bazarbackdoor | 78d84068b47cf28b76c88ba4474c7c187510f4e4e967d079d3761dcab7851655

Analysis

max time kernel
264s
max time network
302s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
20-03-2023 21:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TLauncher-2.876-Installer-1.0.7-global.exe
Size

22.6MB
MD5

e89a95bce6075955a4e1acdb6bb56561
SHA1

8b17013cbf2ea69d625d7bcb1e578933c13678fc
SHA256

78d84068b47cf28b76c88ba4474c7c187510f4e4e967d079d3761dcab7851655
SHA512

4ccb33f60c9292e12daa53b49524a36bbe1c1ca86d794b5134b8b954736a532e9f202123b39036c6a9c557e128bd8361e5c1cb86d40723cc00784026741d5e65
SSDEEP

393216:DXkoYB+UAVl/Pfs/dQETVlOBbpFEjdGphRqV56HpkvQFa2Vj4h2cU:D0oYB+3fHHExi73qqHpU2Vj4hE

Score

10^/10

bazarbackdoor adware backdoor discovery persistence spyware stealer upx

Malware Config

Signatures

BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
backdoor bazarbackdoor

Bazar/Team9 Backdoor payload 1 IoCs

Processes:

resource	yara_rule
C:\Windows\Installer\6fa507.msi	BazarBackdoorVar3

Blocklisted process makes network request 1 IoCs

Processes:

msiexec.exe

flow pid process

45 2912 msiexec.exe
Downloads MZ/PE file

flow	pid	process
45	2912	msiexec.exe

Executes dropped EXE 23 IoCs

Processes:

irsetup.exeBrowserInstaller.exeirsetup.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exe_sfx.exeassistant_installer.exeassistant_installer.exejre-windows.exejre-windows.exeinstaller.exebspatch.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exejavaw.exe

pid	process
1720	irsetup.exe
1144	BrowserInstaller.exe
1460	irsetup.exe
1060	opera-installer-bro.exe
272	opera-installer-bro.exe
848	opera-installer-bro.exe
328	opera-installer-bro.exe
824	opera-installer-bro.exe
2712	_sfx.exe
1880	assistant_installer.exe
2924	assistant_installer.exe
880	jre-windows.exe
2036	jre-windows.exe
2352	installer.exe
1700	bspatch.exe
2788	unpack200.exe
2172	unpack200.exe
2756	unpack200.exe
2464	unpack200.exe
2528	unpack200.exe
2668	unpack200.exe
2436	unpack200.exe
2532	javaw.exe

Loads dropped DLL 64 IoCs

Processes:

TLauncher-2.876-Installer-1.0.7-global.exeirsetup.exeBrowserInstaller.exeirsetup.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exeassistant_installer.exejre-windows.exeMsiExec.exemsiexec.exebspatch.exeinstaller.exeunpack200.exe

pid	process
2016	TLauncher-2.876-Installer-1.0.7-global.exe
2016	TLauncher-2.876-Installer-1.0.7-global.exe
2016	TLauncher-2.876-Installer-1.0.7-global.exe
2016	TLauncher-2.876-Installer-1.0.7-global.exe
1720	irsetup.exe
1720	irsetup.exe
1720	irsetup.exe
1720	irsetup.exe
1720	irsetup.exe
1720	irsetup.exe
1720	irsetup.exe
1720	irsetup.exe
1144	BrowserInstaller.exe
1144	BrowserInstaller.exe
1144	BrowserInstaller.exe
1144	BrowserInstaller.exe
1460	irsetup.exe
1460	irsetup.exe
1460	irsetup.exe
1460	irsetup.exe
1460	irsetup.exe
1460	irsetup.exe
1460	irsetup.exe
1460	irsetup.exe
1060	opera-installer-bro.exe
1060	opera-installer-bro.exe
272	opera-installer-bro.exe
1060	opera-installer-bro.exe
848	opera-installer-bro.exe
1060	opera-installer-bro.exe
328	opera-installer-bro.exe
328	opera-installer-bro.exe
824	opera-installer-bro.exe
1060	opera-installer-bro.exe
1060	opera-installer-bro.exe
1060	opera-installer-bro.exe
1060	opera-installer-bro.exe
1880	assistant_installer.exe
1720	irsetup.exe
880	jre-windows.exe
1268
1268
1812	MsiExec.exe
1812	MsiExec.exe
1812	MsiExec.exe
2912	msiexec.exe
1700	bspatch.exe
1700	bspatch.exe
1700	bspatch.exe
2352	installer.exe
2788	unpack200.exe
2788	unpack200.exe
2788	unpack200.exe
2788	unpack200.exe
2788	unpack200.exe
2788	unpack200.exe
2788	unpack200.exe
2788	unpack200.exe
2788	unpack200.exe
2788	unpack200.exe
2788	unpack200.exe
2788	unpack200.exe
2788	unpack200.exe
2788	unpack200.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

installer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC}\InprocServer32	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0110-ABCDEFFEDCBA}\InprocServer32	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0117-ABCDEFFEDCBB}\InprocServer32	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}\InprocServer32	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0051-ABCDEFFEDCBB}\InprocServer32	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0059-ABCDEFFEDCBA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0073-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0166-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0099-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0058-ABCDEFFEDCBA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0041-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0194-ABCDEFFEDCBA}\InprocServer32	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0069-ABCDEFFEDCBA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0117-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0048-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0033-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0081-ABCDEFFEDCBC}\INPROCSERVER32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0018-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0044-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0075-ABCDEFFEDCBB}\INPROCSERVER32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0114-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}\INPROCSERVER32	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0071-ABCDEFFEDCBC}\InprocServer32	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0054-ABCDEFFEDCBC}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0206-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0156-ABCDEFFEDCBB}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0106-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0086-ABCDEFFEDCBB}\InprocServer32	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0140-ABCDEFFEDCBA}\InprocServer32	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0038-ABCDEFFEDCBC}\InprocServer32	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0050-ABCDEFFEDCBC}\INPROCSERVER32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0126-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0075-ABCDEFFEDCBB}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0045-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBB}\InprocServer32	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0010-ABCDEFFEDCBB}\INPROCSERVER32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBB}\INPROCSERVER32	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0196-ABCDEFFEDCBA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0138-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0042-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0093-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0064-ABCDEFFEDCBC}\InprocServer32	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0085-ABCDEFFEDCBA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0112-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0002-ABCDEFFEDCBC}\INPROCSERVER32	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0058-ABCDEFFEDCBA}\InprocServer32	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBC}\INPROCSERVER32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0072-ABCDEFFEDCBC}\INPROCSERVER32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0087-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBA}\INPROCSERVER32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0069-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0066-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0114-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0031-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe

UPX packed file 52 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
behavioral2/memory/1720-73-0x0000000000330000-0x0000000000718000-memory.dmp	upx
behavioral2/memory/1720-366-0x0000000000330000-0x0000000000718000-memory.dmp	upx
behavioral2/memory/1720-383-0x0000000000330000-0x0000000000718000-memory.dmp	upx
behavioral2/memory/1720-384-0x0000000000330000-0x0000000000718000-memory.dmp	upx
behavioral2/memory/1720-394-0x0000000000330000-0x0000000000718000-memory.dmp	upx
behavioral2/memory/1720-414-0x0000000000330000-0x0000000000718000-memory.dmp	upx
behavioral2/memory/1720-443-0x0000000000330000-0x0000000000718000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
behavioral2/memory/1460-509-0x0000000000DC0000-0x00000000011A8000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
behavioral2/memory/1720-541-0x0000000000330000-0x0000000000718000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
behavioral2/memory/1060-550-0x0000000001080000-0x00000000015C5000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe	upx
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe	upx
behavioral2/memory/848-564-0x00000000010E0000-0x0000000001625000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
behavioral2/memory/272-589-0x0000000001080000-0x00000000015C5000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
behavioral2/memory/824-594-0x0000000001080000-0x00000000015C5000-memory.dmp	upx
behavioral2/memory/328-592-0x0000000001080000-0x00000000015C5000-memory.dmp	upx
behavioral2/memory/1460-602-0x0000000000DC0000-0x00000000011A8000-memory.dmp	upx
behavioral2/memory/1460-616-0x0000000000DC0000-0x00000000011A8000-memory.dmp	upx
behavioral2/memory/1720-728-0x0000000000330000-0x0000000000718000-memory.dmp	upx
behavioral2/memory/1720-1622-0x0000000000330000-0x0000000000718000-memory.dmp	upx
behavioral2/memory/1720-1650-0x0000000000330000-0x0000000000718000-memory.dmp	upx
behavioral2/memory/1700-2013-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/1700-2030-0x0000000000400000-0x0000000000417000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 26 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

opera-installer-bro.exemsiexec.exeopera-installer-bro.exe

description	ioc	process
File opened (read-only)	\??\D:	opera-installer-bro.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\D:	opera-installer-bro.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Installs/modifies Browser Helper Object 2 TTPs 6 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

installer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	installer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\NoExplorer = "1"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9}	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}	installer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\NoExplorer = "1"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	installer.exe

Drops file in System32 directory 1 IoCs

Processes:

installer.exe

description ioc process

File created C:\Windows\system32\WindowsAccessBridge-64.dll installer.exe

description	ioc	process
File created	C:\Windows\system32\WindowsAccessBridge-64.dll	installer.exe

Drops file in Program Files directory 64 IoCs

Processes:

installer.exe

description	ioc	process
File created	C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-core-errorhandling-l1-1-0.dll	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\bin\eula.dll	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\bin\javaw.exe	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\lib\fontconfig.bfc	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\lib\jfr\profile.jfc	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\lib\security\policy\unlimited\US_export_policy.jar	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\bin\glib-lite.dll	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\bin\jjs.exe	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\bin\ucrtbase.dll	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\legal\javafx\jpeg_fx.md	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\lib\flavormap.properties	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\lib\management\management.properties	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-core-debug-l1-1-0.dll	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-core-namedpipe-l1-1-0.dll	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\bin\javafx_iio.dll	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\bin\resource.dll	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\legal\jdk\relaxngcc.md	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\bin\jp2ssv.dll	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\lib\cmm\sRGB.pf	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\lib\deploy\[email protected]	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\COPYRIGHT	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\bin\sunmscapi.dll	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\bin\vcruntime140.dll	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\lib\management\jmxremote.password.template	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-core-handle-l1-1-0.dll	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\bin\bci.dll	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\lib\cmm\GRAY.pf	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\lib\images\cursors\cursors.properties	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\lib\images\cursors\win32_MoveDrop32x32.gif	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-core-rtlsupport-l1-1-0.dll	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\bin\JAWTAccessBridge-64.dll	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\legal\jdk\colorimaging.md	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\lib\deploy\messages_zh_TW.properties	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\lib\deploy\[email protected]	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\lib\security\cacerts	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\LICENSE	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-core-localization-l1-2-0.dll	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-crt-multibyte-l1-1-0.dll	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\bin\pack200.exe	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\bin\ssv.dll	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\lib\cmm\LINEAR_RGB.pf	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\lib\security\javaws.policy	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\lib\sound.properties	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\lib\management-agent.jar	installer.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_7340174\javaws.exe	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\bin\jabswitch.exe	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\bin\javacpl.cpl	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\bin\prism_common.dll	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\legal\jdk\thaidict.md	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\lib\images\cursors\win32_LinkNoDrop32x32.gif	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\README.txt	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\THIRDPARTYLICENSEREADME-JAVAFX.txt	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\legal\javafx\libxml2.md	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\lib\cmm\CIEXYZ.pf	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\bin\fontmanager.dll	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\bin\java.exe	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\lib\ext\access-bridge-64.jar	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\lib\ext\jaccess.jar	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\lib\charsets.pack	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-core-processenvironment-l1-1-0.dll	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\bin\java-rmi.exe	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\bin\jfxwebkit.dll	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\legal\javafx\gstreamer.md	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\lib\security\java.policy	installer.exe

Drops file in Windows directory 9 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSIAD27.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\6fa507.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAA85.tmp	msiexec.exe
File created	C:\Windows\Installer\6fa509.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAC79.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAC99.tmp	msiexec.exe
File created	C:\Windows\Installer\6fa50b.msi	msiexec.exe
File created	C:\Windows\Installer\6fa507.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msiexec.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msiexec.exe

Modifies Internet Explorer settings 1 TTPs 7 IoCs

adware spyware

Modify Registry

T1112

Processes:

installer.exeirsetup.exejre-windows.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Policy = "0"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main	irsetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main	jre-windows.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppName = "javaws.exe"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppPath = "C:\\Program Files\\Java\\jre1.8.0_351\\bin"	installer.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

installer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0122-ABCDEFFEDCBC}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0143-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_143"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBB}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0048-ABCDEFFEDCBB}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0036-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0048-ABCDEFFEDCBC}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0217-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0066-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0095-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_95"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0034-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0059-ABCDEFFEDCBB}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0115-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0069-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0091-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0068-ABCDEFFEDCBB}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0087-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_87"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0147-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_31"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0054-ABCDEFFEDCBB}	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0091-ABCDEFFEDCBA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0151-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0067-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0042-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0137-ABCDEFFEDCBA}\InprocServer32	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0070-ABCDEFFEDCBC}	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0110-ABCDEFFEDCBA}	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0047-ABCDEFFEDCBC}\InprocServer32	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0075-ABCDEFFEDCBC}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0033-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0069-ABCDEFFEDCBC}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0192-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0179-ABCDEFFEDCBB}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.1_01"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0160-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0201-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0028-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0121-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0062-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0063-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0218-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0074-ABCDEFFEDCBC}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0043-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0134-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0049-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0057-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0219-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_219"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0032-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0032-ABCDEFFEDCBB}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0094-ABCDEFFEDCBC}\ = "Java Plug-in 1.7.0_94"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0204-ABCDEFFEDCBC}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0070-ABCDEFFEDCBA}\InprocServer32	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0060-ABCDEFFEDCBC}\InprocServer32	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0087-ABCDEFFEDCBA}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0147-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_147"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0092-ABCDEFFEDCBA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0121-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_121"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0159-ABCDEFFEDCBB}\InprocServer32	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0086-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe

Modifies registry class 64 IoCs

Processes:

installer.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0077-ABCDEFFEDCBA}	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBA}	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0063-ABCDEFFEDCBA}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0063-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_63"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0040-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0069-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0121-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0123-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_123"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0127-ABCDEFFEDCBC}\InprocServer32	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0150-ABCDEFFEDCBA}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0136-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBA}	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBB}\INPROCSERVER32	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0031-ABCDEFFEDCBB}\InprocServer32	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\INPROCSERVER32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0120-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_120"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_19"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0064-ABCDEFFEDCBA}	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0056-ABCDEFFEDCBA}\INPROCSERVER32	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0207-ABCDEFFEDCBA}	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0031-ABCDEFFEDCBB}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0086-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0187-ABCDEFFEDCBA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0078-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0038-ABCDEFFEDCBB}\InprocServer32	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0032-ABCDEFFEDCBC}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0080-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0207-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_207"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0144-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_144"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0157-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0216-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0067-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0072-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0097-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0179-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_179"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0009-ABCDEFFEDCBC}\ = "Java Plug-in 1.7.0_09"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0011-ABCDEFFEDCBB}	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0032-ABCDEFFEDCBB}\INPROCSERVER32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0088-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_88"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0054-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0061-ABCDEFFEDCBB}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0087-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.2_87"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0098-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0051-ABCDEFFEDCBB}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0140-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0148-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0098-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0201-ABCDEFFEDCBB}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0205-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_205"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_08"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0068-ABCDEFFEDCBA}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0056-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_56"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0078-ABCDEFFEDCBB}\INPROCSERVER32	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0123-ABCDEFFEDCBA}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0077-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_77"	installer.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

irsetup.exeopera-installer-bro.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	irsetup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	opera-installer-bro.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	opera-installer-bro.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	opera-installer-bro.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	opera-installer-bro.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

jre-windows.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	2036	jre-windows.exe
Token: SeIncreaseQuotaPrivilege	2036	jre-windows.exe
Token: SeRestorePrivilege	2912	msiexec.exe
Token: SeTakeOwnershipPrivilege	2912	msiexec.exe
Token: SeSecurityPrivilege	2912	msiexec.exe
Token: SeCreateTokenPrivilege	2036	jre-windows.exe
Token: SeAssignPrimaryTokenPrivilege	2036	jre-windows.exe
Token: SeLockMemoryPrivilege	2036	jre-windows.exe
Token: SeIncreaseQuotaPrivilege	2036	jre-windows.exe
Token: SeMachineAccountPrivilege	2036	jre-windows.exe
Token: SeTcbPrivilege	2036	jre-windows.exe
Token: SeSecurityPrivilege	2036	jre-windows.exe
Token: SeTakeOwnershipPrivilege	2036	jre-windows.exe
Token: SeLoadDriverPrivilege	2036	jre-windows.exe
Token: SeSystemProfilePrivilege	2036	jre-windows.exe
Token: SeSystemtimePrivilege	2036	jre-windows.exe
Token: SeProfSingleProcessPrivilege	2036	jre-windows.exe
Token: SeIncBasePriorityPrivilege	2036	jre-windows.exe
Token: SeCreatePagefilePrivilege	2036	jre-windows.exe
Token: SeCreatePermanentPrivilege	2036	jre-windows.exe
Token: SeBackupPrivilege	2036	jre-windows.exe
Token: SeRestorePrivilege	2036	jre-windows.exe
Token: SeShutdownPrivilege	2036	jre-windows.exe
Token: SeDebugPrivilege	2036	jre-windows.exe
Token: SeAuditPrivilege	2036	jre-windows.exe
Token: SeSystemEnvironmentPrivilege	2036	jre-windows.exe
Token: SeChangeNotifyPrivilege	2036	jre-windows.exe
Token: SeRemoteShutdownPrivilege	2036	jre-windows.exe
Token: SeUndockPrivilege	2036	jre-windows.exe
Token: SeSyncAgentPrivilege	2036	jre-windows.exe
Token: SeEnableDelegationPrivilege	2036	jre-windows.exe
Token: SeManageVolumePrivilege	2036	jre-windows.exe
Token: SeImpersonatePrivilege	2036	jre-windows.exe
Token: SeCreateGlobalPrivilege	2036	jre-windows.exe
Token: SeRestorePrivilege	2912	msiexec.exe
Token: SeTakeOwnershipPrivilege	2912	msiexec.exe
Token: SeRestorePrivilege	2912	msiexec.exe
Token: SeTakeOwnershipPrivilege	2912	msiexec.exe
Token: SeRestorePrivilege	2912	msiexec.exe
Token: SeTakeOwnershipPrivilege	2912	msiexec.exe
Token: SeRestorePrivilege	2912	msiexec.exe
Token: SeTakeOwnershipPrivilege	2912	msiexec.exe
Token: SeRestorePrivilege	2912	msiexec.exe
Token: SeTakeOwnershipPrivilege	2912	msiexec.exe
Token: SeRestorePrivilege	2912	msiexec.exe
Token: SeTakeOwnershipPrivilege	2912	msiexec.exe
Token: SeRestorePrivilege	2912	msiexec.exe
Token: SeTakeOwnershipPrivilege	2912	msiexec.exe
Token: SeRestorePrivilege	2912	msiexec.exe
Token: SeTakeOwnershipPrivilege	2912	msiexec.exe
Token: SeRestorePrivilege	2912	msiexec.exe
Token: SeTakeOwnershipPrivilege	2912	msiexec.exe
Token: SeRestorePrivilege	2912	msiexec.exe
Token: SeTakeOwnershipPrivilege	2912	msiexec.exe
Token: SeRestorePrivilege	2912	msiexec.exe
Token: SeTakeOwnershipPrivilege	2912	msiexec.exe
Token: SeRestorePrivilege	2912	msiexec.exe
Token: SeTakeOwnershipPrivilege	2912	msiexec.exe
Token: SeRestorePrivilege	2912	msiexec.exe
Token: SeTakeOwnershipPrivilege	2912	msiexec.exe
Token: SeRestorePrivilege	2912	msiexec.exe
Token: SeTakeOwnershipPrivilege	2912	msiexec.exe
Token: SeRestorePrivilege	2912	msiexec.exe
Token: SeTakeOwnershipPrivilege	2912	msiexec.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

irsetup.exeirsetup.exejre-windows.exe

pid	process
1720	irsetup.exe
1720	irsetup.exe
1720	irsetup.exe
1720	irsetup.exe
1720	irsetup.exe
1720	irsetup.exe
1460	irsetup.exe
1460	irsetup.exe
2036	jre-windows.exe
2036	jre-windows.exe
2036	jre-windows.exe
2036	jre-windows.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

TLauncher-2.876-Installer-1.0.7-global.exeirsetup.exeBrowserInstaller.exeirsetup.exeopera-installer-bro.exeopera-installer-bro.exe

description	pid	process	target process
PID 2016 wrote to memory of 1720	2016	TLauncher-2.876-Installer-1.0.7-global.exe	irsetup.exe
PID 2016 wrote to memory of 1720	2016	TLauncher-2.876-Installer-1.0.7-global.exe	irsetup.exe
PID 2016 wrote to memory of 1720	2016	TLauncher-2.876-Installer-1.0.7-global.exe	irsetup.exe
PID 2016 wrote to memory of 1720	2016	TLauncher-2.876-Installer-1.0.7-global.exe	irsetup.exe
PID 2016 wrote to memory of 1720	2016	TLauncher-2.876-Installer-1.0.7-global.exe	irsetup.exe
PID 2016 wrote to memory of 1720	2016	TLauncher-2.876-Installer-1.0.7-global.exe	irsetup.exe
PID 2016 wrote to memory of 1720	2016	TLauncher-2.876-Installer-1.0.7-global.exe	irsetup.exe
PID 1720 wrote to memory of 1144	1720	irsetup.exe	BrowserInstaller.exe
PID 1720 wrote to memory of 1144	1720	irsetup.exe	BrowserInstaller.exe
PID 1720 wrote to memory of 1144	1720	irsetup.exe	BrowserInstaller.exe
PID 1720 wrote to memory of 1144	1720	irsetup.exe	BrowserInstaller.exe
PID 1720 wrote to memory of 1144	1720	irsetup.exe	BrowserInstaller.exe
PID 1720 wrote to memory of 1144	1720	irsetup.exe	BrowserInstaller.exe
PID 1720 wrote to memory of 1144	1720	irsetup.exe	BrowserInstaller.exe
PID 1144 wrote to memory of 1460	1144	BrowserInstaller.exe	irsetup.exe
PID 1144 wrote to memory of 1460	1144	BrowserInstaller.exe	irsetup.exe
PID 1144 wrote to memory of 1460	1144	BrowserInstaller.exe	irsetup.exe
PID 1144 wrote to memory of 1460	1144	BrowserInstaller.exe	irsetup.exe
PID 1144 wrote to memory of 1460	1144	BrowserInstaller.exe	irsetup.exe
PID 1144 wrote to memory of 1460	1144	BrowserInstaller.exe	irsetup.exe
PID 1144 wrote to memory of 1460	1144	BrowserInstaller.exe	irsetup.exe
PID 1460 wrote to memory of 1060	1460	irsetup.exe	opera-installer-bro.exe
PID 1460 wrote to memory of 1060	1460	irsetup.exe	opera-installer-bro.exe
PID 1460 wrote to memory of 1060	1460	irsetup.exe	opera-installer-bro.exe
PID 1460 wrote to memory of 1060	1460	irsetup.exe	opera-installer-bro.exe
PID 1460 wrote to memory of 1060	1460	irsetup.exe	opera-installer-bro.exe
PID 1460 wrote to memory of 1060	1460	irsetup.exe	opera-installer-bro.exe
PID 1460 wrote to memory of 1060	1460	irsetup.exe	opera-installer-bro.exe
PID 1060 wrote to memory of 272	1060	opera-installer-bro.exe	opera-installer-bro.exe
PID 1060 wrote to memory of 272	1060	opera-installer-bro.exe	opera-installer-bro.exe
PID 1060 wrote to memory of 272	1060	opera-installer-bro.exe	opera-installer-bro.exe
PID 1060 wrote to memory of 272	1060	opera-installer-bro.exe	opera-installer-bro.exe
PID 1060 wrote to memory of 272	1060	opera-installer-bro.exe	opera-installer-bro.exe
PID 1060 wrote to memory of 272	1060	opera-installer-bro.exe	opera-installer-bro.exe
PID 1060 wrote to memory of 272	1060	opera-installer-bro.exe	opera-installer-bro.exe
PID 1060 wrote to memory of 848	1060	opera-installer-bro.exe	opera-installer-bro.exe
PID 1060 wrote to memory of 848	1060	opera-installer-bro.exe	opera-installer-bro.exe
PID 1060 wrote to memory of 848	1060	opera-installer-bro.exe	opera-installer-bro.exe
PID 1060 wrote to memory of 848	1060	opera-installer-bro.exe	opera-installer-bro.exe
PID 1060 wrote to memory of 848	1060	opera-installer-bro.exe	opera-installer-bro.exe
PID 1060 wrote to memory of 848	1060	opera-installer-bro.exe	opera-installer-bro.exe
PID 1060 wrote to memory of 848	1060	opera-installer-bro.exe	opera-installer-bro.exe
PID 1060 wrote to memory of 328	1060	opera-installer-bro.exe	opera-installer-bro.exe
PID 1060 wrote to memory of 328	1060	opera-installer-bro.exe	opera-installer-bro.exe
PID 1060 wrote to memory of 328	1060	opera-installer-bro.exe	opera-installer-bro.exe
PID 1060 wrote to memory of 328	1060	opera-installer-bro.exe	opera-installer-bro.exe
PID 1060 wrote to memory of 328	1060	opera-installer-bro.exe	opera-installer-bro.exe
PID 1060 wrote to memory of 328	1060	opera-installer-bro.exe	opera-installer-bro.exe
PID 1060 wrote to memory of 328	1060	opera-installer-bro.exe	opera-installer-bro.exe
PID 328 wrote to memory of 824	328	opera-installer-bro.exe	opera-installer-bro.exe
PID 328 wrote to memory of 824	328	opera-installer-bro.exe	opera-installer-bro.exe
PID 328 wrote to memory of 824	328	opera-installer-bro.exe	opera-installer-bro.exe
PID 328 wrote to memory of 824	328	opera-installer-bro.exe	opera-installer-bro.exe
PID 328 wrote to memory of 824	328	opera-installer-bro.exe	opera-installer-bro.exe
PID 328 wrote to memory of 824	328	opera-installer-bro.exe	opera-installer-bro.exe
PID 328 wrote to memory of 824	328	opera-installer-bro.exe	opera-installer-bro.exe
PID 1060 wrote to memory of 2712	1060	opera-installer-bro.exe	_sfx.exe
PID 1060 wrote to memory of 2712	1060	opera-installer-bro.exe	_sfx.exe
PID 1060 wrote to memory of 2712	1060	opera-installer-bro.exe	_sfx.exe
PID 1060 wrote to memory of 2712	1060	opera-installer-bro.exe	_sfx.exe
PID 1060 wrote to memory of 2712	1060	opera-installer-bro.exe	_sfx.exe
PID 1060 wrote to memory of 2712	1060	opera-installer-bro.exe	_sfx.exe
PID 1060 wrote to memory of 2712	1060	opera-installer-bro.exe	_sfx.exe
PID 1060 wrote to memory of 1880	1060	opera-installer-bro.exe	assistant_installer.exe

C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe
"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe" "__IRCT:3" "__IRTSS:23645635" "__IRSID:S-1-5-21-3499517378-2376672570-1134980332-1000"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1144
  - - C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816338 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:1840798" "__IRSID:S-1-5-21-3499517378-2376672570-1134980332-1000"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies system certificate store
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1460
    - - C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
        
        "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        Modifies system certificate store
        Suspicious use of WriteProcessMemory
        
        PID:1060
      - C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
        
        C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=96.0.4693.80 --initial-client-data=0x1a4,0x1a8,0x1ac,0x178,0x1b0,0x713924a8,0x713924b8,0x713924c4
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:272
      - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe" --version
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:848
      - C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
        
        "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=1060 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20230320224335" --session-guid=834a5e23-0cb5-46af-a46d-8456a8c27906 --server-tracking-blob=NTA3MDhjOWZiN2U3ZjBlNzQ5ZTIxMDRmNWM4ODM4ZDBjYmEwMmM1NjBhOWQ3MzIzNWM2Y2U2ZGJkMDQ3MWJhMDp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjciLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNjc5MzQ4NjEzLjQyNzEiLCJ1c2VyYWdlbnQiOiJTZXR1cCBGYWN0b3J5IDkuMCIsInV0bSI6eyJjYW1wYWlnbiI6Ik9wZXJhRGVza3RvcCIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Ik1TVEwifSwidXVpZCI6ImVjMmY4ODM0LTQ1YmQtNGQzMC1iMDc4LWRlYTA4MTNlZTgzMSJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=3403000000000000
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        Suspicious use of WriteProcessMemory
        
        PID:328
        
        C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
        
        C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=96.0.4693.80 --initial-client-data=0x1b0,0x1b4,0x1b8,0x178,0x1bc,0x708f24a8,0x708f24b8,0x708f24c4
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:824
      - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303202243351\assistant\_sfx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303202243351\assistant\_sfx.exe"
        6⤵
        Executes dropped EXE
        
        PID:2712
      - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303202243351\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303202243351\assistant\assistant_installer.exe" --version
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303202243351\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303202243351\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=96.0.4693.50 --initial-client-data=0x148,0x14c,0x150,0x11c,0x154,0xc56c28,0xc56c38,0xc56c44
        7⤵
        Executes dropped EXE
        
        PID:2924
- - C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
    "C:\Users\Admin\AppData\Local\Temp\jre-windows.exe" STATIC=1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:880
  - - C:\Users\Admin\AppData\Local\Temp\jds7307398.tmp\jre-windows.exe
      "C:\Users\Admin\AppData\Local\Temp\jds7307398.tmp\jre-windows.exe" "STATIC=1"
      4⤵
      Executes dropped EXE
      Modifies Internet Explorer settings
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2036

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2912
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding B7CE20AA27E9BB4DD9A4710BE92E4757
  2⤵
  - Loads dropped DLL
  PID:1812
- C:\Program Files\Java\jre1.8.0_351\installer.exe
  "C:\Program Files\Java\jre1.8.0_351\installer.exe" /s INSTALLDIR="C:\Program Files\Java\jre1.8.0_351\\" STATIC=1 INSTALL_SILENT=1 REPAIRMODE=0 ProductCode={26A24AE4-039D-4CA4-87B4-2F64180351F0}
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Registers COM server for autorun
  - Installs/modifies Browser Helper Object
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:2352
- - C:\ProgramData\Oracle\Java\installcache_x64\7321033.tmp\bspatch.exe
    "bspatch.exe" baseimagefam8 newimage diff
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1700
- - C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
    "C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/plugin.pack" "C:\Program Files\Java\jre1.8.0_351\lib/plugin.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2788
- - C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
    "C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/javaws.pack" "C:\Program Files\Java\jre1.8.0_351\lib/javaws.jar"
    3⤵
    - Executes dropped EXE
    PID:2172
- - C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
    "C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/deploy.pack" "C:\Program Files\Java\jre1.8.0_351\lib/deploy.jar"
    3⤵
    - Executes dropped EXE
    PID:2756
- - C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
    "C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/rt.pack" "C:\Program Files\Java\jre1.8.0_351\lib/rt.jar"
    3⤵
    - Executes dropped EXE
    PID:2464
- - C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
    "C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/jsse.pack" "C:\Program Files\Java\jre1.8.0_351\lib/jsse.jar"
    3⤵
    - Executes dropped EXE
    PID:2528
- - C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
    "C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/charsets.pack" "C:\Program Files\Java\jre1.8.0_351\lib/charsets.jar"
    3⤵
    - Executes dropped EXE
    PID:2668
- - C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
    "C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/ext/localedata.pack" "C:\Program Files\Java\jre1.8.0_351\lib/ext/localedata.jar"
    3⤵
    - Executes dropped EXE
    PID:2436
- - C:\Program Files\Java\jre1.8.0_351\bin\javaw.exe
    "C:\Program Files\Java\jre1.8.0_351\bin\javaw.exe" -Xshare:dump -Djdk.disableLastUsageTracking
    3⤵
    - Executes dropped EXE
    PID:2532
- - C:\Program Files\Java\jre1.8.0_351\bin\ssvagent.exe
    "C:\Program Files\Java\jre1.8.0_351\bin\ssvagent.exe" -doHKCUSSVSetup
    3⤵
    PID:2660
- - C:\Program Files\Java\jre1.8.0_351\bin\javaws.exe
    "C:\Program Files\Java\jre1.8.0_351\bin\javaws.exe" -wait -fix -permissions -silent
    3⤵
    PID:2868
  - - C:\Program Files\Java\jre1.8.0_351\bin\jp2launcher.exe
      "C:\Program Files\Java\jre1.8.0_351\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre1.8.0_351" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzM1MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF8zNTFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzM1MVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==
      4⤵
      PID:2780

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jre1.8.0_351\bin\dtplugin\npdeployJava1.dll

Filesize
1.8MB

MD5
ff91ac355dc6b1df63795886125bccf8

SHA1
90979fc6ea3a89031598d2146bf5cdbbb6db6b77

SHA256
14b30467cfea0071dffc658dd31b8a25b7b4e79608933f171911c2cba6aa9a0a

SHA512
77aa8c7930730004bdb8d49a82712e1042db978102f6eca0d38317b6fd98ef03e52279130eadc7a0da1148e759db6589f7f8334d4c2eccfb2613e8f19542e197

Download Submit
C:\Program Files\Java\jre1.8.0_351\bin\javacpl.exe

Filesize
103KB

MD5
7a9d69862a2021508931a197cd6501ec

SHA1
a0f7d313a874552f4972784d15042b564e4067fc

SHA256
51ff63cbac78bd133333e98d91b02b652c88cd57cedd0052519051a17be77856

SHA512
5c331e6deefc8256ea203d63770484f6b485d4c3832a60ecf4a540dff3cb75a76dbde37980fe1763ca487401b68126f58f8d1a4c72ee610f5144c624c4736850

Download Submit
C:\Program Files\Java\jre1.8.0_351\bin\javaws.exe

Filesize
446KB

MD5
24ccb37646e1f52ce4f47164cccf2b91

SHA1
bc265e26417026286d6ed951904305086c4f693c

SHA256
adf2d659c2b2a4afff1ca58f3a742d27d767d27eabeca6a8b6ee243e9c913a39

SHA512
cb174e7a219f6ffae3715e37beb428979bc1462202729c05a25fa7b8da90e2dd6faa92c03cd9ca21567d354dce7acc1852669f4071298e953d6a286243794e32

Download Submit
C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe

Filesize
216KB

MD5
691f68efcd902bfdfb60b556a3e11c2c

SHA1
c279fa09293185bddfd73d1170b6a73bd266cf07

SHA256
471d70ebf91bdc762dcacbea9f6ca883f97921938e83269fef911dbf83598a70

SHA512
a4816ae0654f41bd130d56e44839d9f29ab48bd2f99c3d6db38ce3358ac46c1cef09da09184c6291dd378018a49f9e56173c35d780d3eaefcce459592c75de3f

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit\Reference Documentation.lnk

Filesize
197B

MD5
b5e1de7d05841796c6d96dfe5b8b338c

SHA1
c7c64e5b35d0cca1a5c98a1c68e1e5d4c8b72547

SHA256
062cb9dec2b2ce02c633fc442d1a23e910e602548a54a54c8310b0dde9ae074d

SHA512
963a89b04f34bc00fea5b8e0f9648596c428beac2db30d8b0932974b15c0eb90b7c801ba6fa1082ea9d133258f393ae27e61f27fd3b3951f5c2e4b8c6a212c2d

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Get Help.url

Filesize
182B

MD5
7fadb9e200dbbd992058cefa41212796

SHA1
e2525d7ba66bb07bc1cd5ba93f88c54e7e2042b4

SHA256
b05abacd15117b1ffcd2a288308f50c0542214d264b852eddfa9025307ac401b

SHA512
94b7bf1f1f5cea2a74f8c326113dd25652cb14e5fa356ac83d16b6ac5a5cac26c9d2b20259f5c2cf8ebc1e022490511e2996335a5d8dd7f5b64dce429fb6dfb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

Filesize
471B

MD5
a20b5879a95dcafd85ac493c4e7f898b

SHA1
fc4a0d7388e53cb335532d2e5cfbe061ed7fc74a

SHA256
846f69b7f739c74b4804ba36519a838cd952e201f2c23bcd695e6ba5702728f0

SHA512
9dbd9b3d30a86bcaeabf915bd2cb492e27b94951cdc190d6416d4736cfff33901ab73e0ca27cbd6e2c54ee2c35acba2d8dc79d70955ad6e55fb1ca464290a0d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1d7e806ffac930de798c91889e83c8c

SHA1
6fcc1c1cb25df7ce12441cf69dc02d20c7768538

SHA256
af69ded4a6bb4997f972225c8bf44df44209c343ad1b61a067967c828df11349

SHA512
265b126aa73dcccc49f76516f25a3696a212c33d868f5f65ce5e5aeb2491b941f9eeccbac2874881a621e981661d3e5909b1ffe2a2a909e12f76944fe0d3b5b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb7df7d584e1af57233b707f6d712e7e

SHA1
9068252a30a4d87816014f887989d2de32617d4d

SHA256
e13f0f8cb503b12d4ff70f3b7021c367f78db22c079a6098a5490a19b4145d58

SHA512
b41d6422ad30a4c614d69ecba985cea387a71891fd637d825d7ea156ff6664a2f6f9cbfbb91d4eafe8d46bffa77a1972a949b4859063520e7e927e5b29f8f8b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

Filesize
434B

MD5
8d7a7d5753c52c01a9b4a5d6927ba918

SHA1
5bf6827ce243fd0a406d6a23ea9effb556f057bc

SHA256
a85c7609afd47285f0d27f4f2d5b15858a1ba69b15cc7dbe5db4298664a0d2ed

SHA512
d043ed18e3d5cc6e2762dbd0f583bc6763e2b8a7b1b709580d392116d97b35223f7a81be318a3c6d62a1b474ca3116106a27293aecb58481ee28edb5cfd0d217

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
140d799c60e148f8cc042ffa064fc046

SHA1
83c349321e880dc3ca1d1c21489a3718f6645695

SHA256
73fa88d34d90f4bee42f4dfad1f639ed6c19393c66cce966d71f5b8232cd1433

SHA512
12025bf79b852bdf46870c3d2e3b2a52793cc1ad49b62a2917b2e80ddf504560d77cdceafa3cc04b1b3fe19cff13d687a8bf5ed3edeac25cd9e485b005667b36

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303202243351\additional_file0.tmp

Filesize
1.7MB

MD5
b386cdcb413405daa8219af8e4cbd318

SHA1
ce275ff8514fef0629c915a6ee7b5ac481b9043d

SHA256
408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e

SHA512
91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303202243351\assistant\_sfx.exe

Filesize
1.7MB

MD5
b386cdcb413405daa8219af8e4cbd318

SHA1
ce275ff8514fef0629c915a6ee7b5ac481b9043d

SHA256
408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e

SHA512
91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303202243351\assistant\_sfx.exe

Filesize
1.7MB

MD5
b386cdcb413405daa8219af8e4cbd318

SHA1
ce275ff8514fef0629c915a6ee7b5ac481b9043d

SHA256
408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e

SHA512
91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303202243351\assistant\assistant_installer.exe

Filesize
2.1MB

MD5
2f3d9e21e232b9bfea064d3b2264db06

SHA1
bafddc657d8d1bb531683b29b0342cc065ee51d2

SHA256
25528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d

SHA512
94e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303202243351\assistant\assistant_installer.exe

Filesize
2.1MB

MD5
2f3d9e21e232b9bfea064d3b2264db06

SHA1
bafddc657d8d1bb531683b29b0342cc065ee51d2

SHA256
25528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d

SHA512
94e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303202243351\assistant\assistant_installer.exe

Filesize
2.1MB

MD5
2f3d9e21e232b9bfea064d3b2264db06

SHA1
bafddc657d8d1bb531683b29b0342cc065ee51d2

SHA256
25528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d

SHA512
94e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303202243351\opera_package

Filesize
86.9MB

MD5
6b7771354e081eb94cdbf7627799da4f

SHA1
199341a750443cc6e9b2b2fa1e657d0dd327711f

SHA256
494d1247e61eebf703a6eb19c14bde88edd2f85515fefa4f0465f43873e69aab

SHA512
33e781a102ba3f5c3b1895540bc9c43b78bf4f19af4b91ae0c765594f39d6569d1bad207b33f808426d8ebdcb00c419b7bb76bb050bae0bb843f96dd84355800

Download Submit
C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
52e46b1adf9cd40428b41755df527bd4

SHA1
5f0bb9c9c14208851beb5c93d9268c16ab39dc07

SHA256
a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

SHA512
813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

Download Submit
C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
52e46b1adf9cd40428b41755df527bd4

SHA1
5f0bb9c9c14208851beb5c93d9268c16ab39dc07

SHA256
a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

SHA512
813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC256.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_230320224335436848.dll

Filesize
4.6MB

MD5
927a01657c6bee50ca093ffcfdc9134a

SHA1
f7e484a777affe3c6227a2be0a6560111e1be8f9

SHA256
b1012ab0e2e6a363372a14b480b4c8275c013e66c94adfb8857e523899350cc9

SHA512
718c25b4e95948b728fe7eda6c5953bc0246dc5730ba99a71c3963ebcffda58b1759bf2554fca297d1590d8768d50e0fd9c39bdf790f4d372bc4aa255bfb5db7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar990.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFA0C.tmp

Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico

Filesize
116KB

MD5
e043a9cb014d641a56f50f9d9ac9a1b9

SHA1
61dc6aed3d0d1f3b8afe3d161410848c565247ed

SHA256
9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946

SHA512
4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe

Filesize
1.8MB

MD5
52e46b1adf9cd40428b41755df527bd4

SHA1
5f0bb9c9c14208851beb5c93d9268c16ab39dc07

SHA256
a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

SHA512
813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.PNG

Filesize
339B

MD5
bbdf2e8c0262e7e606d41ddbe5a3cd12

SHA1
acbb25f729af14b692ec9c8187a23b1a696f8e47

SHA256
d7c76896d206d977739556ad2d5811f7cf3117252afcd439a5aa0f2b645f6949

SHA512
0334fae3682889adbc18594b7917d8c93252a86bc04d08efc6860d5714ba4eb8aabc39c51e532c4aee57a938021540d2f2899781d9cd1de311036e1850a65067

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG104.PNG

Filesize
644B

MD5
38c12e1a54f8fd216ed3f13b36798cc6

SHA1
ccf1fe585d3374ebce4c1ec025e2d8ec39968a7c

SHA256
608924ba294590b5b706658d9aaa71b480ad9aa1b6797bbc5cf1632ac6c616b1

SHA512
0918af63f006d7fa04a3faeeb813e61c060316a126c4742a948a30f5b6ea368c3b8592011319dad3dbf8427dfcc095aa72f7b651d6fc31061f861f070447331b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG109.PNG

Filesize
2KB

MD5
03b1d78771eb279766efb2d9f2fa8463

SHA1
8f10e304fd65e58136ccd6ab012ffc594e6fb707

SHA256
eec16d2cb57e38b485b6a269e9c2554c1dfc3b70dec9f7bbddc2b62526b3d832

SHA512
ca51cbaf20e6f62eb6ec69555d259ef61828d3166d09106bcd335dd417ed30660af71e7fd8db6bd22bf134cc530e1a55ecdd2c307e64e8edb28af95299d66f5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.PNG

Filesize
280B

MD5
5a7901f7df307fba45b1c377f2c94ccc

SHA1
d6630cf733033cdfbda7af3213d49b32f5b06919

SHA256
d8471d5a5b4792c4b49e80b5cb22ef1e938dc3069b210646704f658548d7a9f8

SHA512
fc0036a7ed4b53edd72b91c4824919e6e8a82b5be1e82cdc134e267ef4792424124fb6ba5d7c86cf686910da0baba8453d7a6c12b39a5b4c0cb70658580f3bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG22.PNG

Filesize
1KB

MD5
46a65321aa1fce57d465c26e8b6eb392

SHA1
9efb9a3acd5b32556ea66398c74b014f91087559

SHA256
61df7a1f0367209668d4f0f6a285b8baff864d1341d382ebbc7fd4e71036b666

SHA512
094d69016f066ae835c71d7a950217b9ad09e8cd4d74131787203cae950e572c18213dc1ded139b1fa46c7f803cc15bf4f596c9d51aefe0d43850ae2865f3707

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.PNG

Filesize
281B

MD5
05d7bba3d6ac92766c4495b8928202a6

SHA1
50b65a8ba5ed2633e43929ee4bd58c95a91a3363

SHA256
4804f3c4fae714657fdb85e98244828acc6ac938505c2da1ed694ae7b58f2949

SHA512
1544d5cd6f85aaeeacd26f2deb9da9eb510226b41079ee78c4dede14386e5ea3446efdfd475bfbfa3a6846fa2ff23d64f4dad3a4ddd304e32de80e4d7bcbc600

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG85.PNG

Filesize
43KB

MD5
667b0b54ee5ba0d1cb66190226596e46

SHA1
b8658b35e7cf44b24053e4d01d3b51233d6526f6

SHA256
3a9ab8c3640f1b40b33553d7d3dd3d15bd6e702ef510ec0b66a2f14aa744bf83

SHA512
9ccc773214a0074634be66801d81d7a593ab154351fdbd1b93f56ffa80cf824ee31ff2e13f26536d5f3096e90df43fa223080b4dc55340614b076c08ef976dcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG86.PNG

Filesize
1KB

MD5
5bc85d12eb492baa3be9230f1fbdc342

SHA1
456fe4284fa916ad3817e7c3d419c13f4c949737

SHA256
9a27f240758513aa1cc05500171fe22fdb3a485781cba4798cefc29f6944373c

SHA512
3d55c597ac29d7f810980dfd89404d3ecbd2e652ae1bc5e6710668ad5386a0caecf3149289df13f6dabed6b2e4305a26684ab3bd21b255b37f8a596fe8d641b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

Filesize
1.7MB

MD5
1bbf5dd0b6ca80e4c7c77495c3f33083

SHA1
e0520037e60eb641ec04d1e814394c9da0a6a862

SHA256
bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

SHA512
97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

Filesize
97KB

MD5
da1d0cd400e0b6ad6415fd4d90f69666

SHA1
de9083d2902906cacf57259cf581b1466400b799

SHA256
7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

SHA512
f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
111dddf2f308abc2a8f7555d5f642751

SHA1
11e6cdccbf29a71a97011b9444cf20c83ad8b57b

SHA256
c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

SHA512
11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
111dddf2f308abc2a8f7555d5f642751

SHA1
11e6cdccbf29a71a97011b9444cf20c83ad8b57b

SHA256
c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

SHA512
11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
111dddf2f308abc2a8f7555d5f642751

SHA1
11e6cdccbf29a71a97011b9444cf20c83ad8b57b

SHA256
c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

SHA512
11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat

Filesize
108KB

MD5
aec508468d53ab8d55f5b4beb82c347d

SHA1
477d1ffb28834243f5811a4a2a54b4f0ca240120

SHA256
ebee84e34e221ad822486432333bad9e6357af2fb0d9651cc61c7fab8ec9b5bf

SHA512
26a0278af2a9e75ef966bc3f7f40d7669204c2004a043adaad102ef440caa6282e69372ca0c3c7d39a8450691d528c2dc77a4386bfb0c6e5a2a76c3fef900fbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
5027f3112ac2d6f764769102a9145c8e

SHA1
a369a0e1d4ace1a8d66908aa43543bea03c76f5b

SHA256
d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

SHA512
181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
5027f3112ac2d6f764769102a9145c8e

SHA1
a369a0e1d4ace1a8d66908aa43543bea03c76f5b

SHA256
d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

SHA512
181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
5027f3112ac2d6f764769102a9145c8e

SHA1
a369a0e1d4ace1a8d66908aa43543bea03c76f5b

SHA256
d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

SHA512
181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jusched.log

Filesize
3KB

MD5
36a4eee7c556d0e7ee05ceafefa617ea

SHA1
9e996d8ebbf25c6930c3321a4eb8f334127173c2

SHA256
5ee96faf95fe7df3086608380a242168ed06671361af5385fca5acca2c674723

SHA512
d34b7fde9cb88e26972d085c47322c6a9c822082bb5a551819ecdbd2e9dcfc7fccfdd89265d589a2a057fc34a04977a3432bdb5373dc26a47c585248241c56aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\jusched.log

Filesize
4KB

MD5
4ed8479a812da283b57a5b4decda2797

SHA1
0528dfa0e6ec7ef2104bae6ab7bb8901a960dc1b

SHA256
5034f3d1b9ed7d41c8fbdff5d7890f3f28cdd2b0a5a41d266c0bebf6285ea8d8

SHA512
2c80c7911120502ca8a6d21134bc2889e15be9c8400f65c6d0b034861dc2389fef78d34d704336bed861f348f7384348a9c58d79a68315acfabda8433e77110d

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
140d799c60e148f8cc042ffa064fc046

SHA1
83c349321e880dc3ca1d1c21489a3718f6645695

SHA256
73fa88d34d90f4bee42f4dfad1f639ed6c19393c66cce966d71f5b8232cd1433

SHA512
12025bf79b852bdf46870c3d2e3b2a52793cc1ad49b62a2917b2e80ddf504560d77cdceafa3cc04b1b3fe19cff13d687a8bf5ed3edeac25cd9e485b005667b36

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
140d799c60e148f8cc042ffa064fc046

SHA1
83c349321e880dc3ca1d1c21489a3718f6645695

SHA256
73fa88d34d90f4bee42f4dfad1f639ed6c19393c66cce966d71f5b8232cd1433

SHA512
12025bf79b852bdf46870c3d2e3b2a52793cc1ad49b62a2917b2e80ddf504560d77cdceafa3cc04b1b3fe19cff13d687a8bf5ed3edeac25cd9e485b005667b36

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
140d799c60e148f8cc042ffa064fc046

SHA1
83c349321e880dc3ca1d1c21489a3718f6645695

SHA256
73fa88d34d90f4bee42f4dfad1f639ed6c19393c66cce966d71f5b8232cd1433

SHA512
12025bf79b852bdf46870c3d2e3b2a52793cc1ad49b62a2917b2e80ddf504560d77cdceafa3cc04b1b3fe19cff13d687a8bf5ed3edeac25cd9e485b005667b36

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
140d799c60e148f8cc042ffa064fc046

SHA1
83c349321e880dc3ca1d1c21489a3718f6645695

SHA256
73fa88d34d90f4bee42f4dfad1f639ed6c19393c66cce966d71f5b8232cd1433

SHA512
12025bf79b852bdf46870c3d2e3b2a52793cc1ad49b62a2917b2e80ddf504560d77cdceafa3cc04b1b3fe19cff13d687a8bf5ed3edeac25cd9e485b005667b36

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
140d799c60e148f8cc042ffa064fc046

SHA1
83c349321e880dc3ca1d1c21489a3718f6645695

SHA256
73fa88d34d90f4bee42f4dfad1f639ed6c19393c66cce966d71f5b8232cd1433

SHA512
12025bf79b852bdf46870c3d2e3b2a52793cc1ad49b62a2917b2e80ddf504560d77cdceafa3cc04b1b3fe19cff13d687a8bf5ed3edeac25cd9e485b005667b36

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
140d799c60e148f8cc042ffa064fc046

SHA1
83c349321e880dc3ca1d1c21489a3718f6645695

SHA256
73fa88d34d90f4bee42f4dfad1f639ed6c19393c66cce966d71f5b8232cd1433

SHA512
12025bf79b852bdf46870c3d2e3b2a52793cc1ad49b62a2917b2e80ddf504560d77cdceafa3cc04b1b3fe19cff13d687a8bf5ed3edeac25cd9e485b005667b36

Download Submit
C:\Users\Admin\AppData\Local\Temp\setuparguments.ini

Filesize
602B

MD5
03774349ce4a78b86bff91547dd43063

SHA1
2ce159a5c61b46ac79450ff49962197a0cf2c38c

SHA256
12f550c12f481abc941a3fb1dd3a5a99cd7675ccc92a66471462f6ca9348cd21

SHA512
9e62bde33999b0e7aa1d5ae94bc0c01679237cb0fa69f03ebb364872d19e5b40f3e051158a165c9c5369d7326d27f262b7715eda6ecb83d1e088125d83a01a32

Download Submit
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

Filesize
6.3MB

MD5
f08d9bbc61cff8e8c3504524c3220bef

SHA1
b4268c667469620bb528c04eaa819d508159b398

SHA256
2c4d8b48344ae221e349e525ac16eb364ffb5ab8deae80c7caa28dd5967cabdb

SHA512
a64a03d959487399fb57e1bd062c0e9f88a17ff9b3ad15e6b96a4b7332341d0fc9186ef99b2ab9bdcfa51864f21d08bce48479202c01d15470916e90fb09fef4

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.BMP

Filesize
451KB

MD5
0b445ace8798426e7185f52b7b7b6d1e

SHA1
7a77b46e0848cc9b32283ccb3f91a18c0934c079

SHA256
2bbf97ccba3f87d469eac909c4ce8a3f13ed29c8f31b611e7d5cf89a0619eda6

SHA512
51523d5b711481293305465a3a3c6a3a50dca984cdc8cca1f4c44f3c21bfa430cd9aac1a8782d9605e6954cbafb307beb6b1a52e9785de1bc3f71067d80c6b6e

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG23.PNG

Filesize
1KB

MD5
fa8aa84ef4bf0de505f6e3447d4b55b3

SHA1
b99654dfa5f6c56857b4f4102af2d27503bcdc74

SHA256
f3b7e85e8e5e41496fb563816fbf79e6640feb1591bd5e0c0b876d80053ad913

SHA512
b3a7d0d5abe554301b8745bd738662d80e439fba8df6f984cc05151ec8c081a61f0538765653e8587b431cdc97d384ee35d17ab3324c06a2ca40a069e1525ba6

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNG

Filesize
45KB

MD5
2799f9daca46770a871ce1b5eed32e7c

SHA1
a2792f571210a7f38cdbe49391017300ee7b1ce4

SHA256
fc22676f5b6cdae17b78ddfd16bb070687516fbc827a7edd0541f3a32d85c9e9

SHA512
c41f2e4c4ca59d6f9d11fac11296ab87f1b508b5d64e5db7762f2f6dd387aa96206b2b0fa127f17c0b8c24a0b56e81af12d5937474a450222d9c4416c1acb16a

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG41.PNG

Filesize
457B

MD5
ce17d7ce06488f394ce124f17d5acafc

SHA1
8a5dceae9ea369b686123c8f940bb0ea07870ffa

SHA256
c4b04568930f03979d71f48a57b9ad06b4cdf687272f6753ff662006e8e6237f

SHA512
c33f1370213cabd1b84c936f1ac14f9bcc83bc03a633bbe25efe1e906bcee515d0e615c86b7ee3b34404dd1d95ce74d1a00908de8cdacbf9961de3f1ceb8362b

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG42.PNG

Filesize
352B

MD5
1f5c8939031a7f93762862cfc88a8e56

SHA1
6dc4df87344db0ddf09c777e7a80d1b5661559b8

SHA256
14be26e969eb15ef7e76e0ad02d8aa0516c5391e8b09dba0a9a6c5f57ae24aba

SHA512
de45d700c86329c704777917863fd1ddeca90d2bed67a72794164882bf15725ce83c7733f664ee0a2af7df54a6be2def729d19237fb2c434115396ac126ff47f

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG45.PNG

Filesize
438B

MD5
09229c3bfb801177839a7c2e22e33a1b

SHA1
f679c05c4c7b2f3722069420c6d6481fc856e7aa

SHA256
cbf81d779b469942613297a3ca6c09d885e3b1d4aa952dc1994a7175fbfc7e3f

SHA512
503bfa063b29dda95f15da303f707e5b78a6bdb74662c222d8a8b7e3a33264016a66acdd9de44aea932e7cde80a43c2406ea6f0250d3df8e182217bc4a0a7ed7

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG46.PNG

Filesize
206B

MD5
d8a095202e08fa1ac2578982e9a486db

SHA1
397ffc8af43ac18466b8df245b4faa6b278659e6

SHA256
28fed2b9a3cbde34da4b6b5d1af2d2844437d21f6dec85b3ca2faa5cd3b512e5

SHA512
ac751386a0004e335f4e5f4ea24bf6a474478c8a7ca54d018734e7cd44b8e9a0eb262b00fe1219b1c62c96b018b08ba6b1056d3a13e64b55c7e70d748a6ae9c6

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG48.PNG

Filesize
1KB

MD5
59d6f22fdc11d6b116b38193ed5f4b97

SHA1
cddc7eb2110b3179dd6d1e32b4b37f3568a22ebf

SHA256
782cafea76d24d76885d88ee1302e5f78d75a4e335529dc20ad476fdb9e34744

SHA512
5b0fab5139736d30a69c98ea88d95a5c70f59aab1b82394c58b33617b824447b861a6e6067b62dd1ca1812a4989937e06ad473c6c94376af957871e9e63553fa

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG5.PNG

Filesize
1KB

MD5
3094925a8de871bcc72ae50882d2a6f7

SHA1
9f7894bc4b2a498ad20b14b2b3cac175bf4d7a9f

SHA256
523e7230db0c47a436abbc442db93e41b6f549b32da6c2a10db7a18228491216

SHA512
bf2349354321397652d834507aae4c32885273209d1409b796170292e37ebf35878e2934d3f53545e66724561e646cc660f952e0bb5006cd7a262a790b64e39e

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG66.PNG

Filesize
41KB

MD5
1557c08e187b7783083e0b80051fd321

SHA1
2c6ee47799d713e88fd589609b81912a4522044e

SHA256
0c0e74dd07c45833a5dd7ba931e5d528eb16334defdd06171df2f632d6e47842

SHA512
485f69b3878b2bd7fdf52ad020dde2cbc34dd1970aaa4e5eb8f8618f6091b5b827b428447859499c3d61ea9cde2edcbb97c8fb0560cd0aaff50027c0f97ee6f3

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG67.PNG

Filesize
1KB

MD5
5eecdc666e6dc0b8e5e8d2fc3b9cc1b2

SHA1
72a16d461bd2410d5749c6bf939a127683d83a95

SHA256
052f0289886f9cc0931d7026dfe1f5253ad39123479627e37afa5c430e8f8ff1

SHA512
5d465d2c61d97ec2a52db3aeee8d42ececdef08930692842f9c6a41b0611cb774015d369e4fe5186079e97839acc78e8403ea6a6c33ee54a7aef3eea41c3d7db

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

Filesize
33KB

MD5
8eec84d1f7b34fb8f0c92402959392b4

SHA1
4d49164ae8f7533d61e2ae137404d02d1308ce38

SHA256
2d6ea1e3e2247eb839116c10062aab24e7d029dec1b23bd7d34dc4b98a7f34a7

SHA512
662e5f4228b294ecac0ce0c892082984aabb7779ea1318df3c5202d775fbb0825fe672953bd7e8fc695960183fc1a4fefabc3eee68f0298ad20f3bf7cabdc5a3

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

Filesize
7KB

MD5
87806e300541d11561a19b676106875f

SHA1
9cc54f52bcd759a8647643d28aa617514185b2f4

SHA256
faff66b8462a38c755df783be8cf8b74c89bb39c565bf61455418bcb65b9050a

SHA512
7491de9808e8069ae2716f34d757de1fd3897d4e8cd01bc6e3ec2a5c87f90011efd8d35aeff362fa6cceee020f7d6dbb84b506318d8c52c7d884a02de58580bc

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

Filesize
40B

MD5
75fc6e0056d99df8e9b026582aa1385b

SHA1
9d53e2135f73f8d1b570c5e49e56ce8d85fc7ad4

SHA256
8645d740b0e65a8d9f33ec8ba3a01c6e3e2b782be935b640f40f2b9fab73dc37

SHA512
fb56f02a3da76e47820133b24feea64dbeb1fb78345882cc07691e6a5d29cd1713edf74ec73f577c44e4a1e52f900b8a97c30b27170444a472714a6557b1c03f

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

Filesize
40B

MD5
75fc6e0056d99df8e9b026582aa1385b

SHA1
9d53e2135f73f8d1b570c5e49e56ce8d85fc7ad4

SHA256
8645d740b0e65a8d9f33ec8ba3a01c6e3e2b782be935b640f40f2b9fab73dc37

SHA512
fb56f02a3da76e47820133b24feea64dbeb1fb78345882cc07691e6a5d29cd1713edf74ec73f577c44e4a1e52f900b8a97c30b27170444a472714a6557b1c03f

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

Filesize
40B

MD5
75fc6e0056d99df8e9b026582aa1385b

SHA1
9d53e2135f73f8d1b570c5e49e56ce8d85fc7ad4

SHA256
8645d740b0e65a8d9f33ec8ba3a01c6e3e2b782be935b640f40f2b9fab73dc37

SHA512
fb56f02a3da76e47820133b24feea64dbeb1fb78345882cc07691e6a5d29cd1713edf74ec73f577c44e4a1e52f900b8a97c30b27170444a472714a6557b1c03f

Download Submit
C:\Windows\Installer\6fa507.msi

Filesize
81.0MB

MD5
1794aaa17d114a315a95473c9780fc8b

SHA1
7f250c022b916b88e22254985e7552bc3ac8db04

SHA256
7682233d155e6d19f30cf61b185a02055be0dbcacd2c9accf90a99de21547eb4

SHA512
fb9defdf73786528e82ffc7e1ccfa03cfb687365ec740e9620993da785414306f03a7e1fa523192a9d690a882b012d1e426afd1757639f3ef5f1e612c01e6516

Download Submit
C:\Windows\Installer\MSIAD27.tmp

Filesize
757KB

MD5
62cfeb86f117ad91b8bb52f1dda6f473

SHA1
c753b488938b3e08f7f47df209359c7b78764448

SHA256
f06cba20bd40e9d841add1877cf8d3b406f0acfa4800b80ae041ed3cc374eb7e

SHA512
c1b0e76cee4e2c3ca604dcc8f5665e72e70008acc824e20d89404f139d7e7e789e99dff131dafd76409f6ea0a813aa136f96089fbdadcf90d6485b1807762e4e

Download Submit
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
140d799c60e148f8cc042ffa064fc046

SHA1
83c349321e880dc3ca1d1c21489a3718f6645695

SHA256
73fa88d34d90f4bee42f4dfad1f639ed6c19393c66cce966d71f5b8232cd1433

SHA512
12025bf79b852bdf46870c3d2e3b2a52793cc1ad49b62a2917b2e80ddf504560d77cdceafa3cc04b1b3fe19cff13d687a8bf5ed3edeac25cd9e485b005667b36

Download Submit
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303202243351\assistant\_sfx.exe

Filesize
1.7MB

MD5
b386cdcb413405daa8219af8e4cbd318

SHA1
ce275ff8514fef0629c915a6ee7b5ac481b9043d

SHA256
408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e

SHA512
91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

Download Submit
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303202243351\assistant\assistant_installer.exe

Filesize
2.1MB

MD5
2f3d9e21e232b9bfea064d3b2264db06

SHA1
bafddc657d8d1bb531683b29b0342cc065ee51d2

SHA256
25528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d

SHA512
94e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5

Download Submit
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303202243351\assistant\assistant_installer.exe

Filesize
2.1MB

MD5
2f3d9e21e232b9bfea064d3b2264db06

SHA1
bafddc657d8d1bb531683b29b0342cc065ee51d2

SHA256
25528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d

SHA512
94e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5

Download Submit
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303202243351\opera_package

Filesize
86.9MB

MD5
6b7771354e081eb94cdbf7627799da4f

SHA1
199341a750443cc6e9b2b2fa1e657d0dd327711f

SHA256
494d1247e61eebf703a6eb19c14bde88edd2f85515fefa4f0465f43873e69aab

SHA512
33e781a102ba3f5c3b1895540bc9c43b78bf4f19af4b91ae0c765594f39d6569d1bad207b33f808426d8ebdcb00c419b7bb76bb050bae0bb843f96dd84355800

Download Submit
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303202243351\opera_package

Filesize
86.9MB

MD5
6b7771354e081eb94cdbf7627799da4f

SHA1
199341a750443cc6e9b2b2fa1e657d0dd327711f

SHA256
494d1247e61eebf703a6eb19c14bde88edd2f85515fefa4f0465f43873e69aab

SHA512
33e781a102ba3f5c3b1895540bc9c43b78bf4f19af4b91ae0c765594f39d6569d1bad207b33f808426d8ebdcb00c419b7bb76bb050bae0bb843f96dd84355800

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
52e46b1adf9cd40428b41755df527bd4

SHA1
5f0bb9c9c14208851beb5c93d9268c16ab39dc07

SHA256
a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

SHA512
813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
52e46b1adf9cd40428b41755df527bd4

SHA1
5f0bb9c9c14208851beb5c93d9268c16ab39dc07

SHA256
a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

SHA512
813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
52e46b1adf9cd40428b41755df527bd4

SHA1
5f0bb9c9c14208851beb5c93d9268c16ab39dc07

SHA256
a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

SHA512
813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
52e46b1adf9cd40428b41755df527bd4

SHA1
5f0bb9c9c14208851beb5c93d9268c16ab39dc07

SHA256
a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

SHA512
813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
52e46b1adf9cd40428b41755df527bd4

SHA1
5f0bb9c9c14208851beb5c93d9268c16ab39dc07

SHA256
a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

SHA512
813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
52e46b1adf9cd40428b41755df527bd4

SHA1
5f0bb9c9c14208851beb5c93d9268c16ab39dc07

SHA256
a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

SHA512
813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_2303202243339851060.dll

Filesize
4.6MB

MD5
927a01657c6bee50ca093ffcfdc9134a

SHA1
f7e484a777affe3c6227a2be0a6560111e1be8f9

SHA256
b1012ab0e2e6a363372a14b480b4c8275c013e66c94adfb8857e523899350cc9

SHA512
718c25b4e95948b728fe7eda6c5953bc0246dc5730ba99a71c3963ebcffda58b1759bf2554fca297d1590d8768d50e0fd9c39bdf790f4d372bc4aa255bfb5db7

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_230320224334687272.dll

Filesize
4.6MB

MD5
927a01657c6bee50ca093ffcfdc9134a

SHA1
f7e484a777affe3c6227a2be0a6560111e1be8f9

SHA256
b1012ab0e2e6a363372a14b480b4c8275c013e66c94adfb8857e523899350cc9

SHA512
718c25b4e95948b728fe7eda6c5953bc0246dc5730ba99a71c3963ebcffda58b1759bf2554fca297d1590d8768d50e0fd9c39bdf790f4d372bc4aa255bfb5db7

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_230320224335436848.dll

Filesize
4.6MB

MD5
927a01657c6bee50ca093ffcfdc9134a

SHA1
f7e484a777affe3c6227a2be0a6560111e1be8f9

SHA256
b1012ab0e2e6a363372a14b480b4c8275c013e66c94adfb8857e523899350cc9

SHA512
718c25b4e95948b728fe7eda6c5953bc0246dc5730ba99a71c3963ebcffda58b1759bf2554fca297d1590d8768d50e0fd9c39bdf790f4d372bc4aa255bfb5db7

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_230320224335717328.dll

Filesize
4.6MB

MD5
927a01657c6bee50ca093ffcfdc9134a

SHA1
f7e484a777affe3c6227a2be0a6560111e1be8f9

SHA256
b1012ab0e2e6a363372a14b480b4c8275c013e66c94adfb8857e523899350cc9

SHA512
718c25b4e95948b728fe7eda6c5953bc0246dc5730ba99a71c3963ebcffda58b1759bf2554fca297d1590d8768d50e0fd9c39bdf790f4d372bc4aa255bfb5db7

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_230320224335795824.dll

Filesize
4.6MB

MD5
927a01657c6bee50ca093ffcfdc9134a

SHA1
f7e484a777affe3c6227a2be0a6560111e1be8f9

SHA256
b1012ab0e2e6a363372a14b480b4c8275c013e66c94adfb8857e523899350cc9

SHA512
718c25b4e95948b728fe7eda6c5953bc0246dc5730ba99a71c3963ebcffda58b1759bf2554fca297d1590d8768d50e0fd9c39bdf790f4d372bc4aa255bfb5db7

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

Filesize
1.7MB

MD5
1bbf5dd0b6ca80e4c7c77495c3f33083

SHA1
e0520037e60eb641ec04d1e814394c9da0a6a862

SHA256
bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

SHA512
97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

Filesize
97KB

MD5
da1d0cd400e0b6ad6415fd4d90f69666

SHA1
de9083d2902906cacf57259cf581b1466400b799

SHA256
7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

SHA512
f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
111dddf2f308abc2a8f7555d5f642751

SHA1
11e6cdccbf29a71a97011b9444cf20c83ad8b57b

SHA256
c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

SHA512
11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
111dddf2f308abc2a8f7555d5f642751

SHA1
11e6cdccbf29a71a97011b9444cf20c83ad8b57b

SHA256
c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

SHA512
11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
111dddf2f308abc2a8f7555d5f642751

SHA1
11e6cdccbf29a71a97011b9444cf20c83ad8b57b

SHA256
c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

SHA512
11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
111dddf2f308abc2a8f7555d5f642751

SHA1
11e6cdccbf29a71a97011b9444cf20c83ad8b57b

SHA256
c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

SHA512
11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
111dddf2f308abc2a8f7555d5f642751

SHA1
11e6cdccbf29a71a97011b9444cf20c83ad8b57b

SHA256
c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

SHA512
11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
5027f3112ac2d6f764769102a9145c8e

SHA1
a369a0e1d4ace1a8d66908aa43543bea03c76f5b

SHA256
d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

SHA512
181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
5027f3112ac2d6f764769102a9145c8e

SHA1
a369a0e1d4ace1a8d66908aa43543bea03c76f5b

SHA256
d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

SHA512
181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
5027f3112ac2d6f764769102a9145c8e

SHA1
a369a0e1d4ace1a8d66908aa43543bea03c76f5b

SHA256
d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

SHA512
181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
5027f3112ac2d6f764769102a9145c8e

SHA1
a369a0e1d4ace1a8d66908aa43543bea03c76f5b

SHA256
d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

SHA512
181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
5027f3112ac2d6f764769102a9145c8e

SHA1
a369a0e1d4ace1a8d66908aa43543bea03c76f5b

SHA256
d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

SHA512
181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
140d799c60e148f8cc042ffa064fc046

SHA1
83c349321e880dc3ca1d1c21489a3718f6645695

SHA256
73fa88d34d90f4bee42f4dfad1f639ed6c19393c66cce966d71f5b8232cd1433

SHA512
12025bf79b852bdf46870c3d2e3b2a52793cc1ad49b62a2917b2e80ddf504560d77cdceafa3cc04b1b3fe19cff13d687a8bf5ed3edeac25cd9e485b005667b36

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
140d799c60e148f8cc042ffa064fc046

SHA1
83c349321e880dc3ca1d1c21489a3718f6645695

SHA256
73fa88d34d90f4bee42f4dfad1f639ed6c19393c66cce966d71f5b8232cd1433

SHA512
12025bf79b852bdf46870c3d2e3b2a52793cc1ad49b62a2917b2e80ddf504560d77cdceafa3cc04b1b3fe19cff13d687a8bf5ed3edeac25cd9e485b005667b36

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
140d799c60e148f8cc042ffa064fc046

SHA1
83c349321e880dc3ca1d1c21489a3718f6645695

SHA256
73fa88d34d90f4bee42f4dfad1f639ed6c19393c66cce966d71f5b8232cd1433

SHA512
12025bf79b852bdf46870c3d2e3b2a52793cc1ad49b62a2917b2e80ddf504560d77cdceafa3cc04b1b3fe19cff13d687a8bf5ed3edeac25cd9e485b005667b36

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
140d799c60e148f8cc042ffa064fc046

SHA1
83c349321e880dc3ca1d1c21489a3718f6645695

SHA256
73fa88d34d90f4bee42f4dfad1f639ed6c19393c66cce966d71f5b8232cd1433

SHA512
12025bf79b852bdf46870c3d2e3b2a52793cc1ad49b62a2917b2e80ddf504560d77cdceafa3cc04b1b3fe19cff13d687a8bf5ed3edeac25cd9e485b005667b36

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
140d799c60e148f8cc042ffa064fc046

SHA1
83c349321e880dc3ca1d1c21489a3718f6645695

SHA256
73fa88d34d90f4bee42f4dfad1f639ed6c19393c66cce966d71f5b8232cd1433

SHA512
12025bf79b852bdf46870c3d2e3b2a52793cc1ad49b62a2917b2e80ddf504560d77cdceafa3cc04b1b3fe19cff13d687a8bf5ed3edeac25cd9e485b005667b36

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
140d799c60e148f8cc042ffa064fc046

SHA1
83c349321e880dc3ca1d1c21489a3718f6645695

SHA256
73fa88d34d90f4bee42f4dfad1f639ed6c19393c66cce966d71f5b8232cd1433

SHA512
12025bf79b852bdf46870c3d2e3b2a52793cc1ad49b62a2917b2e80ddf504560d77cdceafa3cc04b1b3fe19cff13d687a8bf5ed3edeac25cd9e485b005667b36

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
140d799c60e148f8cc042ffa064fc046

SHA1
83c349321e880dc3ca1d1c21489a3718f6645695

SHA256
73fa88d34d90f4bee42f4dfad1f639ed6c19393c66cce966d71f5b8232cd1433

SHA512
12025bf79b852bdf46870c3d2e3b2a52793cc1ad49b62a2917b2e80ddf504560d77cdceafa3cc04b1b3fe19cff13d687a8bf5ed3edeac25cd9e485b005667b36

Download Submit
memory/272-589-0x0000000001080000-0x00000000015C5000-memory.dmp

Filesize
5.3MB

Download
memory/328-592-0x0000000001080000-0x00000000015C5000-memory.dmp

Filesize
5.3MB

Download
memory/328-593-0x00000000029D0000-0x0000000002F15000-memory.dmp

Filesize
5.3MB

Download
memory/824-594-0x0000000001080000-0x00000000015C5000-memory.dmp

Filesize
5.3MB

Download
memory/848-564-0x00000000010E0000-0x0000000001625000-memory.dmp

Filesize
5.3MB

Download
memory/1060-1276-0x0000000003FF0000-0x0000000004535000-memory.dmp

Filesize
5.3MB

Download
memory/1060-591-0x0000000003FF0000-0x0000000004535000-memory.dmp

Filesize
5.3MB

Download
memory/1060-590-0x0000000003820000-0x0000000003D65000-memory.dmp

Filesize
5.3MB

Download
memory/1060-588-0x0000000002CA0000-0x00000000031E5000-memory.dmp

Filesize
5.3MB

Download
memory/1060-550-0x0000000001080000-0x00000000015C5000-memory.dmp

Filesize
5.3MB

Download
memory/1144-507-0x0000000002B50000-0x0000000002F38000-memory.dmp

Filesize
3.9MB

Download
memory/1144-618-0x0000000002B50000-0x0000000002F38000-memory.dmp

Filesize
3.9MB

Download
memory/1144-506-0x0000000002B50000-0x0000000002F38000-memory.dmp

Filesize
3.9MB

Download
memory/1144-508-0x0000000002B50000-0x0000000002F38000-memory.dmp

Filesize
3.9MB

Download
memory/1144-617-0x0000000002B50000-0x0000000002F38000-memory.dmp

Filesize
3.9MB

Download
memory/1460-545-0x0000000005990000-0x0000000005ED5000-memory.dmp

Filesize
5.3MB

Download
memory/1460-661-0x0000000002770000-0x0000000002780000-memory.dmp

Filesize
64KB

Download
memory/1460-602-0x0000000000DC0000-0x00000000011A8000-memory.dmp

Filesize
3.9MB

Download
memory/1460-525-0x0000000002770000-0x0000000002780000-memory.dmp

Filesize
64KB

Download
memory/1460-509-0x0000000000DC0000-0x00000000011A8000-memory.dmp

Filesize
3.9MB

Download
memory/1460-544-0x0000000005990000-0x0000000005ED5000-memory.dmp

Filesize
5.3MB

Download
memory/1460-616-0x0000000000DC0000-0x00000000011A8000-memory.dmp

Filesize
3.9MB

Download
memory/1460-543-0x0000000005990000-0x0000000005ED5000-memory.dmp

Filesize
5.3MB

Download
memory/1700-2014-0x0000000000230000-0x0000000000247000-memory.dmp

Filesize
92KB

Download
memory/1700-2013-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1700-2015-0x0000000000230000-0x0000000000247000-memory.dmp

Filesize
92KB

Download
memory/1700-2030-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1720-385-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/1720-387-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/1720-612-0x0000000002F70000-0x0000000002F80000-memory.dmp

Filesize
64KB

Download
memory/1720-367-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/1720-366-0x0000000000330000-0x0000000000718000-memory.dmp

Filesize
3.9MB

Download
memory/1720-365-0x0000000000730000-0x0000000000733000-memory.dmp

Filesize
12KB

Download
memory/1720-541-0x0000000000330000-0x0000000000718000-memory.dmp

Filesize
3.9MB

Download
memory/1720-383-0x0000000000330000-0x0000000000718000-memory.dmp

Filesize
3.9MB

Download
memory/1720-1650-0x0000000000330000-0x0000000000718000-memory.dmp

Filesize
3.9MB

Download
memory/1720-1662-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/1720-364-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/1720-384-0x0000000000330000-0x0000000000718000-memory.dmp

Filesize
3.9MB

Download
memory/1720-443-0x0000000000330000-0x0000000000718000-memory.dmp

Filesize
3.9MB

Download
memory/1720-1622-0x0000000000330000-0x0000000000718000-memory.dmp

Filesize
3.9MB

Download
memory/1720-394-0x0000000000330000-0x0000000000718000-memory.dmp

Filesize
3.9MB

Download
memory/1720-397-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/1720-414-0x0000000000330000-0x0000000000718000-memory.dmp

Filesize
3.9MB

Download
memory/1720-415-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/1720-728-0x0000000000330000-0x0000000000718000-memory.dmp

Filesize
3.9MB

Download
memory/1720-73-0x0000000000330000-0x0000000000718000-memory.dmp

Filesize
3.9MB

Download
memory/1720-542-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/1720-466-0x0000000002F70000-0x0000000002F80000-memory.dmp

Filesize
64KB

Download
memory/1720-444-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2016-71-0x0000000002CC0000-0x00000000030A8000-memory.dmp

Filesize
3.9MB

Download
memory/2016-382-0x0000000002CC0000-0x00000000030A8000-memory.dmp

Filesize
3.9MB

Download