000-0x0000000003118000-memory.dmpFilesize
3.9MB
-
memory/1780-1904-0x0000000003920000-0x0000000003930000-memory.dmpFilesize
64KB
-
memory/2044-71-0x0000000002DB0000-0x0000000003198000-memory.dmpFilesize
3.9MB
-
memory/2044-69-0x0000000002DB0000-0x0000000003198000-memory.dmpFilesize
3.9MB
-
memory/2216-2097-0x0000000002820000-0x0000000002821000-memory.dmpFilesize
4KB
-
memory/2712-2714-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2712-2705-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2712-2696-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2712-2638-0x00000000003D0000-0x00000000003E7000-memory.dmpFilesize
92KB
-
memory/2712-2637-0x00000000003D0000-0x00000000003E7000-memory.dmpFilesize
92KB
-
memory/2712-2636-0x00000000003D0000-0x00000000003E7000-memory.dmpFilesize
92KB
-
memory/2712-2633-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB