78d84068b47cf28b76c88ba4474c7c187510f4e4e967d079d3761dcab7851655

Resubmissions

21-03-2023 22:25

230321-2cdt2afd7z 8

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21-03-2023 22:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TLauncher-2.876-Installer-1.0.7-global.exe
Size

22.6MB
MD5

e89a95bce6075955a4e1acdb6bb56561
SHA1

8b17013cbf2ea69d625d7bcb1e578933c13678fc
SHA256

78d84068b47cf28b76c88ba4474c7c187510f4e4e967d079d3761dcab7851655
SHA512

4ccb33f60c9292e12daa53b49524a36bbe1c1ca86d794b5134b8b954736a532e9f202123b39036c6a9c557e128bd8361e5c1cb86d40723cc00784026741d5e65
SSDEEP

393216:DXkoYB+UAVl/Pfs/dQETVlOBbpFEjdGphRqV56HpkvQFa2Vj4h2cU:D0oYB+3fHHExi73qqHpU2Vj4hE

Score

8^/10

adware discovery persistence spyware stealer upx

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 14 IoCs

Processes:

irsetup.exeBrowserInstaller.exeirsetup.exeopera-installer-bro.exeopera-installer-bro.exeDllHost.exeopera-installer-bro.exeopera-installer-bro.exe_sfx.exeassistant_installer.exeassistant_installer.exejre-windows.exejre-windows.exeMSI18D2.tmp

pid	process
776	irsetup.exe
1104	BrowserInstaller.exe
1716	irsetup.exe
1608	opera-installer-bro.exe
1672	opera-installer-bro.exe
1960	DllHost.exe
1612	opera-installer-bro.exe
1556	opera-installer-bro.exe
1756	_sfx.exe
2116	assistant_installer.exe
2288	assistant_installer.exe
2428	jre-windows.exe
2492	jre-windows.exe
2536	MSI18D2.tmp

Loads dropped DLL 52 IoCs

Processes:

TLauncher-2.876-Installer-1.0.7-global.exeirsetup.exeBrowserInstaller.exeirsetup.exeopera-installer-bro.exeopera-installer-bro.exeDllHost.exeopera-installer-bro.exeopera-installer-bro.exeassistant_installer.exejre-windows.exeMsiExec.exemsiexec.exerundll32.exe

pid	process
924	TLauncher-2.876-Installer-1.0.7-global.exe
924	TLauncher-2.876-Installer-1.0.7-global.exe
924	TLauncher-2.876-Installer-1.0.7-global.exe
924	TLauncher-2.876-Installer-1.0.7-global.exe
776	irsetup.exe
776	irsetup.exe
776	irsetup.exe
776	irsetup.exe
776	irsetup.exe
776	irsetup.exe
776	irsetup.exe
776	irsetup.exe
1104	BrowserInstaller.exe
1104	BrowserInstaller.exe
1104	BrowserInstaller.exe
1104	BrowserInstaller.exe
1716	irsetup.exe
1716	irsetup.exe
1716	irsetup.exe
1716	irsetup.exe
1716	irsetup.exe
1716	irsetup.exe
1716	irsetup.exe
1716	irsetup.exe
1608	opera-installer-bro.exe
1608	opera-installer-bro.exe
1672	opera-installer-bro.exe
1608	opera-installer-bro.exe
1960	DllHost.exe
1608	opera-installer-bro.exe
1612	opera-installer-bro.exe
1612	opera-installer-bro.exe
1556	opera-installer-bro.exe
1608	opera-installer-bro.exe
1608	opera-installer-bro.exe
1608	opera-installer-bro.exe
1608	opera-installer-bro.exe
2116	assistant_installer.exe
776	irsetup.exe
2428	jre-windows.exe
1244
1244
2448	MsiExec.exe
2448	MsiExec.exe
2040	msiexec.exe
2448	MsiExec.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe
1312	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

rundll32.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0039-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0058-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0033-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0063-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0064-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0008-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0044-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0073-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0055-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0008-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0059-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0027-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0044-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0039-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0078-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0051-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0063-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0062-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0020-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0049-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-FFFF-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0056-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0063-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0078-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0046-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0064-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0065-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0063-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0003-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0070-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0013-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0010-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0040-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0089-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0059-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0043-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0038-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0012-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0015-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0059-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0066-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0035-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe

UPX packed file 50 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
behavioral1/memory/776-73-0x00000000008D0000-0x0000000000CB8000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
behavioral1/memory/776-367-0x00000000008D0000-0x0000000000CB8000-memory.dmp	upx
behavioral1/memory/776-383-0x00000000008D0000-0x0000000000CB8000-memory.dmp	upx
behavioral1/memory/776-389-0x00000000008D0000-0x0000000000CB8000-memory.dmp	upx
behavioral1/memory/776-418-0x00000000008D0000-0x0000000000CB8000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
behavioral1/memory/1716-484-0x00000000003E0000-0x00000000007C8000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe	upx
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe	upx
behavioral1/memory/1960-533-0x0000000000EE0000-0x0000000001425000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
behavioral1/memory/1612-553-0x0000000001310000-0x0000000001855000-memory.dmp	upx
behavioral1/memory/1556-555-0x0000000001310000-0x0000000001855000-memory.dmp	upx
behavioral1/memory/1672-550-0x0000000001310000-0x0000000001855000-memory.dmp	upx
behavioral1/memory/1608-548-0x0000000001310000-0x0000000001855000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
behavioral1/memory/776-564-0x00000000008D0000-0x0000000000CB8000-memory.dmp	upx
behavioral1/memory/1716-578-0x00000000003E0000-0x00000000007C8000-memory.dmp	upx
behavioral1/memory/776-599-0x00000000008D0000-0x0000000000CB8000-memory.dmp	upx
behavioral1/memory/776-1532-0x00000000008D0000-0x0000000000CB8000-memory.dmp	upx
behavioral1/memory/776-1644-0x00000000008D0000-0x0000000000CB8000-memory.dmp	upx
behavioral1/memory/776-1659-0x00000000008D0000-0x0000000000CB8000-memory.dmp	upx
behavioral1/memory/1716-1664-0x00000000003E0000-0x00000000007C8000-memory.dmp	upx
behavioral1/memory/776-1676-0x00000000008D0000-0x0000000000CB8000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 26 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exeopera-installer-bro.exeopera-installer-bro.exe

description	ioc	process
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	opera-installer-bro.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\D:	opera-installer-bro.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

rundll32.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	rundll32.exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Atlantic\Azores	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Paris	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Port_Moresby	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\bin\awt.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\bin\keytool.exe	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Merida	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Scoresbysund	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Brunei	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\bin\npt.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Argentina\San_Juan	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Kaliningrad	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\bin\JavaAccessBridge-64.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\deploy\messages_de.properties	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Bahia	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\currency.data	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\jfr\profile.jfc	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Stockholm	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javaw.exe	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java_crw_demo.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Thule	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-10	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Belgrade	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Indian\Mauritius	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\bin\kcms.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Belem	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Dawson	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Monterrey	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\ext\zipfs.jar	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Chatham	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jsound.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Hebron	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Tbilisi	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Minsk	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\bin\sunec.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\cmm\PYCC.pf	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\security\blacklist	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Atlantic\Cape_Verde	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Bougainville	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Guadalcanal	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Antarctica\Vostok	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Atlantic\Reykjavik	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Copenhagen	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Zurich	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Rarotonga	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\MET	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Anchorage	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Inuvik	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\bin\kinit.exe	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\deploy\messages.properties	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Samarkand	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Apia	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Fakaofo	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\classlist	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\ext\sunmscapi.jar	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Africa\Tripoli	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Mazatlan	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Hovd	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\SystemV\YST9	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\bin\dt_socket.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Pangnirtung	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Beirut	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+2	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Budapest	msiexec.exe

Drops file in Windows directory 8 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSIFE8B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFE8C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI18C1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI18D2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI199E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\6dfb42.ipi	msiexec.exe
File created	C:\Windows\Installer\6dfb42.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msiexec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msiexec.exe

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

irsetup.exerundll32.exejre-windows.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main	irsetup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Policy = "19"	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4B5F-9EE6-34795C46E7E7}	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main	jre-windows.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppName	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppPath	rundll32.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

msiexec.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe

Modifies registry class 64 IoCs

Processes:

rundll32.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0074-ABCDEFFEDCBB}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0063-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0047-ABCDEFFEDCBA}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0029-ABCDEFFEDCBC}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0043-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0056-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0072-ABCDEFFEDCBB}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0052-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0090-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0020-ABCDEFFEDCBC}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0042-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0046-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0014-0002-0033-ABCDEFFEDCBB}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0014-0002-0038-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0075-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\ProgID\ = "JavaWebStart.isInstalled.1.7.0.0"	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0070-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0041-ABCDEFFEDCBB}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0074-ABCDEFFEDCBA}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBC}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0032-ABCDEFFEDCBC}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0009-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0054-ABCDEFFEDCBC}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0014-0002-0043-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0078-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0038-ABCDEFFEDCBC}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0078-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0023-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0028-ABCDEFFEDCBC}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0069-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0073-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0016-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0065-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0077-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0025-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBA}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0052-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0019-ABCDEFFEDCBA}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0049-ABCDEFFEDCBC}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0066-ABCDEFFEDCBA}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0065-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0073-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0078-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBC}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0046-ABCDEFFEDCBC}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0079-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0042-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0079-ABCDEFFEDCBA}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0018-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

irsetup.exeopera-installer-bro.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	irsetup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	opera-installer-bro.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	opera-installer-bro.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	opera-installer-bro.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	opera-installer-bro.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

MSI18D2.tmp

pid process

2536 MSI18D2.tmp

pid	process
2536	MSI18D2.tmp

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

jre-windows.exemsiexec.exeMSI18D2.tmprundll32.exe

description	pid	process
Token: SeShutdownPrivilege	2492	jre-windows.exe
Token: SeIncreaseQuotaPrivilege	2492	jre-windows.exe
Token: SeRestorePrivilege	2040	msiexec.exe
Token: SeTakeOwnershipPrivilege	2040	msiexec.exe
Token: SeSecurityPrivilege	2040	msiexec.exe
Token: SeCreateTokenPrivilege	2492	jre-windows.exe
Token: SeAssignPrimaryTokenPrivilege	2492	jre-windows.exe
Token: SeLockMemoryPrivilege	2492	jre-windows.exe
Token: SeIncreaseQuotaPrivilege	2492	jre-windows.exe
Token: SeMachineAccountPrivilege	2492	jre-windows.exe
Token: SeTcbPrivilege	2492	jre-windows.exe
Token: SeSecurityPrivilege	2492	jre-windows.exe
Token: SeTakeOwnershipPrivilege	2492	jre-windows.exe
Token: SeLoadDriverPrivilege	2492	jre-windows.exe
Token: SeSystemProfilePrivilege	2492	jre-windows.exe
Token: SeSystemtimePrivilege	2492	jre-windows.exe
Token: SeProfSingleProcessPrivilege	2492	jre-windows.exe
Token: SeIncBasePriorityPrivilege	2492	jre-windows.exe
Token: SeCreatePagefilePrivilege	2492	jre-windows.exe
Token: SeCreatePermanentPrivilege	2492	jre-windows.exe
Token: SeBackupPrivilege	2492	jre-windows.exe
Token: SeRestorePrivilege	2492	jre-windows.exe
Token: SeShutdownPrivilege	2492	jre-windows.exe
Token: SeDebugPrivilege	2492	jre-windows.exe
Token: SeAuditPrivilege	2492	jre-windows.exe
Token: SeSystemEnvironmentPrivilege	2492	jre-windows.exe
Token: SeChangeNotifyPrivilege	2492	jre-windows.exe
Token: SeRemoteShutdownPrivilege	2492	jre-windows.exe
Token: SeUndockPrivilege	2492	jre-windows.exe
Token: SeSyncAgentPrivilege	2492	jre-windows.exe
Token: SeEnableDelegationPrivilege	2492	jre-windows.exe
Token: SeManageVolumePrivilege	2492	jre-windows.exe
Token: SeImpersonatePrivilege	2492	jre-windows.exe
Token: SeCreateGlobalPrivilege	2492	jre-windows.exe
Token: SeRestorePrivilege	2040	msiexec.exe
Token: SeTakeOwnershipPrivilege	2040	msiexec.exe
Token: SeRestorePrivilege	2040	msiexec.exe
Token: SeTakeOwnershipPrivilege	2040	msiexec.exe
Token: SeRestorePrivilege	2040	msiexec.exe
Token: SeTakeOwnershipPrivilege	2040	msiexec.exe
Token: SeRestorePrivilege	2040	msiexec.exe
Token: SeTakeOwnershipPrivilege	2040	msiexec.exe
Token: SeDebugPrivilege	2536	MSI18D2.tmp
Token: SeRestorePrivilege	2040	msiexec.exe
Token: SeTakeOwnershipPrivilege	2040	msiexec.exe
Token: SeBackupPrivilege	1312	rundll32.exe
Token: SeRestorePrivilege	1312	rundll32.exe
Token: SeBackupPrivilege	1312	rundll32.exe
Token: SeRestorePrivilege	1312	rundll32.exe
Token: SeBackupPrivilege	1312	rundll32.exe
Token: SeRestorePrivilege	1312	rundll32.exe
Token: SeRestorePrivilege	2040	msiexec.exe
Token: SeTakeOwnershipPrivilege	2040	msiexec.exe
Token: SeRestorePrivilege	2040	msiexec.exe
Token: SeTakeOwnershipPrivilege	2040	msiexec.exe
Token: SeRestorePrivilege	2040	msiexec.exe
Token: SeTakeOwnershipPrivilege	2040	msiexec.exe
Token: SeRestorePrivilege	2040	msiexec.exe
Token: SeTakeOwnershipPrivilege	2040	msiexec.exe
Token: SeRestorePrivilege	2040	msiexec.exe
Token: SeTakeOwnershipPrivilege	2040	msiexec.exe
Token: SeRestorePrivilege	2040	msiexec.exe
Token: SeTakeOwnershipPrivilege	2040	msiexec.exe
Token: SeRestorePrivilege	2040	msiexec.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

irsetup.exeirsetup.exejre-windows.exe

pid	process
776	irsetup.exe
776	irsetup.exe
776	irsetup.exe
776	irsetup.exe
776	irsetup.exe
776	irsetup.exe
1716	irsetup.exe
1716	irsetup.exe
2492	jre-windows.exe
2492	jre-windows.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

TLauncher-2.876-Installer-1.0.7-global.exeirsetup.exeBrowserInstaller.exeirsetup.exeopera-installer-bro.exeopera-installer-bro.exe

description	pid	process	target process
PID 924 wrote to memory of 776	924	TLauncher-2.876-Installer-1.0.7-global.exe	irsetup.exe
PID 924 wrote to memory of 776	924	TLauncher-2.876-Installer-1.0.7-global.exe	irsetup.exe
PID 924 wrote to memory of 776	924	TLauncher-2.876-Installer-1.0.7-global.exe	irsetup.exe
PID 924 wrote to memory of 776	924	TLauncher-2.876-Installer-1.0.7-global.exe	irsetup.exe
PID 924 wrote to memory of 776	924	TLauncher-2.876-Installer-1.0.7-global.exe	irsetup.exe
PID 924 wrote to memory of 776	924	TLauncher-2.876-Installer-1.0.7-global.exe	irsetup.exe
PID 924 wrote to memory of 776	924	TLauncher-2.876-Installer-1.0.7-global.exe	irsetup.exe
PID 776 wrote to memory of 1104	776	irsetup.exe	BrowserInstaller.exe
PID 776 wrote to memory of 1104	776	irsetup.exe	BrowserInstaller.exe
PID 776 wrote to memory of 1104	776	irsetup.exe	BrowserInstaller.exe
PID 776 wrote to memory of 1104	776	irsetup.exe	BrowserInstaller.exe
PID 776 wrote to memory of 1104	776	irsetup.exe	BrowserInstaller.exe
PID 776 wrote to memory of 1104	776	irsetup.exe	BrowserInstaller.exe
PID 776 wrote to memory of 1104	776	irsetup.exe	BrowserInstaller.exe
PID 1104 wrote to memory of 1716	1104	BrowserInstaller.exe	irsetup.exe
PID 1104 wrote to memory of 1716	1104	BrowserInstaller.exe	irsetup.exe
PID 1104 wrote to memory of 1716	1104	BrowserInstaller.exe	irsetup.exe
PID 1104 wrote to memory of 1716	1104	BrowserInstaller.exe	irsetup.exe
PID 1104 wrote to memory of 1716	1104	BrowserInstaller.exe	irsetup.exe
PID 1104 wrote to memory of 1716	1104	BrowserInstaller.exe	irsetup.exe
PID 1104 wrote to memory of 1716	1104	BrowserInstaller.exe	irsetup.exe
PID 1716 wrote to memory of 1608	1716	irsetup.exe	opera-installer-bro.exe
PID 1716 wrote to memory of 1608	1716	irsetup.exe	opera-installer-bro.exe
PID 1716 wrote to memory of 1608	1716	irsetup.exe	opera-installer-bro.exe
PID 1716 wrote to memory of 1608	1716	irsetup.exe	opera-installer-bro.exe
PID 1716 wrote to memory of 1608	1716	irsetup.exe	opera-installer-bro.exe
PID 1716 wrote to memory of 1608	1716	irsetup.exe	opera-installer-bro.exe
PID 1716 wrote to memory of 1608	1716	irsetup.exe	opera-installer-bro.exe
PID 1608 wrote to memory of 1672	1608	opera-installer-bro.exe	opera-installer-bro.exe
PID 1608 wrote to memory of 1672	1608	opera-installer-bro.exe	opera-installer-bro.exe
PID 1608 wrote to memory of 1672	1608	opera-installer-bro.exe	opera-installer-bro.exe
PID 1608 wrote to memory of 1672	1608	opera-installer-bro.exe	opera-installer-bro.exe
PID 1608 wrote to memory of 1672	1608	opera-installer-bro.exe	opera-installer-bro.exe
PID 1608 wrote to memory of 1672	1608	opera-installer-bro.exe	opera-installer-bro.exe
PID 1608 wrote to memory of 1672	1608	opera-installer-bro.exe	opera-installer-bro.exe
PID 1608 wrote to memory of 1960	1608	opera-installer-bro.exe	DllHost.exe
PID 1608 wrote to memory of 1960	1608	opera-installer-bro.exe	DllHost.exe
PID 1608 wrote to memory of 1960	1608	opera-installer-bro.exe	DllHost.exe
PID 1608 wrote to memory of 1960	1608	opera-installer-bro.exe	DllHost.exe
PID 1608 wrote to memory of 1960	1608	opera-installer-bro.exe	DllHost.exe
PID 1608 wrote to memory of 1960	1608	opera-installer-bro.exe	DllHost.exe
PID 1608 wrote to memory of 1960	1608	opera-installer-bro.exe	DllHost.exe
PID 1608 wrote to memory of 1612	1608	opera-installer-bro.exe	opera-installer-bro.exe
PID 1608 wrote to memory of 1612	1608	opera-installer-bro.exe	opera-installer-bro.exe
PID 1608 wrote to memory of 1612	1608	opera-installer-bro.exe	opera-installer-bro.exe
PID 1608 wrote to memory of 1612	1608	opera-installer-bro.exe	opera-installer-bro.exe
PID 1608 wrote to memory of 1612	1608	opera-installer-bro.exe	opera-installer-bro.exe
PID 1608 wrote to memory of 1612	1608	opera-installer-bro.exe	opera-installer-bro.exe
PID 1608 wrote to memory of 1612	1608	opera-installer-bro.exe	opera-installer-bro.exe
PID 1612 wrote to memory of 1556	1612	opera-installer-bro.exe	opera-installer-bro.exe
PID 1612 wrote to memory of 1556	1612	opera-installer-bro.exe	opera-installer-bro.exe
PID 1612 wrote to memory of 1556	1612	opera-installer-bro.exe	opera-installer-bro.exe
PID 1612 wrote to memory of 1556	1612	opera-installer-bro.exe	opera-installer-bro.exe
PID 1612 wrote to memory of 1556	1612	opera-installer-bro.exe	opera-installer-bro.exe
PID 1612 wrote to memory of 1556	1612	opera-installer-bro.exe	opera-installer-bro.exe
PID 1612 wrote to memory of 1556	1612	opera-installer-bro.exe	opera-installer-bro.exe
PID 1608 wrote to memory of 1756	1608	opera-installer-bro.exe	_sfx.exe
PID 1608 wrote to memory of 1756	1608	opera-installer-bro.exe	_sfx.exe
PID 1608 wrote to memory of 1756	1608	opera-installer-bro.exe	_sfx.exe
PID 1608 wrote to memory of 1756	1608	opera-installer-bro.exe	_sfx.exe
PID 1608 wrote to memory of 1756	1608	opera-installer-bro.exe	_sfx.exe
PID 1608 wrote to memory of 1756	1608	opera-installer-bro.exe	_sfx.exe
PID 1608 wrote to memory of 1756	1608	opera-installer-bro.exe	_sfx.exe
PID 1608 wrote to memory of 2116	1608	opera-installer-bro.exe	assistant_installer.exe

C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe
"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:924

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe" "__IRCT:3" "__IRTSS:23645635" "__IRSID:S-1-5-21-3948302646-268491222-1934009652-1000"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:776

C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1104

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816338 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:1840798" "__IRSID:S-1-5-21-3948302646-268491222-1934009652-1000"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
"C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1608

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=96.0.4693.80 --initial-client-data=0x1a4,0x1a8,0x1ac,0x178,0x1b0,0x717524a8,0x717524b8,0x717524c4
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe" --version
6⤵
PID:1960

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
"C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=1608 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20230321232806" --session-guid=2a1bfa31-d52c-43ed-9505-9000bc59e8bb --server-tracking-blob=ODY2OWViNmNlN2U4ODhkZjA3ZjczZjkxNDMzZjI5NjdkMjgwM2NlYTNiYzk4N2VkZDZjNzZmM2U1YWNlMzYxMzp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjciLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNjc5NDM3Njg2LjYwNjEiLCJ1c2VyYWdlbnQiOiJTZXR1cCBGYWN0b3J5IDkuMCIsInV0bSI6eyJjYW1wYWlnbiI6Ik9wZXJhRGVza3RvcCIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Ik1TVEwifSwidXVpZCI6IjVjNjM0YmY3LTA5NGItNDBhZC04MDc1LTQ1ZjBkZTNiNGUyMCJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=0C03000000000000
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1612

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=96.0.4693.80 --initial-client-data=0x1b0,0x1b4,0x1b8,0x178,0x1bc,0x70cb24a8,0x70cb24b8,0x70cb24c4
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303212328061\assistant\_sfx.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303212328061\assistant\_sfx.exe"
6⤵
- Executes dropped EXE
PID:1756

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303212328061\assistant\assistant_installer.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303212328061\assistant\assistant_installer.exe" --version
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303212328061\assistant\assistant_installer.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303212328061\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=96.0.4693.50 --initial-client-data=0x148,0x14c,0x150,0x11c,0x154,0x566c28,0x566c38,0x566c44
7⤵
- Executes dropped EXE
PID:2288

C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
"C:\Users\Admin\AppData\Local\Temp\jre-windows.exe" STATIC=1
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428

C:\Users\Admin\AppData\Local\Temp\jds7179290.tmp\jre-windows.exe
"C:\Users\Admin\AppData\Local\Temp\jds7179290.tmp\jre-windows.exe" "STATIC=1"
4⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2492

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1960

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2040

C:\Windows\system32\MsiExec.exe
C:\Windows\system32\MsiExec.exe -Embedding E949A51574332771A0006ED0A776C629
2⤵
- Loads dropped DLL
PID:2448

C:\Windows\Installer\MSI18D2.tmp
"C:\Windows\Installer\MSI18D2.tmp" C:\Program Files\Java\jre7\;C;2
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2536

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Program Files\Java\jre7\bin\\installer.dll",UninstallJREEntryPoint
2⤵
- Loads dropped DLL
- Registers COM server for autorun
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1312

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\6dfb43.rbs
Filesize
112KB

MD5
2b5dd8c61cfb96d9ab1de246749d91f0

SHA1
c45d94604e42626c84b2f1a6a0b0c7736503c679

SHA256
b37b0a48f11d34b345cdcdb7768633f118eaf0d172b7e86f2ce9edeeca8e5f39

SHA512
ac0ce4c11b27d92dcd38cc72ab6a3a65ce5781955daf6c2b936153fd7abfd7ad183ff667da2e39a39683b45ea484c6558d206902e44b214d4d7f6af93b71bbc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
Filesize
471B

MD5
798b4691d215aa51ce3d1c0cbb084385

SHA1
3c2975c4442915c1dc8e3371efeb0757b765541b

SHA256
446d42b19b07b384014cefa8bcffa71a70ee3fd9dc3da1aa5fee0ae9b2e2475e

SHA512
5d6dfa2ec8a2f44e79c415d444f7802455547ea94ef073ea85d0823c05c0376216378e1eb5aeeaa6f19f8accf17894e64f8e52ba4f825cf8bac0aa1b4445a386

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
28547fec3ff49e7f149763a35f1bcd10

SHA1
a132c68ba9d08e9cc11c13ff9db5027251846c6c

SHA256
050b9dc8b4faf468312ce5c4ae6043be94da752887d2a96aa263e94109c4cdb0

SHA512
70e687685c5ff329831ad320c93144512e0425a1fa233733e1bcd8dd8b0eed37e710f88fbdb714673b67447366e81d364543b82135a8c6349612997e264f8cdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
ece11110facb0b59de10931f58cf5960

SHA1
f2a41564246a01b9956f9258365dcc2414644849

SHA256
27e5cabfc532f6ee0940441787330b4976d3aa3dfd19f5aab5a5ce8f4f7e0194

SHA512
c40f8bea9cb39452b484abd69aaa88f5a4d17b9671505d98f6ea23fa3e61bc6102a8d61765531b2a1abab4c13055e3444b34c8056889419fa7527aee9261b90f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
Filesize
404B

MD5
eea94709260ea91e2894056c46ffe07f

SHA1
6a731217da95e49bc801f42ac24755348c2c4edb

SHA256
54ef2df6a6186d4c8a3893cf57f23e6143bfb649266975c45b051be7a90c2163

SHA512
378b36c86219268f1818af5c30c0f539617b359ed41ba0c25a7dc6df70ff930376189ee261ae891ddda2955a817f32ceb9513ddbe16aee7dc450a8a80007eb70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ACT9UUKV\rtutils[2]
Filesize
244B

MD5
c0a4cebb2c15be8262bf11de37606e07

SHA1
cafc2ccb797df31eecd3ae7abd396567de8e736d

SHA256
7da9aa32aa10b69f34b9d3602a3b8a15eb7c03957512714392f12458726ac5f1

SHA512
cc68f4bc22601430a77258c1d7e18d6366b6bf8f707d31933698b2008092ba5348c33fa8b03e18c4c707abf20ce3cbcb755226dc6489d2b19833809c98a11c74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AFOBZ3YS\common[2]
Filesize
1KB

MD5
f5bb484d82e7842a602337e34d11a8f6

SHA1
09ea1dee4b7c969771e97991c8f5826de637716f

SHA256
219108bfef63f97562c4532681b03675c9e698c5ae495205853dbcbfd93faf1a

SHA512
a23cc05b94842e1f3a53c2ea8a0b78061649e0a97fcd51c8673b2bcb6de80162c841e9fdde212d3dfd453933df2362dcb237fe629f802bafaa144e33ca78b978

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AFOBZ3YS\l10n[2]
Filesize
4KB

MD5
1fd5111b757493a27e697d57b351bb56

SHA1
9ca81a74fa5c960f4e8b3ad8a0e1ec9f55237711

SHA256
85bbec802e8624e7081abeae4f30bd98d9a9df6574bd01fe5251047e8fdaf59f

SHA512
80f532e4671d685fa8360ef47a09efcb3342bcfcf929170275465f9800bfbfffc35728a1ba496d4c04a1fdefb2776af02262c3774f83fea289585a5296d560b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KIMPJA9E\host[1]
Filesize
1KB

MD5
a752a4469ac0d91dd2cb1b766ba157de

SHA1
724ae6b6d6063306cc53b6ad07be6f88eaffbab3

SHA256
1e67043252582aea0e042f5a7be4a849b7cd01b133a489c3b2e67c10ade086f3

SHA512
abc2899705a23f15862acf3d407b700bb91c545722c02c7429745ab7f722507285c62614dcb87ea846f88fc0779345cb2e22dc3ad5f8113f6907821505be2c02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KIMPJA9E\masthead_fill[2]
Filesize
1KB

MD5
91a7b390315635f033459904671c196d

SHA1
b996e96492a01e1b26eb62c17212e19f22b865f3

SHA256
155d2a08198237a22ed23dbb6babbd87a0d4f96ffdc73e0119ab14e5dd3b7e00

SHA512
b3c8b6f86ecf45408ac6b6387ee2c1545115ba79771714c4dd4bbe98f41f7034eae0257ec43c880c2ee88c44e8fc48c775c5bb4fd48666a9a27a8f8ac6bcfdcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NMXH1C0L\layout[2]
Filesize
2KB

MD5
cc86b13a186fa96dfc6480a8024d2275

SHA1
d892a7f06dc12a0f2996cc094e0730fe14caf51a

SHA256
fab91ced243da62ec1d938503fa989462374df470be38707fbf59f73715af058

SHA512
0e3e4c9755aa8377e00fc9998faab0cd839dfa9f88ce4f4a46d8b5aaf7a33e59e26dbf55e9e7d1f8ef325d43302c68c44216adb565913d30818c159a182120fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NMXH1C0L\masthead_left[2]
Filesize
4KB

MD5
b663555027df2f807752987f002e52e7

SHA1
aef83d89f9c712a1cbf6f1cd98869822b73d08a6

SHA256
0ce32c034dfb7a635a7f6e8152666def16d860b6c631369013a0f34af9d17879

SHA512
b104ed3327fed172501c5aa990357b44e3b31bb75373fb8a4ea6470ee6a72e345c9dc4bcf46a1983c81adb567979e6e8e6517d943eb204c3f7fac559cd17c451

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NMXH1C0L\runtime[2]
Filesize
41KB

MD5
c65bc05f8e3c03fe4899862480f4d3f3

SHA1
5a5d38a3154430d1ada06724567eba14f652ae4e

SHA256
cc8f816e080d837cf1d98a1a301ab2a8ddd64ccad69d01995125645710b5ef21

SHA512
874112843ebc5eb4bc1038a003bd3706e55844205f0ad676ca76aaa9e51f8e9e05b61c427ee50bd193ed693124c9adff94689df1a73cfa35d981df9540a928ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
7d653e77212215fe139494d902f7c06c

SHA1
29c9635ab753cdabfc1af3920b08b1f521bc1373

SHA256
90d0e16d466d5948547d5392182037baa3baf97e6b1dc3351456d45efd7257c1

SHA512
06a610a0eb68df9356d32d7f066c3ed75c33ed13addadc85d1cef1ae966412cb2a93ac808d85fd574afba5cd403f271a3cc58276208c9fa02ead500a5676e9d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303212328061\additional_file0.tmp
Filesize
1.7MB

MD5
b386cdcb413405daa8219af8e4cbd318

SHA1
ce275ff8514fef0629c915a6ee7b5ac481b9043d

SHA256
408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e

SHA512
91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303212328061\assistant\_sfx.exe
Filesize
1.7MB

MD5
b386cdcb413405daa8219af8e4cbd318

SHA1
ce275ff8514fef0629c915a6ee7b5ac481b9043d

SHA256
408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e

SHA512
91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303212328061\assistant\_sfx.exe
Filesize
1.7MB

MD5
b386cdcb413405daa8219af8e4cbd318

SHA1
ce275ff8514fef0629c915a6ee7b5ac481b9043d

SHA256
408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e

SHA512
91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303212328061\assistant\assistant_installer.exe
Filesize
2.1MB

MD5
2f3d9e21e232b9bfea064d3b2264db06

SHA1
bafddc657d8d1bb531683b29b0342cc065ee51d2

SHA256
25528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d

SHA512
94e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303212328061\assistant\assistant_installer.exe
Filesize
2.1MB

MD5
2f3d9e21e232b9bfea064d3b2264db06

SHA1
bafddc657d8d1bb531683b29b0342cc065ee51d2

SHA256
25528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d

SHA512
94e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303212328061\assistant\assistant_installer.exe
Filesize
2.1MB

MD5
2f3d9e21e232b9bfea064d3b2264db06

SHA1
bafddc657d8d1bb531683b29b0342cc065ee51d2

SHA256
25528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d

SHA512
94e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303212328061\opera_package
Filesize
86.9MB

MD5
6b7771354e081eb94cdbf7627799da4f

SHA1
199341a750443cc6e9b2b2fa1e657d0dd327711f

SHA256
494d1247e61eebf703a6eb19c14bde88edd2f85515fefa4f0465f43873e69aab

SHA512
33e781a102ba3f5c3b1895540bc9c43b78bf4f19af4b91ae0c765594f39d6569d1bad207b33f808426d8ebdcb00c419b7bb76bb050bae0bb843f96dd84355800

Download Submit
C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
Filesize
1.8MB

MD5
52e46b1adf9cd40428b41755df527bd4

SHA1
5f0bb9c9c14208851beb5c93d9268c16ab39dc07

SHA256
a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

SHA512
813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

Download Submit
C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
Filesize
1.8MB

MD5
52e46b1adf9cd40428b41755df527bd4

SHA1
5f0bb9c9c14208851beb5c93d9268c16ab39dc07

SHA256
a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

SHA512
813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCFBF.tmp
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2303212328059331960.dll
Filesize
4.6MB

MD5
927a01657c6bee50ca093ffcfdc9134a

SHA1
f7e484a777affe3c6227a2be0a6560111e1be8f9

SHA256
b1012ab0e2e6a363372a14b480b4c8275c013e66c94adfb8857e523899350cc9

SHA512
718c25b4e95948b728fe7eda6c5953bc0246dc5730ba99a71c3963ebcffda58b1759bf2554fca297d1590d8768d50e0fd9c39bdf790f4d372bc4aa255bfb5db7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F46.tmp
Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCFD1.tmp
Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico
Filesize
116KB

MD5
e043a9cb014d641a56f50f9d9ac9a1b9

SHA1
61dc6aed3d0d1f3b8afe3d161410848c565247ed

SHA256
9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946

SHA512
4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe
Filesize
1.8MB

MD5
52e46b1adf9cd40428b41755df527bd4

SHA1
5f0bb9c9c14208851beb5c93d9268c16ab39dc07

SHA256
a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

SHA512
813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.PNG
Filesize
339B

MD5
bbdf2e8c0262e7e606d41ddbe5a3cd12

SHA1
acbb25f729af14b692ec9c8187a23b1a696f8e47

SHA256
d7c76896d206d977739556ad2d5811f7cf3117252afcd439a5aa0f2b645f6949

SHA512
0334fae3682889adbc18594b7917d8c93252a86bc04d08efc6860d5714ba4eb8aabc39c51e532c4aee57a938021540d2f2899781d9cd1de311036e1850a65067

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG104.PNG
Filesize
644B

MD5
38c12e1a54f8fd216ed3f13b36798cc6

SHA1
ccf1fe585d3374ebce4c1ec025e2d8ec39968a7c

SHA256
608924ba294590b5b706658d9aaa71b480ad9aa1b6797bbc5cf1632ac6c616b1

SHA512
0918af63f006d7fa04a3faeeb813e61c060316a126c4742a948a30f5b6ea368c3b8592011319dad3dbf8427dfcc095aa72f7b651d6fc31061f861f070447331b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG105.PNG
Filesize
40KB

MD5
98abbfa2908f51f4eda33f465ccacc03

SHA1
1bd17c0835b1c8196d0a8166b4818b3138f65a28

SHA256
10438b49eeac103534a5fd867888437b761f346cec8714daeb95fdd246cc540a

SHA512
9eaa76ab654a786f5af84e9a20e7d0efb22ee00977e662ab5a057da1aff1a7552150bba0253704f00e60115347bfb4fe1784a703ad3846e221dbee41ea7a1470

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG106.PNG
Filesize
1KB

MD5
0f414e91b67121d55587e7c004f35cb2

SHA1
6d63b4c6fa858f8cfd4b257600037e9c370355a8

SHA256
015dd2b2df51cd90438286d28b5719cbdf9a2e7bebf326b99c6c091ad98e4cc1

SHA512
1b7d8bbb97f6acb4984cd93578b5045cd4ce0813645a28d3b778489b646194e68b2a931f26a9c6a7026f98de29719132972eb983d771affdfe42c42622b786e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG109.PNG
Filesize
2KB

MD5
03b1d78771eb279766efb2d9f2fa8463

SHA1
8f10e304fd65e58136ccd6ab012ffc594e6fb707

SHA256
eec16d2cb57e38b485b6a269e9c2554c1dfc3b70dec9f7bbddc2b62526b3d832

SHA512
ca51cbaf20e6f62eb6ec69555d259ef61828d3166d09106bcd335dd417ed30660af71e7fd8db6bd22bf134cc530e1a55ecdd2c307e64e8edb28af95299d66f5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.PNG
Filesize
280B

MD5
5a7901f7df307fba45b1c377f2c94ccc

SHA1
d6630cf733033cdfbda7af3213d49b32f5b06919

SHA256
d8471d5a5b4792c4b49e80b5cb22ef1e938dc3069b210646704f658548d7a9f8

SHA512
fc0036a7ed4b53edd72b91c4824919e6e8a82b5be1e82cdc134e267ef4792424124fb6ba5d7c86cf686910da0baba8453d7a6c12b39a5b4c0cb70658580f3bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG22.PNG
Filesize
1KB

MD5
46a65321aa1fce57d465c26e8b6eb392

SHA1
9efb9a3acd5b32556ea66398c74b014f91087559

SHA256
61df7a1f0367209668d4f0f6a285b8baff864d1341d382ebbc7fd4e71036b666

SHA512
094d69016f066ae835c71d7a950217b9ad09e8cd4d74131787203cae950e572c18213dc1ded139b1fa46c7f803cc15bf4f596c9d51aefe0d43850ae2865f3707

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.PNG
Filesize
281B

MD5
05d7bba3d6ac92766c4495b8928202a6

SHA1
50b65a8ba5ed2633e43929ee4bd58c95a91a3363

SHA256
4804f3c4fae714657fdb85e98244828acc6ac938505c2da1ed694ae7b58f2949

SHA512
1544d5cd6f85aaeeacd26f2deb9da9eb510226b41079ee78c4dede14386e5ea3446efdfd475bfbfa3a6846fa2ff23d64f4dad3a4ddd304e32de80e4d7bcbc600

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG45.PNG
Filesize
438B

MD5
09229c3bfb801177839a7c2e22e33a1b

SHA1
f679c05c4c7b2f3722069420c6d6481fc856e7aa

SHA256
cbf81d779b469942613297a3ca6c09d885e3b1d4aa952dc1994a7175fbfc7e3f

SHA512
503bfa063b29dda95f15da303f707e5b78a6bdb74662c222d8a8b7e3a33264016a66acdd9de44aea932e7cde80a43c2406ea6f0250d3df8e182217bc4a0a7ed7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG85.PNG
Filesize
43KB

MD5
667b0b54ee5ba0d1cb66190226596e46

SHA1
b8658b35e7cf44b24053e4d01d3b51233d6526f6

SHA256
3a9ab8c3640f1b40b33553d7d3dd3d15bd6e702ef510ec0b66a2f14aa744bf83

SHA512
9ccc773214a0074634be66801d81d7a593ab154351fdbd1b93f56ffa80cf824ee31ff2e13f26536d5f3096e90df43fa223080b4dc55340614b076c08ef976dcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG86.PNG
Filesize
1KB

MD5
5bc85d12eb492baa3be9230f1fbdc342

SHA1
456fe4284fa916ad3817e7c3d419c13f4c949737

SHA256
9a27f240758513aa1cc05500171fe22fdb3a485781cba4798cefc29f6944373c

SHA512
3d55c597ac29d7f810980dfd89404d3ecbd2e652ae1bc5e6710668ad5386a0caecf3149289df13f6dabed6b2e4305a26684ab3bd21b255b37f8a596fe8d641b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
Filesize
1.7MB

MD5
1bbf5dd0b6ca80e4c7c77495c3f33083

SHA1
e0520037e60eb641ec04d1e814394c9da0a6a862

SHA256
bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

SHA512
97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
Filesize
97KB

MD5
da1d0cd400e0b6ad6415fd4d90f69666

SHA1
de9083d2902906cacf57259cf581b1466400b799

SHA256
7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

SHA512
f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Filesize
1.3MB

MD5
111dddf2f308abc2a8f7555d5f642751

SHA1
11e6cdccbf29a71a97011b9444cf20c83ad8b57b

SHA256
c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

SHA512
11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Filesize
1.3MB

MD5
111dddf2f308abc2a8f7555d5f642751

SHA1
11e6cdccbf29a71a97011b9444cf20c83ad8b57b

SHA256
c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

SHA512
11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Filesize
1.3MB

MD5
111dddf2f308abc2a8f7555d5f642751

SHA1
11e6cdccbf29a71a97011b9444cf20c83ad8b57b

SHA256
c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

SHA512
11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat
Filesize
108KB

MD5
aec508468d53ab8d55f5b4beb82c347d

SHA1
477d1ffb28834243f5811a4a2a54b4f0ca240120

SHA256
ebee84e34e221ad822486432333bad9e6357af2fb0d9651cc61c7fab8ec9b5bf

SHA512
26a0278af2a9e75ef966bc3f7f40d7669204c2004a043adaad102ef440caa6282e69372ca0c3c7d39a8450691d528c2dc77a4386bfb0c6e5a2a76c3fef900fbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
Filesize
1.3MB

MD5
5027f3112ac2d6f764769102a9145c8e

SHA1
a369a0e1d4ace1a8d66908aa43543bea03c76f5b

SHA256
d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

SHA512
181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
Filesize
1.3MB

MD5
5027f3112ac2d6f764769102a9145c8e

SHA1
a369a0e1d4ace1a8d66908aa43543bea03c76f5b

SHA256
d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

SHA512
181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
Filesize
1.3MB

MD5
5027f3112ac2d6f764769102a9145c8e

SHA1
a369a0e1d4ace1a8d66908aa43543bea03c76f5b

SHA256
d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

SHA512
181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\java_install_reg.log
Filesize
5KB

MD5
515c45d9da4c615f7aa931fe67941121

SHA1
71582470022487dc37cbcae8395bf9614ee8b365

SHA256
251c6dcbaff7129aba535ab84bba4e4828f2eacee8172d6b07acb4db2714c6c9

SHA512
587c416a401848ee7306a26c8a3100f778e71ccf1cbccdb04be9b405f85201120c2a1aac7551d6d119153d52b464eace7bf78fd4b0a81b8952700d30cb44f06f

Download Submit
C:\Users\Admin\AppData\Local\Temp\jusched.log
Filesize
3KB

MD5
671d7901b2ee1c03b7e09fabe951e3cd

SHA1
944d7020dc80496f229c0af7055ad7e9bf771418

SHA256
5c42e7bb16c408afcc8773079431ae2ef008ee4c7ee78af89841474cd9e2f4bd

SHA512
ea80085e33cb019058e70d4a3ee752b61f106ad70d483f94b6fa42e1936ffac022c231f7fb84c6c76edd0304205ec250243f9ce32f18db9899eaa2a97a3b0062

Download Submit
C:\Users\Admin\AppData\Local\Temp\jusched.log
Filesize
4KB

MD5
6a6d44a9e652685a765d90f3f3125b1a

SHA1
1d06a1c1d426976063eca390996ab77070b3608d

SHA256
a0d416c8d7a1abd467527e0a2156edaaa0c1e652ca912e6905d9cf9ae7b8bd5e

SHA512
5234584b62f2b75fb4bf87f691fc116deb60c0b624d977be4ffe60949f818cd7d65868258cc353398036d439b7ad0d567b819986af8e6c1ee077909937064e53

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
7d653e77212215fe139494d902f7c06c

SHA1
29c9635ab753cdabfc1af3920b08b1f521bc1373

SHA256
90d0e16d466d5948547d5392182037baa3baf97e6b1dc3351456d45efd7257c1

SHA512
06a610a0eb68df9356d32d7f066c3ed75c33ed13addadc85d1cef1ae966412cb2a93ac808d85fd574afba5cd403f271a3cc58276208c9fa02ead500a5676e9d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
7d653e77212215fe139494d902f7c06c

SHA1
29c9635ab753cdabfc1af3920b08b1f521bc1373

SHA256
90d0e16d466d5948547d5392182037baa3baf97e6b1dc3351456d45efd7257c1

SHA512
06a610a0eb68df9356d32d7f066c3ed75c33ed13addadc85d1cef1ae966412cb2a93ac808d85fd574afba5cd403f271a3cc58276208c9fa02ead500a5676e9d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
7d653e77212215fe139494d902f7c06c

SHA1
29c9635ab753cdabfc1af3920b08b1f521bc1373

SHA256
90d0e16d466d5948547d5392182037baa3baf97e6b1dc3351456d45efd7257c1

SHA512
06a610a0eb68df9356d32d7f066c3ed75c33ed13addadc85d1cef1ae966412cb2a93ac808d85fd574afba5cd403f271a3cc58276208c9fa02ead500a5676e9d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
7d653e77212215fe139494d902f7c06c

SHA1
29c9635ab753cdabfc1af3920b08b1f521bc1373

SHA256
90d0e16d466d5948547d5392182037baa3baf97e6b1dc3351456d45efd7257c1

SHA512
06a610a0eb68df9356d32d7f066c3ed75c33ed13addadc85d1cef1ae966412cb2a93ac808d85fd574afba5cd403f271a3cc58276208c9fa02ead500a5676e9d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
7d653e77212215fe139494d902f7c06c

SHA1
29c9635ab753cdabfc1af3920b08b1f521bc1373

SHA256
90d0e16d466d5948547d5392182037baa3baf97e6b1dc3351456d45efd7257c1

SHA512
06a610a0eb68df9356d32d7f066c3ed75c33ed13addadc85d1cef1ae966412cb2a93ac808d85fd574afba5cd403f271a3cc58276208c9fa02ead500a5676e9d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
7d653e77212215fe139494d902f7c06c

SHA1
29c9635ab753cdabfc1af3920b08b1f521bc1373

SHA256
90d0e16d466d5948547d5392182037baa3baf97e6b1dc3351456d45efd7257c1

SHA512
06a610a0eb68df9356d32d7f066c3ed75c33ed13addadc85d1cef1ae966412cb2a93ac808d85fd574afba5cd403f271a3cc58276208c9fa02ead500a5676e9d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
Filesize
602B

MD5
769a15ff9b8da38993f9cf3440b21e7c

SHA1
63ea1d4551de93d98fb342a50fef0078cd13e622

SHA256
2de6d9affccb809e81f5747a0e199bbe0e6aaa5174c82a21e801a58e557c3d7f

SHA512
c689175106aad6c65bf6f051561adeddcd3c7ab10da3a0d0a66f9d93aac873cb618db362872d16fde142a049c1cd96551519d62df121bd7956d22ff40f087d80

Download Submit
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
Filesize
6.3MB

MD5
f08d9bbc61cff8e8c3504524c3220bef

SHA1
b4268c667469620bb528c04eaa819d508159b398

SHA256
2c4d8b48344ae221e349e525ac16eb364ffb5ab8deae80c7caa28dd5967cabdb

SHA512
a64a03d959487399fb57e1bd062c0e9f88a17ff9b3ad15e6b96a4b7332341d0fc9186ef99b2ab9bdcfa51864f21d08bce48479202c01d15470916e90fb09fef4

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.BMP
Filesize
451KB

MD5
0b445ace8798426e7185f52b7b7b6d1e

SHA1
7a77b46e0848cc9b32283ccb3f91a18c0934c079

SHA256
2bbf97ccba3f87d469eac909c4ce8a3f13ed29c8f31b611e7d5cf89a0619eda6

SHA512
51523d5b711481293305465a3a3c6a3a50dca984cdc8cca1f4c44f3c21bfa430cd9aac1a8782d9605e6954cbafb307beb6b1a52e9785de1bc3f71067d80c6b6e

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG23.PNG
Filesize
1KB

MD5
fa8aa84ef4bf0de505f6e3447d4b55b3

SHA1
b99654dfa5f6c56857b4f4102af2d27503bcdc74

SHA256
f3b7e85e8e5e41496fb563816fbf79e6640feb1591bd5e0c0b876d80053ad913

SHA512
b3a7d0d5abe554301b8745bd738662d80e439fba8df6f984cc05151ec8c081a61f0538765653e8587b431cdc97d384ee35d17ab3324c06a2ca40a069e1525ba6

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNG
Filesize
45KB

MD5
2799f9daca46770a871ce1b5eed32e7c

SHA1
a2792f571210a7f38cdbe49391017300ee7b1ce4

SHA256
fc22676f5b6cdae17b78ddfd16bb070687516fbc827a7edd0541f3a32d85c9e9

SHA512
c41f2e4c4ca59d6f9d11fac11296ab87f1b508b5d64e5db7762f2f6dd387aa96206b2b0fa127f17c0b8c24a0b56e81af12d5937474a450222d9c4416c1acb16a

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG41.PNG
Filesize
457B

MD5
ce17d7ce06488f394ce124f17d5acafc

SHA1
8a5dceae9ea369b686123c8f940bb0ea07870ffa

SHA256
c4b04568930f03979d71f48a57b9ad06b4cdf687272f6753ff662006e8e6237f

SHA512
c33f1370213cabd1b84c936f1ac14f9bcc83bc03a633bbe25efe1e906bcee515d0e615c86b7ee3b34404dd1d95ce74d1a00908de8cdacbf9961de3f1ceb8362b

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG42.PNG
Filesize
352B

MD5
1f5c8939031a7f93762862cfc88a8e56

SHA1
6dc4df87344db0ddf09c777e7a80d1b5661559b8

SHA256
14be26e969eb15ef7e76e0ad02d8aa0516c5391e8b09dba0a9a6c5f57ae24aba

SHA512
de45d700c86329c704777917863fd1ddeca90d2bed67a72794164882bf15725ce83c7733f664ee0a2af7df54a6be2def729d19237fb2c434115396ac126ff47f

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG46.PNG
Filesize
206B

MD5
d8a095202e08fa1ac2578982e9a486db

SHA1
397ffc8af43ac18466b8df245b4faa6b278659e6

SHA256
28fed2b9a3cbde34da4b6b5d1af2d2844437d21f6dec85b3ca2faa5cd3b512e5

SHA512
ac751386a0004e335f4e5f4ea24bf6a474478c8a7ca54d018734e7cd44b8e9a0eb262b00fe1219b1c62c96b018b08ba6b1056d3a13e64b55c7e70d748a6ae9c6

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG48.PNG
Filesize
1KB

MD5
59d6f22fdc11d6b116b38193ed5f4b97

SHA1
cddc7eb2110b3179dd6d1e32b4b37f3568a22ebf

SHA256
782cafea76d24d76885d88ee1302e5f78d75a4e335529dc20ad476fdb9e34744

SHA512
5b0fab5139736d30a69c98ea88d95a5c70f59aab1b82394c58b33617b824447b861a6e6067b62dd1ca1812a4989937e06ad473c6c94376af957871e9e63553fa

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG5.PNG
Filesize
1KB

MD5
3094925a8de871bcc72ae50882d2a6f7

SHA1
9f7894bc4b2a498ad20b14b2b3cac175bf4d7a9f

SHA256
523e7230db0c47a436abbc442db93e41b6f549b32da6c2a10db7a18228491216

SHA512
bf2349354321397652d834507aae4c32885273209d1409b796170292e37ebf35878e2934d3f53545e66724561e646cc660f952e0bb5006cd7a262a790b64e39e

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG66.PNG
Filesize
41KB

MD5
1557c08e187b7783083e0b80051fd321

SHA1
2c6ee47799d713e88fd589609b81912a4522044e

SHA256
0c0e74dd07c45833a5dd7ba931e5d528eb16334defdd06171df2f632d6e47842

SHA512
485f69b3878b2bd7fdf52ad020dde2cbc34dd1970aaa4e5eb8f8618f6091b5b827b428447859499c3d61ea9cde2edcbb97c8fb0560cd0aaff50027c0f97ee6f3

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG67.PNG
Filesize
1KB

MD5
5eecdc666e6dc0b8e5e8d2fc3b9cc1b2

SHA1
72a16d461bd2410d5749c6bf939a127683d83a95

SHA256
052f0289886f9cc0931d7026dfe1f5253ad39123479627e37afa5c430e8f8ff1

SHA512
5d465d2c61d97ec2a52db3aeee8d42ececdef08930692842f9c6a41b0611cb774015d369e4fe5186079e97839acc78e8403ea6a6c33ee54a7aef3eea41c3d7db

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
Filesize
33KB

MD5
6ca2f96b60695b62d852032d9ea42d1c

SHA1
60bda4ddf6040fa9538c0d4664287a67b3ac5754

SHA256
edd21708f99beeb71b91a80e4e27a418f05541144bd903b594b1942c7767c9d4

SHA512
61cdb49222af3047b4f3aa7f2097cc05e3165f97ef5a5376975834bc26876869330e61232f308a2d996497536f847ff29c8fbdccf157837b33d2f769075ee4b9

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
Filesize
6KB

MD5
4f7be9736242579cb8afa1af86980dfe

SHA1
1c486393847996db4f6b78532dd7bd9a0a924549

SHA256
9cecc28716f392d2394829f4cc3f307d08f5aecaf3e2124bdaaa0d6d9c3400b4

SHA512
4c55bc2698d8934713e791c015480248198e22efa66dd5ca79ea834b9835c9e85ca8c2869c9b40dc394ae7e27da039f79c392f88472dedc1adfa83dd1e94f1c9

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Filesize
40B

MD5
d99ecded61c4187d08d36ce7ae67d1a1

SHA1
1f523a1f2deb3881a941ea8890198d8206949790

SHA256
e9b416a96fa3abd1c1478a1b66c69f8af2a11ace9956d98f207c30ac35240af0

SHA512
7986bb31c1148426ea8585acde970f436b3aa7b79c9f49dc909d3b98344a6ea4b217ad43af7b8e63b4c712eb9b5085313063b85d38661ae0113e551034243725

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Filesize
40B

MD5
d99ecded61c4187d08d36ce7ae67d1a1

SHA1
1f523a1f2deb3881a941ea8890198d8206949790

SHA256
e9b416a96fa3abd1c1478a1b66c69f8af2a11ace9956d98f207c30ac35240af0

SHA512
7986bb31c1148426ea8585acde970f436b3aa7b79c9f49dc909d3b98344a6ea4b217ad43af7b8e63b4c712eb9b5085313063b85d38661ae0113e551034243725

Download Submit
C:\Windows\Installer\MSI199E.tmp
Filesize
235KB

MD5
16cae7c3dce97c9ab1c1519383109141

SHA1
10e29384e2df609caea7a3ce9f63724b1c248479

SHA256
8acd0117c92da6b67baf5c1ae8a81adf47e5db4c2f58d3e197850a81a555d2c2

SHA512
5b8b803ddabbb46a8ae5f012f3b5adbbd8eb7d7edbd324095011e385e1e94b2c5e20a28f6c0b8dd89b8789106c02d41916e70e090fbc63edd845d75c6f210e69

Download Submit
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
7d653e77212215fe139494d902f7c06c

SHA1
29c9635ab753cdabfc1af3920b08b1f521bc1373

SHA256
90d0e16d466d5948547d5392182037baa3baf97e6b1dc3351456d45efd7257c1

SHA512
06a610a0eb68df9356d32d7f066c3ed75c33ed13addadc85d1cef1ae966412cb2a93ac808d85fd574afba5cd403f271a3cc58276208c9fa02ead500a5676e9d3

Download Submit
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303212328061\assistant\_sfx.exe
Filesize
1.7MB

MD5
b386cdcb413405daa8219af8e4cbd318

SHA1
ce275ff8514fef0629c915a6ee7b5ac481b9043d

SHA256
408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e

SHA512
91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

Download Submit
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303212328061\assistant\assistant_installer.exe
Filesize
2.1MB

MD5
2f3d9e21e232b9bfea064d3b2264db06

SHA1
bafddc657d8d1bb531683b29b0342cc065ee51d2

SHA256
25528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d

SHA512
94e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5

Download Submit
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303212328061\assistant\assistant_installer.exe
Filesize
2.1MB

MD5
2f3d9e21e232b9bfea064d3b2264db06

SHA1
bafddc657d8d1bb531683b29b0342cc065ee51d2

SHA256
25528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d

SHA512
94e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5

Download Submit
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303212328061\opera_package
Filesize
86.9MB

MD5
6b7771354e081eb94cdbf7627799da4f

SHA1
199341a750443cc6e9b2b2fa1e657d0dd327711f

SHA256
494d1247e61eebf703a6eb19c14bde88edd2f85515fefa4f0465f43873e69aab

SHA512
33e781a102ba3f5c3b1895540bc9c43b78bf4f19af4b91ae0c765594f39d6569d1bad207b33f808426d8ebdcb00c419b7bb76bb050bae0bb843f96dd84355800

Download Submit
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303212328061\opera_package
Filesize
86.9MB

MD5
6b7771354e081eb94cdbf7627799da4f

SHA1
199341a750443cc6e9b2b2fa1e657d0dd327711f

SHA256
494d1247e61eebf703a6eb19c14bde88edd2f85515fefa4f0465f43873e69aab

SHA512
33e781a102ba3f5c3b1895540bc9c43b78bf4f19af4b91ae0c765594f39d6569d1bad207b33f808426d8ebdcb00c419b7bb76bb050bae0bb843f96dd84355800

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
Filesize
1.8MB

MD5
52e46b1adf9cd40428b41755df527bd4

SHA1
5f0bb9c9c14208851beb5c93d9268c16ab39dc07

SHA256
a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

SHA512
813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
Filesize
1.8MB

MD5
52e46b1adf9cd40428b41755df527bd4

SHA1
5f0bb9c9c14208851beb5c93d9268c16ab39dc07

SHA256
a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

SHA512
813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
Filesize
1.8MB

MD5
52e46b1adf9cd40428b41755df527bd4

SHA1
5f0bb9c9c14208851beb5c93d9268c16ab39dc07

SHA256
a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

SHA512
813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
Filesize
1.8MB

MD5
52e46b1adf9cd40428b41755df527bd4

SHA1
5f0bb9c9c14208851beb5c93d9268c16ab39dc07

SHA256
a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

SHA512
813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
Filesize
1.8MB

MD5
52e46b1adf9cd40428b41755df527bd4

SHA1
5f0bb9c9c14208851beb5c93d9268c16ab39dc07

SHA256
a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

SHA512
813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
Filesize
1.8MB

MD5
52e46b1adf9cd40428b41755df527bd4

SHA1
5f0bb9c9c14208851beb5c93d9268c16ab39dc07

SHA256
a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

SHA512
813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_2303212328051061608.dll
Filesize
4.6MB

MD5
927a01657c6bee50ca093ffcfdc9134a

SHA1
f7e484a777affe3c6227a2be0a6560111e1be8f9

SHA256
b1012ab0e2e6a363372a14b480b4c8275c013e66c94adfb8857e523899350cc9

SHA512
718c25b4e95948b728fe7eda6c5953bc0246dc5730ba99a71c3963ebcffda58b1759bf2554fca297d1590d8768d50e0fd9c39bdf790f4d372bc4aa255bfb5db7

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_2303212328055111672.dll
Filesize
4.6MB

MD5
927a01657c6bee50ca093ffcfdc9134a

SHA1
f7e484a777affe3c6227a2be0a6560111e1be8f9

SHA256
b1012ab0e2e6a363372a14b480b4c8275c013e66c94adfb8857e523899350cc9

SHA512
718c25b4e95948b728fe7eda6c5953bc0246dc5730ba99a71c3963ebcffda58b1759bf2554fca297d1590d8768d50e0fd9c39bdf790f4d372bc4aa255bfb5db7

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_2303212328059331960.dll
Filesize
4.6MB

MD5
927a01657c6bee50ca093ffcfdc9134a

SHA1
f7e484a777affe3c6227a2be0a6560111e1be8f9

SHA256
b1012ab0e2e6a363372a14b480b4c8275c013e66c94adfb8857e523899350cc9

SHA512
718c25b4e95948b728fe7eda6c5953bc0246dc5730ba99a71c3963ebcffda58b1759bf2554fca297d1590d8768d50e0fd9c39bdf790f4d372bc4aa255bfb5db7

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_2303212328062911612.dll
Filesize
4.6MB

MD5
927a01657c6bee50ca093ffcfdc9134a

SHA1
f7e484a777affe3c6227a2be0a6560111e1be8f9

SHA256
b1012ab0e2e6a363372a14b480b4c8275c013e66c94adfb8857e523899350cc9

SHA512
718c25b4e95948b728fe7eda6c5953bc0246dc5730ba99a71c3963ebcffda58b1759bf2554fca297d1590d8768d50e0fd9c39bdf790f4d372bc4aa255bfb5db7

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_2303212328064321556.dll
Filesize
4.6MB

MD5
927a01657c6bee50ca093ffcfdc9134a

SHA1
f7e484a777affe3c6227a2be0a6560111e1be8f9

SHA256
b1012ab0e2e6a363372a14b480b4c8275c013e66c94adfb8857e523899350cc9

SHA512
718c25b4e95948b728fe7eda6c5953bc0246dc5730ba99a71c3963ebcffda58b1759bf2554fca297d1590d8768d50e0fd9c39bdf790f4d372bc4aa255bfb5db7

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
Filesize
1.7MB

MD5
1bbf5dd0b6ca80e4c7c77495c3f33083

SHA1
e0520037e60eb641ec04d1e814394c9da0a6a862

SHA256
bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

SHA512
97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
Filesize
97KB

MD5
da1d0cd400e0b6ad6415fd4d90f69666

SHA1
de9083d2902906cacf57259cf581b1466400b799

SHA256
7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

SHA512
f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Filesize
1.3MB

MD5
111dddf2f308abc2a8f7555d5f642751

SHA1
11e6cdccbf29a71a97011b9444cf20c83ad8b57b

SHA256
c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

SHA512
11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Filesize
1.3MB

MD5
111dddf2f308abc2a8f7555d5f642751

SHA1
11e6cdccbf29a71a97011b9444cf20c83ad8b57b

SHA256
c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

SHA512
11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Filesize
1.3MB

MD5
111dddf2f308abc2a8f7555d5f642751

SHA1
11e6cdccbf29a71a97011b9444cf20c83ad8b57b

SHA256
c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

SHA512
11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Filesize
1.3MB

MD5
111dddf2f308abc2a8f7555d5f642751

SHA1
11e6cdccbf29a71a97011b9444cf20c83ad8b57b

SHA256
c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

SHA512
11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Filesize
1.3MB

MD5
111dddf2f308abc2a8f7555d5f642751

SHA1
11e6cdccbf29a71a97011b9444cf20c83ad8b57b

SHA256
c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

SHA512
11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
Filesize
1.3MB

MD5
5027f3112ac2d6f764769102a9145c8e

SHA1
a369a0e1d4ace1a8d66908aa43543bea03c76f5b

SHA256
d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

SHA512
181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
Filesize
1.3MB

MD5
5027f3112ac2d6f764769102a9145c8e

SHA1
a369a0e1d4ace1a8d66908aa43543bea03c76f5b

SHA256
d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

SHA512
181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
Filesize
1.3MB

MD5
5027f3112ac2d6f764769102a9145c8e

SHA1
a369a0e1d4ace1a8d66908aa43543bea03c76f5b

SHA256
d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

SHA512
181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
Filesize
1.3MB

MD5
5027f3112ac2d6f764769102a9145c8e

SHA1
a369a0e1d4ace1a8d66908aa43543bea03c76f5b

SHA256
d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

SHA512
181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
Filesize
1.3MB

MD5
5027f3112ac2d6f764769102a9145c8e

SHA1
a369a0e1d4ace1a8d66908aa43543bea03c76f5b

SHA256
d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

SHA512
181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
7d653e77212215fe139494d902f7c06c

SHA1
29c9635ab753cdabfc1af3920b08b1f521bc1373

SHA256
90d0e16d466d5948547d5392182037baa3baf97e6b1dc3351456d45efd7257c1

SHA512
06a610a0eb68df9356d32d7f066c3ed75c33ed13addadc85d1cef1ae966412cb2a93ac808d85fd574afba5cd403f271a3cc58276208c9fa02ead500a5676e9d3

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
7d653e77212215fe139494d902f7c06c

SHA1
29c9635ab753cdabfc1af3920b08b1f521bc1373

SHA256
90d0e16d466d5948547d5392182037baa3baf97e6b1dc3351456d45efd7257c1

SHA512
06a610a0eb68df9356d32d7f066c3ed75c33ed13addadc85d1cef1ae966412cb2a93ac808d85fd574afba5cd403f271a3cc58276208c9fa02ead500a5676e9d3

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
7d653e77212215fe139494d902f7c06c

SHA1
29c9635ab753cdabfc1af3920b08b1f521bc1373

SHA256
90d0e16d466d5948547d5392182037baa3baf97e6b1dc3351456d45efd7257c1

SHA512
06a610a0eb68df9356d32d7f066c3ed75c33ed13addadc85d1cef1ae966412cb2a93ac808d85fd574afba5cd403f271a3cc58276208c9fa02ead500a5676e9d3

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
7d653e77212215fe139494d902f7c06c

SHA1
29c9635ab753cdabfc1af3920b08b1f521bc1373

SHA256
90d0e16d466d5948547d5392182037baa3baf97e6b1dc3351456d45efd7257c1

SHA512
06a610a0eb68df9356d32d7f066c3ed75c33ed13addadc85d1cef1ae966412cb2a93ac808d85fd574afba5cd403f271a3cc58276208c9fa02ead500a5676e9d3

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
7d653e77212215fe139494d902f7c06c

SHA1
29c9635ab753cdabfc1af3920b08b1f521bc1373

SHA256
90d0e16d466d5948547d5392182037baa3baf97e6b1dc3351456d45efd7257c1

SHA512
06a610a0eb68df9356d32d7f066c3ed75c33ed13addadc85d1cef1ae966412cb2a93ac808d85fd574afba5cd403f271a3cc58276208c9fa02ead500a5676e9d3

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
7d653e77212215fe139494d902f7c06c

SHA1
29c9635ab753cdabfc1af3920b08b1f521bc1373

SHA256
90d0e16d466d5948547d5392182037baa3baf97e6b1dc3351456d45efd7257c1

SHA512
06a610a0eb68df9356d32d7f066c3ed75c33ed13addadc85d1cef1ae966412cb2a93ac808d85fd574afba5cd403f271a3cc58276208c9fa02ead500a5676e9d3

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
7d653e77212215fe139494d902f7c06c

SHA1
29c9635ab753cdabfc1af3920b08b1f521bc1373

SHA256
90d0e16d466d5948547d5392182037baa3baf97e6b1dc3351456d45efd7257c1

SHA512
06a610a0eb68df9356d32d7f066c3ed75c33ed13addadc85d1cef1ae966412cb2a93ac808d85fd574afba5cd403f271a3cc58276208c9fa02ead500a5676e9d3

Download Submit
memory/776-419-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/776-418-0x00000000008D0000-0x0000000000CB8000-memory.dmp

Filesize
3.9MB

Download
memory/776-366-0x0000000002310000-0x0000000002313000-memory.dmp

Filesize
12KB

Download
memory/776-599-0x00000000008D0000-0x0000000000CB8000-memory.dmp

Filesize
3.9MB

Download
memory/776-1676-0x00000000008D0000-0x0000000000CB8000-memory.dmp

Filesize
3.9MB

Download
memory/776-564-0x00000000008D0000-0x0000000000CB8000-memory.dmp

Filesize
3.9MB

Download
memory/776-365-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/776-1540-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/776-1532-0x00000000008D0000-0x0000000000CB8000-memory.dmp

Filesize
3.9MB

Download
memory/776-1659-0x00000000008D0000-0x0000000000CB8000-memory.dmp

Filesize
3.9MB

Download
memory/776-73-0x00000000008D0000-0x0000000000CB8000-memory.dmp

Filesize
3.9MB

Download
memory/776-367-0x00000000008D0000-0x0000000000CB8000-memory.dmp

Filesize
3.9MB

Download
memory/776-441-0x0000000003780000-0x0000000003790000-memory.dmp

Filesize
64KB

Download
memory/776-368-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/776-383-0x00000000008D0000-0x0000000000CB8000-memory.dmp

Filesize
3.9MB

Download
memory/776-1644-0x00000000008D0000-0x0000000000CB8000-memory.dmp

Filesize
3.9MB

Download
memory/776-389-0x00000000008D0000-0x0000000000CB8000-memory.dmp

Filesize
3.9MB

Download
memory/776-384-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/924-72-0x0000000002CE0000-0x00000000030C8000-memory.dmp

Filesize
3.9MB

Download
memory/924-70-0x0000000002CE0000-0x00000000030C8000-memory.dmp

Filesize
3.9MB

Download
memory/1104-482-0x0000000002E50000-0x0000000003238000-memory.dmp

Filesize
3.9MB

Download
memory/1104-481-0x0000000002E50000-0x0000000003238000-memory.dmp

Filesize
3.9MB

Download
memory/1104-483-0x0000000002E50000-0x0000000003238000-memory.dmp

Filesize
3.9MB

Download
memory/1556-555-0x0000000001310000-0x0000000001855000-memory.dmp

Filesize
5.3MB

Download
memory/1608-552-0x0000000003F40000-0x0000000004485000-memory.dmp

Filesize
5.3MB

Download
memory/1608-1572-0x0000000003F40000-0x0000000004485000-memory.dmp

Filesize
5.3MB

Download
memory/1608-551-0x00000000039D0000-0x0000000003F15000-memory.dmp

Filesize
5.3MB

Download
memory/1608-548-0x0000000001310000-0x0000000001855000-memory.dmp

Filesize
5.3MB

Download
memory/1608-549-0x0000000002C60000-0x00000000031A5000-memory.dmp

Filesize
5.3MB

Download
memory/1612-554-0x0000000002C60000-0x00000000031A5000-memory.dmp

Filesize
5.3MB

Download
memory/1612-553-0x0000000001310000-0x0000000001855000-memory.dmp

Filesize
5.3MB

Download
memory/1672-550-0x0000000001310000-0x0000000001855000-memory.dmp

Filesize
5.3MB

Download
memory/1716-1664-0x00000000003E0000-0x00000000007C8000-memory.dmp

Filesize
3.9MB

Download
memory/1716-547-0x00000000056D0000-0x0000000005C15000-memory.dmp

Filesize
5.3MB

Download
memory/1716-546-0x00000000056D0000-0x0000000005C15000-memory.dmp

Filesize
5.3MB

Download
memory/1716-545-0x00000000056D0000-0x0000000005C15000-memory.dmp

Filesize
5.3MB

Download
memory/1716-542-0x00000000056D0000-0x0000000005C15000-memory.dmp

Filesize
5.3MB

Download
memory/1716-578-0x00000000003E0000-0x00000000007C8000-memory.dmp

Filesize
3.9MB

Download
memory/1716-1030-0x0000000002970000-0x0000000002980000-memory.dmp

Filesize
64KB

Download
memory/1716-484-0x00000000003E0000-0x00000000007C8000-memory.dmp

Filesize
3.9MB

Download
memory/1716-500-0x0000000002970000-0x0000000002980000-memory.dmp

Filesize
64KB

Download
memory/1960-533-0x0000000000EE0000-0x0000000001425000-memory.dmp

Filesize
5.3MB

Download
memory/2492-1850-0x000007FFFFF80000-0x000007FFFFF90000-memory.dmp

Filesize
64KB

Download