Analysis

  • max time kernel
    206s
  • max time network
    199s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    25-03-2023 00:45

General

  • Target

    TLauncher-2.876-Installer-1.0.7-global.exe

  • Size

    22.6MB

  • MD5

    e89a95bce6075955a4e1acdb6bb56561

  • SHA1

    8b17013cbf2ea69d625d7bcb1e578933c13678fc

  • SHA256

    78d84068b47cf28b76c88ba4474c7c187510f4e4e967d079d3761dcab7851655

  • SHA512

    4ccb33f60c9292e12daa53b49524a36bbe1c1ca86d794b5134b8b954736a532e9f202123b39036c6a9c557e128bd8361e5c1cb86d40723cc00784026741d5e65

  • SSDEEP

    393216:DXkoYB+UAVl/Pfs/dQETVlOBbpFEjdGphRqV56HpkvQFa2Vj4h2cU:D0oYB+3fHHExi73qqHpU2Vj4hE

Malware Config

Signatures

  • BazarBackdoor

    Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

  • Bazar/Team9 Backdoor payload 7 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 23 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Registers COM server for autorun 1 TTPs 64 IoCs
  • UPX packed file 51 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 26 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 6 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 7 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1608
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe" "__IRCT:3" "__IRTSS:23645635" "__IRSID:S-1-5-21-3499517378-2376672570-1134980332-1000"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1524
      • C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
        "C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1172
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816338 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:1840798" "__IRSID:S-1-5-21-3499517378-2376672570-1134980332-1000"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies system certificate store
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1360
          • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
            "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Enumerates connected drives
            • Modifies system certificate store
            • Suspicious use of WriteProcessMemory
            PID:2564
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303250146261\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303250146261\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe"
              6⤵
              • Executes dropped EXE
              PID:908
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303250146261\assistant\assistant_installer.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303250146261\assistant\assistant_installer.exe" --version
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:2472
              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303250146261\assistant\assistant_installer.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303250146261\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=96.0.4693.50 --initial-client-data=0x148,0x14c,0x150,0x11c,0x154,0x236c28,0x236c38,0x236c44
                7⤵
                • Executes dropped EXE
                PID:2544
      • C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
        "C:\Users\Admin\AppData\Local\Temp\jre-windows.exe" STATIC=1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1708
        • C:\Users\Admin\AppData\Local\Temp\jds7140680.tmp\jre-windows.exe
          "C:\Users\Admin\AppData\Local\Temp\jds7140680.tmp\jre-windows.exe" "STATIC=1"
          4⤵
          • Executes dropped EXE
          • Modifies Internet Explorer settings
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:580
  • C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\ResolveLimit.cfg
    1⤵
      PID:1012
    • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
      C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=97.0.4719.28 --initial-client-data=0x1a4,0x1a8,0x1ac,0x178,0x1b0,0x70e733e0,0x70e733f0,0x70e733fc
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2928
    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe" --version
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2180
    • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
      "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=2564 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20230325014626" --session-guid=d9f2c92e-9733-4be0-bac3-3b3b6ee1cc07 --server-tracking-blob=MTU1NTYxZTVkNjkzNTQ1NTVkOGI0MGFkMTU2YTVkZDc1MzdkYTBkNWZhNjQ3ZThlMWQxNmUwMzkzZDc2N2I4Nzp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjciLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNjc5NzA1MTgyLjc3ODEiLCJ1c2VyYWdlbnQiOiJTZXR1cCBGYWN0b3J5IDkuMCIsInV0bSI6eyJjYW1wYWlnbiI6Ik9wZXJhRGVza3RvcCIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Ik1TVEwifSwidXVpZCI6IjI3MTczNGMxLTg1ZWUtNDQ1My04MDUzLTFkZDliYjUyMGNkMSJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=0803000000000000
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • Suspicious use of WriteProcessMemory
      PID:2272
      • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
        C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=97.0.4719.28 --initial-client-data=0x1b0,0x1b4,0x1b8,0x178,0x1bc,0x703f33e0,0x703f33f0,0x703f33fc
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2384
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Enumerates connected drives
      • Drops file in Windows directory
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:2736
      • C:\Windows\system32\MsiExec.exe
        C:\Windows\system32\MsiExec.exe -Embedding 86DBA4DA32524EE9CEF4968E5EA43C59
        2⤵
        • Loads dropped DLL
        PID:1856
      • C:\Program Files\Java\jre1.8.0_351\installer.exe
        "C:\Program Files\Java\jre1.8.0_351\installer.exe" /s INSTALLDIR="C:\Program Files\Java\jre1.8.0_351\\" STATIC=1 INSTALL_SILENT=1 REPAIRMODE=0 ProductCode={26A24AE4-039D-4CA4-87B4-2F64180351F0}
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Registers COM server for autorun
        • Installs/modifies Browser Helper Object
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Modifies Internet Explorer settings
        • Modifies data under HKEY_USERS
        • Modifies registry class
        PID:1480
        • C:\ProgramData\Oracle\Java\installcache_x64\7183783.tmp\bspatch.exe
          "bspatch.exe" baseimagefam8 newimage diff
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1336
        • C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
          "C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/plugin.pack" "C:\Program Files\Java\jre1.8.0_351\lib/plugin.jar"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2400
        • C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
          "C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/javaws.pack" "C:\Program Files\Java\jre1.8.0_351\lib/javaws.jar"
          3⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          PID:920
        • C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
          "C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/deploy.pack" "C:\Program Files\Java\jre1.8.0_351\lib/deploy.jar"
          3⤵
          • Executes dropped EXE
          PID:2084
        • C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
          "C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/rt.pack" "C:\Program Files\Java\jre1.8.0_351\lib/rt.jar"
          3⤵
          • Executes dropped EXE
          PID:2160
        • C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
          "C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/jsse.pack" "C:\Program Files\Java\jre1.8.0_351\lib/jsse.jar"
          3⤵
          • Executes dropped EXE
          PID:2000
        • C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
          "C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/charsets.pack" "C:\Program Files\Java\jre1.8.0_351\lib/charsets.jar"
          3⤵
          • Executes dropped EXE
          PID:2608
        • C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
          "C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/ext/localedata.pack" "C:\Program Files\Java\jre1.8.0_351\lib/ext/localedata.jar"
          3⤵
          • Executes dropped EXE
          PID:1776
        • C:\Program Files\Java\jre1.8.0_351\bin\javaw.exe
          "C:\Program Files\Java\jre1.8.0_351\bin\javaw.exe" -Xshare:dump -Djdk.disableLastUsageTracking
          3⤵
          • Executes dropped EXE
          PID:2516
        • C:\Program Files\Java\jre1.8.0_351\bin\ssvagent.exe
          "C:\Program Files\Java\jre1.8.0_351\bin\ssvagent.exe" -doHKCUSSVSetup
          3⤵
            PID:2824
          • C:\Program Files\Java\jre1.8.0_351\bin\javaws.exe
            "C:\Program Files\Java\jre1.8.0_351\bin\javaws.exe" -wait -fix -permissions -silent
            3⤵
              PID:2240
              • C:\Program Files\Java\jre1.8.0_351\bin\jp2launcher.exe
                "C:\Program Files\Java\jre1.8.0_351\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre1.8.0_351" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzM1MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF8zNTFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzM1MVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==
                4⤵
                  PID:2504
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe"
            1⤵
              PID:592

            Network

            MITRE ATT&CK Matrix ATT&CK v6

            Persistence

            Registry Run Keys / Startup Folder

            1
            T1060

            Browser Extensions

            1
            T1176

            Defense Evasion

            Modify Registry

            3
            T1112

            Install Root Certificate

            1
            T1130

            Credential Access

            Credentials in Files

            1
            T1081

            Discovery

            Query Registry

            3
            T1012

            Peripheral Device Discovery

            1
            T1120

            System Information Discovery

            3
            T1082

            Collection

            Data from Local System

            1
            T1005

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files\Java\jre1.8.0_351\bin\dtplugin\npdeployJava1.dll
              Filesize

              1.8MB

              MD5

              ff91ac355dc6b1df63795886125bccf8

              SHA1

              90979fc6ea3a89031598d2146bf5cdbbb6db6b77

              SHA256

              14b30467cfea0071dffc658dd31b8a25b7b4e79608933f171911c2cba6aa9a0a

              SHA512

              77aa8c7930730004bdb8d49a82712e1042db978102f6eca0d38317b6fd98ef03e52279130eadc7a0da1148e759db6589f7f8334d4c2eccfb2613e8f19542e197

            • C:\Program Files\Java\jre1.8.0_351\bin\javacpl.exe
              Filesize

              103KB

              MD5

              7a9d69862a2021508931a197cd6501ec

              SHA1

              a0f7d313a874552f4972784d15042b564e4067fc

              SHA256

              51ff63cbac78bd133333e98d91b02b652c88cd57cedd0052519051a17be77856

              SHA512

              5c331e6deefc8256ea203d63770484f6b485d4c3832a60ecf4a540dff3cb75a76dbde37980fe1763ca487401b68126f58f8d1a4c72ee610f5144c624c4736850

            • C:\Program Files\Java\jre1.8.0_351\bin\javaws.exe
              Filesize

              446KB

              MD5

              24ccb37646e1f52ce4f47164cccf2b91

              SHA1

              bc265e26417026286d6ed951904305086c4f693c

              SHA256

              adf2d659c2b2a4afff1ca58f3a742d27d767d27eabeca6a8b6ee243e9c913a39

              SHA512

              cb174e7a219f6ffae3715e37beb428979bc1462202729c05a25fa7b8da90e2dd6faa92c03cd9ca21567d354dce7acc1852669f4071298e953d6a286243794e32

            • C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
              Filesize

              216KB

              MD5

              691f68efcd902bfdfb60b556a3e11c2c

              SHA1

              c279fa09293185bddfd73d1170b6a73bd266cf07

              SHA256

              471d70ebf91bdc762dcacbea9f6ca883f97921938e83269fef911dbf83598a70

              SHA512

              a4816ae0654f41bd130d56e44839d9f29ab48bd2f99c3d6db38ce3358ac46c1cef09da09184c6291dd378018a49f9e56173c35d780d3eaefcce459592c75de3f

            • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit\Reference Documentation.lnk
              Filesize

              197B

              MD5

              b5e1de7d05841796c6d96dfe5b8b338c

              SHA1

              c7c64e5b35d0cca1a5c98a1c68e1e5d4c8b72547

              SHA256

              062cb9dec2b2ce02c633fc442d1a23e910e602548a54a54c8310b0dde9ae074d

              SHA512

              963a89b04f34bc00fea5b8e0f9648596c428beac2db30d8b0932974b15c0eb90b7c801ba6fa1082ea9d133258f393ae27e61f27fd3b3951f5c2e4b8c6a212c2d

            • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Get Help.url
              Filesize

              182B

              MD5

              7fadb9e200dbbd992058cefa41212796

              SHA1

              e2525d7ba66bb07bc1cd5ba93f88c54e7e2042b4

              SHA256

              b05abacd15117b1ffcd2a288308f50c0542214d264b852eddfa9025307ac401b

              SHA512

              94b7bf1f1f5cea2a74f8c326113dd25652cb14e5fa356ac83d16b6ac5a5cac26c9d2b20259f5c2cf8ebc1e022490511e2996335a5d8dd7f5b64dce429fb6dfb1

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
              Filesize

              61KB

              MD5

              e71c8443ae0bc2e282c73faead0a6dd3

              SHA1

              0c110c1b01e68edfacaeae64781a37b1995fa94b

              SHA256

              95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

              SHA512

              b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
              Filesize

              471B

              MD5

              5c044e7f16be700237ae9f9f494101a0

              SHA1

              1b231580420248ead9b6509da69ba88bb5f2ebc7

              SHA256

              c0b3879685518cb2b27d03978ce91a31741cb57c473354b69084842133420d6f

              SHA512

              7d396a6d99b4641082836f80dcdfe7c5c68799e3a1f58cd1daa13e4656654e5c5ca69a53373f7d4edd75cafd3f33affb314ab2afac0517ad76ef5e05e4ae953d

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
              Filesize

              471B

              MD5

              576e795a10963a8a2ca1969f5e47faff

              SHA1

              a6cf145b7bce368bfe2f79c5ab585226d758b2ac

              SHA256

              e13bec4f37c0d3aaee6d488fffd4aba0fe2e7122bafeab1988ae437933adcc09

              SHA512

              d70b6f07be8046a953be0603ae20e4171616601bb685304fe04350934837406677862b4a10cf88190fceb84dc7b237b71cef97a1b49bbf084838b18c920b6d77

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
              Filesize

              1KB

              MD5

              a266bb7dcc38a562631361bbf61dd11b

              SHA1

              3b1efd3a66ea28b16697394703a72ca340a05bd5

              SHA256

              df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

              SHA512

              0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              5c2d8ae6d86d2e5bdeefdbc0c9a2c499

              SHA1

              1407c2c779c94ac9fbfcf20495f79505849d597f

              SHA256

              83b0e47bf6797b314907f94ee6f89d430075e3beb95ceba3436d9560ce66d869

              SHA512

              68e8e4e89db2c8650b019a2675e1ae25b8e603d1e62b9c85c99fc8b8f114ff94dff06a5216f4af29a516dc46144365fa3bdf344549b4864582e24bd0aa57341a

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
              Filesize

              400B

              MD5

              b22499518d416719823bc31cd3617c69

              SHA1

              3585a9207b7c8c183bd0da8f4413902acde2b823

              SHA256

              22c9cc6af3657c55faa6a17a9650e45b3a80badb10a1c358d98ce628c942f5e9

              SHA512

              764baa7099a97eff6dde702da264355594d29230663490381420ce19a9c20e2877213db2f9a5d4a026ae116abd4865721cd033dd6bb5738471b7c83412e580ac

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
              Filesize

              404B

              MD5

              4aec4ce372375012e5019f3572ba0075

              SHA1

              340edf08a2ea80e9b9df61f481496ef57a744490

              SHA256

              dee560c83c2bedb3671fa6615f52c39dcd7ad25064dbba2bacedae916e156b31

              SHA512

              f553009f8a5ccbd9620adbed3531754737de3e8f0d450bf591d1a4a3193159d2d1112ac9f4ab06f0e20b673d75766121ed184f14ce3295302ee57c6622e4a833

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
              Filesize

              242B

              MD5

              3f441dc506a042d2222c04a8154d5f0d

              SHA1

              9e937f2df94be9fa40a81b7f64f922c6a564bcc4

              SHA256

              5272b4bba8b695cb2a5f173609adaf737719592663df401a475cedba3fb864c8

              SHA512

              453dbcc0fb037397dd86708e822a92b00c80d1c3ea11925185628a6832dbddd9fc45b15661fe7a78eaba7fcd47bd150d5fd0619c59b85d347b3f0e56ca682cdd

            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
              Filesize

              2.7MB

              MD5

              955c78a8efe1838d1dbb660f7047e606

              SHA1

              fb6756aff4d2e3708dd530520299198572161480

              SHA256

              7bda1ebb13b15b856bde93d3edf31b5679f9ba685a8e70f183550582bac1baba

              SHA512

              2f4d3924b6d0e5405dc63903b0572bac93efaabcc3f54a4045f03ca386b48d8e012ba324dd7743c1d6ddedeec7f7260ab94a37d2cd6c97182ad78193f1d1c1bb

            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303250146261\additional_file0.tmp
              Filesize

              1.7MB

              MD5

              b386cdcb413405daa8219af8e4cbd318

              SHA1

              ce275ff8514fef0629c915a6ee7b5ac481b9043d

              SHA256

              408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e

              SHA512

              91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303250146261\opera_package
              Filesize

              86.9MB

              MD5

              6b7771354e081eb94cdbf7627799da4f

              SHA1

              199341a750443cc6e9b2b2fa1e657d0dd327711f

              SHA256

              494d1247e61eebf703a6eb19c14bde88edd2f85515fefa4f0465f43873e69aab

              SHA512

              33e781a102ba3f5c3b1895540bc9c43b78bf4f19af4b91ae0c765594f39d6569d1bad207b33f808426d8ebdcb00c419b7bb76bb050bae0bb843f96dd84355800

            • C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
              Filesize

              1.8MB

              MD5

              52e46b1adf9cd40428b41755df527bd4

              SHA1

              5f0bb9c9c14208851beb5c93d9268c16ab39dc07

              SHA256

              a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

              SHA512

              813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

            • C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
              Filesize

              1.8MB

              MD5

              52e46b1adf9cd40428b41755df527bd4

              SHA1

              5f0bb9c9c14208851beb5c93d9268c16ab39dc07

              SHA256

              a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

              SHA512

              813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

            • C:\Users\Admin\AppData\Local\Temp\CabBD57.tmp
              Filesize

              61KB

              MD5

              fc4666cbca561e864e7fdf883a9e6661

              SHA1

              2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

              SHA256

              10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

              SHA512

              c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

            • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2303250146250082180.dll
              Filesize

              4.6MB

              MD5

              674e177ac04e98ce48f4df0d4c440568

              SHA1

              b08fa2014573f0af48c06357da323e79399ef144

              SHA256

              8e1ac3c2a3aeb52e26794368c1adf5e7b330aa3bc27ac1669cb3aed64da8fe86

              SHA512

              5d99f5837ec50ca2f46a8e8cfbb055eeedbc28f7e63c49a901984f1c884e2a6d790e91542174dc2808b4ead30a6204912f5f98af1b562210494574eb2328d3e4

            • C:\Users\Admin\AppData\Local\Temp\Tar5F61.tmp
              Filesize

              161KB

              MD5

              be2bec6e8c5653136d3e72fe53c98aa3

              SHA1

              a8182d6db17c14671c3d5766c72e58d87c0810de

              SHA256

              1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

              SHA512

              0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

            • C:\Users\Admin\AppData\Local\Temp\TarBD79.tmp
              Filesize

              161KB

              MD5

              73b4b714b42fc9a6aaefd0ae59adb009

              SHA1

              efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

              SHA256

              c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

              SHA512

              73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico
              Filesize

              116KB

              MD5

              e043a9cb014d641a56f50f9d9ac9a1b9

              SHA1

              61dc6aed3d0d1f3b8afe3d161410848c565247ed

              SHA256

              9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946

              SHA512

              4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe
              Filesize

              1.8MB

              MD5

              52e46b1adf9cd40428b41755df527bd4

              SHA1

              5f0bb9c9c14208851beb5c93d9268c16ab39dc07

              SHA256

              a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

              SHA512

              813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.PNG
              Filesize

              339B

              MD5

              bbdf2e8c0262e7e606d41ddbe5a3cd12

              SHA1

              acbb25f729af14b692ec9c8187a23b1a696f8e47

              SHA256

              d7c76896d206d977739556ad2d5811f7cf3117252afcd439a5aa0f2b645f6949

              SHA512

              0334fae3682889adbc18594b7917d8c93252a86bc04d08efc6860d5714ba4eb8aabc39c51e532c4aee57a938021540d2f2899781d9cd1de311036e1850a65067

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG104.PNG
              Filesize

              644B

              MD5

              38c12e1a54f8fd216ed3f13b36798cc6

              SHA1

              ccf1fe585d3374ebce4c1ec025e2d8ec39968a7c

              SHA256

              608924ba294590b5b706658d9aaa71b480ad9aa1b6797bbc5cf1632ac6c616b1

              SHA512

              0918af63f006d7fa04a3faeeb813e61c060316a126c4742a948a30f5b6ea368c3b8592011319dad3dbf8427dfcc095aa72f7b651d6fc31061f861f070447331b

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG109.PNG
              Filesize

              2KB

              MD5

              03b1d78771eb279766efb2d9f2fa8463

              SHA1

              8f10e304fd65e58136ccd6ab012ffc594e6fb707

              SHA256

              eec16d2cb57e38b485b6a269e9c2554c1dfc3b70dec9f7bbddc2b62526b3d832

              SHA512

              ca51cbaf20e6f62eb6ec69555d259ef61828d3166d09106bcd335dd417ed30660af71e7fd8db6bd22bf134cc530e1a55ecdd2c307e64e8edb28af95299d66f5a

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.PNG
              Filesize

              280B

              MD5

              5a7901f7df307fba45b1c377f2c94ccc

              SHA1

              d6630cf733033cdfbda7af3213d49b32f5b06919

              SHA256

              d8471d5a5b4792c4b49e80b5cb22ef1e938dc3069b210646704f658548d7a9f8

              SHA512

              fc0036a7ed4b53edd72b91c4824919e6e8a82b5be1e82cdc134e267ef4792424124fb6ba5d7c86cf686910da0baba8453d7a6c12b39a5b4c0cb70658580f3bc9

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG22.PNG
              Filesize

              1KB

              MD5

              46a65321aa1fce57d465c26e8b6eb392

              SHA1

              9efb9a3acd5b32556ea66398c74b014f91087559

              SHA256

              61df7a1f0367209668d4f0f6a285b8baff864d1341d382ebbc7fd4e71036b666

              SHA512

              094d69016f066ae835c71d7a950217b9ad09e8cd4d74131787203cae950e572c18213dc1ded139b1fa46c7f803cc15bf4f596c9d51aefe0d43850ae2865f3707

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.PNG
              Filesize

              281B

              MD5

              05d7bba3d6ac92766c4495b8928202a6

              SHA1

              50b65a8ba5ed2633e43929ee4bd58c95a91a3363

              SHA256

              4804f3c4fae714657fdb85e98244828acc6ac938505c2da1ed694ae7b58f2949

              SHA512

              1544d5cd6f85aaeeacd26f2deb9da9eb510226b41079ee78c4dede14386e5ea3446efdfd475bfbfa3a6846fa2ff23d64f4dad3a4ddd304e32de80e4d7bcbc600

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG85.PNG
              Filesize

              43KB

              MD5

              667b0b54ee5ba0d1cb66190226596e46

              SHA1

              b8658b35e7cf44b24053e4d01d3b51233d6526f6

              SHA256

              3a9ab8c3640f1b40b33553d7d3dd3d15bd6e702ef510ec0b66a2f14aa744bf83

              SHA512

              9ccc773214a0074634be66801d81d7a593ab154351fdbd1b93f56ffa80cf824ee31ff2e13f26536d5f3096e90df43fa223080b4dc55340614b076c08ef976dcb

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG86.PNG
              Filesize

              1KB

              MD5

              5bc85d12eb492baa3be9230f1fbdc342

              SHA1

              456fe4284fa916ad3817e7c3d419c13f4c949737

              SHA256

              9a27f240758513aa1cc05500171fe22fdb3a485781cba4798cefc29f6944373c

              SHA512

              3d55c597ac29d7f810980dfd89404d3ecbd2e652ae1bc5e6710668ad5386a0caecf3149289df13f6dabed6b2e4305a26684ab3bd21b255b37f8a596fe8d641b9

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
              Filesize

              1.7MB

              MD5

              1bbf5dd0b6ca80e4c7c77495c3f33083

              SHA1

              e0520037e60eb641ec04d1e814394c9da0a6a862

              SHA256

              bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

              SHA512

              97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
              Filesize

              97KB

              MD5

              da1d0cd400e0b6ad6415fd4d90f69666

              SHA1

              de9083d2902906cacf57259cf581b1466400b799

              SHA256

              7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

              SHA512

              f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
              Filesize

              1.3MB

              MD5

              111dddf2f308abc2a8f7555d5f642751

              SHA1

              11e6cdccbf29a71a97011b9444cf20c83ad8b57b

              SHA256

              c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

              SHA512

              11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
              Filesize

              1.3MB

              MD5

              111dddf2f308abc2a8f7555d5f642751

              SHA1

              11e6cdccbf29a71a97011b9444cf20c83ad8b57b

              SHA256

              c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

              SHA512

              11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
              Filesize

              1.3MB

              MD5

              111dddf2f308abc2a8f7555d5f642751

              SHA1

              11e6cdccbf29a71a97011b9444cf20c83ad8b57b

              SHA256

              c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

              SHA512

              11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
              Filesize

              326KB

              MD5

              80d93d38badecdd2b134fe4699721223

              SHA1

              e829e58091bae93bc64e0c6f9f0bac999cfda23d

              SHA256

              c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

              SHA512

              9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat
              Filesize

              108KB

              MD5

              aec508468d53ab8d55f5b4beb82c347d

              SHA1

              477d1ffb28834243f5811a4a2a54b4f0ca240120

              SHA256

              ebee84e34e221ad822486432333bad9e6357af2fb0d9651cc61c7fab8ec9b5bf

              SHA512

              26a0278af2a9e75ef966bc3f7f40d7669204c2004a043adaad102ef440caa6282e69372ca0c3c7d39a8450691d528c2dc77a4386bfb0c6e5a2a76c3fef900fbe

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
              Filesize

              1.3MB

              MD5

              5027f3112ac2d6f764769102a9145c8e

              SHA1

              a369a0e1d4ace1a8d66908aa43543bea03c76f5b

              SHA256

              d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

              SHA512

              181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
              Filesize

              1.3MB

              MD5

              5027f3112ac2d6f764769102a9145c8e

              SHA1

              a369a0e1d4ace1a8d66908aa43543bea03c76f5b

              SHA256

              d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

              SHA512

              181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
              Filesize

              1.3MB

              MD5

              5027f3112ac2d6f764769102a9145c8e

              SHA1

              a369a0e1d4ace1a8d66908aa43543bea03c76f5b

              SHA256

              d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

              SHA512

              181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
              Filesize

              326KB

              MD5

              80d93d38badecdd2b134fe4699721223

              SHA1

              e829e58091bae93bc64e0c6f9f0bac999cfda23d

              SHA256

              c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

              SHA512

              9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

            • C:\Users\Admin\AppData\Local\Temp\jds7140680.tmp\jre-windows.exe
              Filesize

              84.1MB

              MD5

              dfcfc788d67437530a50177164db42b0

              SHA1

              2d9ed0dc5671a358186dcf83abb74bfe39c40e9f

              SHA256

              a90318bae7d99da633d9cac8ce322120d087e7b6f5eec0d1d0d7f9413fdd4dc1

              SHA512

              dbdfd02528c9f0e506232e8640a8602fade0d05f4139368187300ea2d537e41d2d167655ded30d938bd445a21c776a3c3721f8db4d3f03e3c06807a84cf232e3

            • C:\Users\Admin\AppData\Local\Temp\jds7140680.tmp\jre-windows.exe
              Filesize

              84.1MB

              MD5

              dfcfc788d67437530a50177164db42b0

              SHA1

              2d9ed0dc5671a358186dcf83abb74bfe39c40e9f

              SHA256

              a90318bae7d99da633d9cac8ce322120d087e7b6f5eec0d1d0d7f9413fdd4dc1

              SHA512

              dbdfd02528c9f0e506232e8640a8602fade0d05f4139368187300ea2d537e41d2d167655ded30d938bd445a21c776a3c3721f8db4d3f03e3c06807a84cf232e3

            • C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
              Filesize

              84.5MB

              MD5

              7542ec421a2f6e90751e8b64c22e0542

              SHA1

              d207d221a28ede5c2c8415f82c555989aa7068ba

              SHA256

              188ca8ecc44de1b7f602e883c3054dc392792c3631bf362b1bc4f3e1dba323e6

              SHA512

              8987bf8aa1b401815fa9850e56954db6015bdd06ce78b65ba435724582ffa615dee4e1452fa237c53257dca8ee97b469d01c27757a5f070ce6f807a4f81094bc

            • C:\Users\Admin\AppData\Local\Temp\jusched.log
              Filesize

              3KB

              MD5

              edb1f1df13a2fbe780330d1000b5ce6f

              SHA1

              ca583deee773fbade51e3c3e8c52d28147948b1f

              SHA256

              07576c02d32d08a4bac206b10224d49e3f55dd6777a816ae02120b9062daa841

              SHA512

              d38d8b02a3cfce596280d1da7d2d529a5e398ace1958678dc8ad0a07c7d60d9c5a09bd07a2f05887e39f547a61d6d3217585b5ff95de325b6e551beb7c39eaf3

            • C:\Users\Admin\AppData\Local\Temp\jusched.log
              Filesize

              3KB

              MD5

              edb1f1df13a2fbe780330d1000b5ce6f

              SHA1

              ca583deee773fbade51e3c3e8c52d28147948b1f

              SHA256

              07576c02d32d08a4bac206b10224d49e3f55dd6777a816ae02120b9062daa841

              SHA512

              d38d8b02a3cfce596280d1da7d2d529a5e398ace1958678dc8ad0a07c7d60d9c5a09bd07a2f05887e39f547a61d6d3217585b5ff95de325b6e551beb7c39eaf3

            • C:\Users\Admin\AppData\Local\Temp\jusched.log
              Filesize

              14KB

              MD5

              c0ef65ffece7ce3c74b4707e63250fdd

              SHA1

              2d79e13410ec9d61a2f68d29112e2d782d7009e6

              SHA256

              37a6bb1d05f27dfffcdedca3b7f6cacb79ca0eec5316f6605ed22b8b8b90bd56

              SHA512

              73838c876b80f406d9050903629f4d3e63fbeb88fb30d8af9b41ef9136d240f67720d931af0344e59ddaa60bd0abfd4e098f6985665058e645b0a4c9c56f9ef7

            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              Filesize

              2.7MB

              MD5

              955c78a8efe1838d1dbb660f7047e606

              SHA1

              fb6756aff4d2e3708dd530520299198572161480

              SHA256

              7bda1ebb13b15b856bde93d3edf31b5679f9ba685a8e70f183550582bac1baba

              SHA512

              2f4d3924b6d0e5405dc63903b0572bac93efaabcc3f54a4045f03ca386b48d8e012ba324dd7743c1d6ddedeec7f7260ab94a37d2cd6c97182ad78193f1d1c1bb

            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              Filesize

              2.7MB

              MD5

              955c78a8efe1838d1dbb660f7047e606

              SHA1

              fb6756aff4d2e3708dd530520299198572161480

              SHA256

              7bda1ebb13b15b856bde93d3edf31b5679f9ba685a8e70f183550582bac1baba

              SHA512

              2f4d3924b6d0e5405dc63903b0572bac93efaabcc3f54a4045f03ca386b48d8e012ba324dd7743c1d6ddedeec7f7260ab94a37d2cd6c97182ad78193f1d1c1bb

            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              Filesize

              2.7MB

              MD5

              955c78a8efe1838d1dbb660f7047e606

              SHA1

              fb6756aff4d2e3708dd530520299198572161480

              SHA256

              7bda1ebb13b15b856bde93d3edf31b5679f9ba685a8e70f183550582bac1baba

              SHA512

              2f4d3924b6d0e5405dc63903b0572bac93efaabcc3f54a4045f03ca386b48d8e012ba324dd7743c1d6ddedeec7f7260ab94a37d2cd6c97182ad78193f1d1c1bb

            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              Filesize

              2.7MB

              MD5

              955c78a8efe1838d1dbb660f7047e606

              SHA1

              fb6756aff4d2e3708dd530520299198572161480

              SHA256

              7bda1ebb13b15b856bde93d3edf31b5679f9ba685a8e70f183550582bac1baba

              SHA512

              2f4d3924b6d0e5405dc63903b0572bac93efaabcc3f54a4045f03ca386b48d8e012ba324dd7743c1d6ddedeec7f7260ab94a37d2cd6c97182ad78193f1d1c1bb

            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              Filesize

              2.7MB

              MD5

              955c78a8efe1838d1dbb660f7047e606

              SHA1

              fb6756aff4d2e3708dd530520299198572161480

              SHA256

              7bda1ebb13b15b856bde93d3edf31b5679f9ba685a8e70f183550582bac1baba

              SHA512

              2f4d3924b6d0e5405dc63903b0572bac93efaabcc3f54a4045f03ca386b48d8e012ba324dd7743c1d6ddedeec7f7260ab94a37d2cd6c97182ad78193f1d1c1bb

            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              Filesize

              2.7MB

              MD5

              955c78a8efe1838d1dbb660f7047e606

              SHA1

              fb6756aff4d2e3708dd530520299198572161480

              SHA256

              7bda1ebb13b15b856bde93d3edf31b5679f9ba685a8e70f183550582bac1baba

              SHA512

              2f4d3924b6d0e5405dc63903b0572bac93efaabcc3f54a4045f03ca386b48d8e012ba324dd7743c1d6ddedeec7f7260ab94a37d2cd6c97182ad78193f1d1c1bb

            • C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
              Filesize

              602B

              MD5

              d6d5bb1de8ae390bcb9a4aef3d909820

              SHA1

              ef90950eaff33bfca8b4085ce8b533d142a7db43

              SHA256

              011d6a88f5f9aa3236f8da46c2c89a06c48e0773527179f3f25f25b30be65881

              SHA512

              f8fbd7982d969264d83cf4b291defeceec97d49a8b1f378c010f73625d5fa399e821fedd6a0e5af2b23b9448106aec25a707722d3269a3a2732edcacbba0cab1

            • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
              Filesize

              6.3MB

              MD5

              f08d9bbc61cff8e8c3504524c3220bef

              SHA1

              b4268c667469620bb528c04eaa819d508159b398

              SHA256

              2c4d8b48344ae221e349e525ac16eb364ffb5ab8deae80c7caa28dd5967cabdb

              SHA512

              a64a03d959487399fb57e1bd062c0e9f88a17ff9b3ad15e6b96a4b7332341d0fc9186ef99b2ab9bdcfa51864f21d08bce48479202c01d15470916e90fb09fef4

            • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.BMP
              Filesize

              451KB

              MD5

              0b445ace8798426e7185f52b7b7b6d1e

              SHA1

              7a77b46e0848cc9b32283ccb3f91a18c0934c079

              SHA256

              2bbf97ccba3f87d469eac909c4ce8a3f13ed29c8f31b611e7d5cf89a0619eda6

              SHA512

              51523d5b711481293305465a3a3c6a3a50dca984cdc8cca1f4c44f3c21bfa430cd9aac1a8782d9605e6954cbafb307beb6b1a52e9785de1bc3f71067d80c6b6e

            • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG23.PNG
              Filesize

              1KB

              MD5

              fa8aa84ef4bf0de505f6e3447d4b55b3

              SHA1

              b99654dfa5f6c56857b4f4102af2d27503bcdc74

              SHA256

              f3b7e85e8e5e41496fb563816fbf79e6640feb1591bd5e0c0b876d80053ad913

              SHA512

              b3a7d0d5abe554301b8745bd738662d80e439fba8df6f984cc05151ec8c081a61f0538765653e8587b431cdc97d384ee35d17ab3324c06a2ca40a069e1525ba6

            • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNG
              Filesize

              45KB

              MD5

              2799f9daca46770a871ce1b5eed32e7c

              SHA1

              a2792f571210a7f38cdbe49391017300ee7b1ce4

              SHA256

              fc22676f5b6cdae17b78ddfd16bb070687516fbc827a7edd0541f3a32d85c9e9

              SHA512

              c41f2e4c4ca59d6f9d11fac11296ab87f1b508b5d64e5db7762f2f6dd387aa96206b2b0fa127f17c0b8c24a0b56e81af12d5937474a450222d9c4416c1acb16a

            • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG41.PNG
              Filesize

              457B

              MD5

              ce17d7ce06488f394ce124f17d5acafc

              SHA1

              8a5dceae9ea369b686123c8f940bb0ea07870ffa

              SHA256

              c4b04568930f03979d71f48a57b9ad06b4cdf687272f6753ff662006e8e6237f

              SHA512

              c33f1370213cabd1b84c936f1ac14f9bcc83bc03a633bbe25efe1e906bcee515d0e615c86b7ee3b34404dd1d95ce74d1a00908de8cdacbf9961de3f1ceb8362b

            • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG42.PNG
              Filesize

              352B

              MD5

              1f5c8939031a7f93762862cfc88a8e56

              SHA1

              6dc4df87344db0ddf09c777e7a80d1b5661559b8

              SHA256

              14be26e969eb15ef7e76e0ad02d8aa0516c5391e8b09dba0a9a6c5f57ae24aba

              SHA512

              de45d700c86329c704777917863fd1ddeca90d2bed67a72794164882bf15725ce83c7733f664ee0a2af7df54a6be2def729d19237fb2c434115396ac126ff47f

            • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG45.PNG
              Filesize

              438B

              MD5

              09229c3bfb801177839a7c2e22e33a1b

              SHA1

              f679c05c4c7b2f3722069420c6d6481fc856e7aa

              SHA256

              cbf81d779b469942613297a3ca6c09d885e3b1d4aa952dc1994a7175fbfc7e3f

              SHA512

              503bfa063b29dda95f15da303f707e5b78a6bdb74662c222d8a8b7e3a33264016a66acdd9de44aea932e7cde80a43c2406ea6f0250d3df8e182217bc4a0a7ed7

            • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG46.PNG
              Filesize

              206B

              MD5

              d8a095202e08fa1ac2578982e9a486db

              SHA1

              397ffc8af43ac18466b8df245b4faa6b278659e6

              SHA256

              28fed2b9a3cbde34da4b6b5d1af2d2844437d21f6dec85b3ca2faa5cd3b512e5

              SHA512

              ac751386a0004e335f4e5f4ea24bf6a474478c8a7ca54d018734e7cd44b8e9a0eb262b00fe1219b1c62c96b018b08ba6b1056d3a13e64b55c7e70d748a6ae9c6

            • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG48.PNG
              Filesize

              1KB

              MD5

              59d6f22fdc11d6b116b38193ed5f4b97

              SHA1

              cddc7eb2110b3179dd6d1e32b4b37f3568a22ebf

              SHA256

              782cafea76d24d76885d88ee1302e5f78d75a4e335529dc20ad476fdb9e34744

              SHA512

              5b0fab5139736d30a69c98ea88d95a5c70f59aab1b82394c58b33617b824447b861a6e6067b62dd1ca1812a4989937e06ad473c6c94376af957871e9e63553fa

            • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG5.PNG
              Filesize

              1KB

              MD5

              3094925a8de871bcc72ae50882d2a6f7

              SHA1

              9f7894bc4b2a498ad20b14b2b3cac175bf4d7a9f

              SHA256

              523e7230db0c47a436abbc442db93e41b6f549b32da6c2a10db7a18228491216

              SHA512

              bf2349354321397652d834507aae4c32885273209d1409b796170292e37ebf35878e2934d3f53545e66724561e646cc660f952e0bb5006cd7a262a790b64e39e

            • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG66.PNG
              Filesize

              41KB

              MD5

              1557c08e187b7783083e0b80051fd321

              SHA1

              2c6ee47799d713e88fd589609b81912a4522044e

              SHA256

              0c0e74dd07c45833a5dd7ba931e5d528eb16334defdd06171df2f632d6e47842

              SHA512

              485f69b3878b2bd7fdf52ad020dde2cbc34dd1970aaa4e5eb8f8618f6091b5b827b428447859499c3d61ea9cde2edcbb97c8fb0560cd0aaff50027c0f97ee6f3

            • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG67.PNG
              Filesize

              1KB

              MD5

              5eecdc666e6dc0b8e5e8d2fc3b9cc1b2

              SHA1

              72a16d461bd2410d5749c6bf939a127683d83a95

              SHA256

              052f0289886f9cc0931d7026dfe1f5253ad39123479627e37afa5c430e8f8ff1

              SHA512

              5d465d2c61d97ec2a52db3aeee8d42ececdef08930692842f9c6a41b0611cb774015d369e4fe5186079e97839acc78e8403ea6a6c33ee54a7aef3eea41c3d7db

            • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
              Filesize

              33KB

              MD5

              8eec84d1f7b34fb8f0c92402959392b4

              SHA1

              4d49164ae8f7533d61e2ae137404d02d1308ce38

              SHA256

              2d6ea1e3e2247eb839116c10062aab24e7d029dec1b23bd7d34dc4b98a7f34a7

              SHA512

              662e5f4228b294ecac0ce0c892082984aabb7779ea1318df3c5202d775fbb0825fe672953bd7e8fc695960183fc1a4fefabc3eee68f0298ad20f3bf7cabdc5a3

            • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
              Filesize

              9KB

              MD5

              2e6c1ccb174723203192e589e4604ce9

              SHA1

              637e115bc41b8955bbe01871e3044f4ecc350a45

              SHA256

              8e88e3d85282accaa3eada3b6712cbe6441f49344fc7040d709093706bd4873c

              SHA512

              ac3a23bcbdc5514ebf43d253ae569a2ff1f323aabb74aaab1818b6432f4719deceba23053140102f7dd38e6d4507fd7b9355c7aeb123e707f29a3ac57625cbfb

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\OCNN5RLL.txt
              Filesize

              864B

              MD5

              ef62e8ffb2b19a3144ccad2f47ccb316

              SHA1

              2189e9165e0b014402bfba2dc96b34051becd829

              SHA256

              49b6efac9468cf840bbf6021afc40eda48e3d1a7316fd7838c075f689c55687d

              SHA512

              3b4a92f202fca6e5267954dbc9dcf84c77bc0081a73afe7e3ad235d1af1da3063eac99b931d90397a32b1f9fdf1c6c94971cdf2099c07e79a7cc48a75b192926

            • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
              Filesize

              40B

              MD5

              37f296b9ab5d6f2a231c45099ccd344d

              SHA1

              e8ec73ef09538c54d1a956efe72e1587760bc797

              SHA256

              6d93f8f8ce2e9331fa18bdafad6eb137a1a852252368649e5ef9091700736a94

              SHA512

              e102735de337c53c228dad05ee186150670e4b263345f8b56c6247f070ea989823f59af0826488480e61a58544d1adae1d155ca90d38e8d9d4779326870a43ca

            • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
              Filesize

              40B

              MD5

              37f296b9ab5d6f2a231c45099ccd344d

              SHA1

              e8ec73ef09538c54d1a956efe72e1587760bc797

              SHA256

              6d93f8f8ce2e9331fa18bdafad6eb137a1a852252368649e5ef9091700736a94

              SHA512

              e102735de337c53c228dad05ee186150670e4b263345f8b56c6247f070ea989823f59af0826488480e61a58544d1adae1d155ca90d38e8d9d4779326870a43ca

            • C:\Windows\Installer\6d6ebb.msi
              Filesize

              81.0MB

              MD5

              1794aaa17d114a315a95473c9780fc8b

              SHA1

              7f250c022b916b88e22254985e7552bc3ac8db04

              SHA256

              7682233d155e6d19f30cf61b185a02055be0dbcacd2c9accf90a99de21547eb4

              SHA512

              fb9defdf73786528e82ffc7e1ccfa03cfb687365ec740e9620993da785414306f03a7e1fa523192a9d690a882b012d1e426afd1757639f3ef5f1e612c01e6516

            • C:\Windows\Installer\MSI8C3F.tmp
              Filesize

              757KB

              MD5

              62cfeb86f117ad91b8bb52f1dda6f473

              SHA1

              c753b488938b3e08f7f47df209359c7b78764448

              SHA256

              f06cba20bd40e9d841add1877cf8d3b406f0acfa4800b80ae041ed3cc374eb7e

              SHA512

              c1b0e76cee4e2c3ca604dcc8f5665e72e70008acc824e20d89404f139d7e7e789e99dff131dafd76409f6ea0a813aa136f96089fbdadcf90d6485b1807762e4e

            • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
              Filesize

              2.7MB

              MD5

              955c78a8efe1838d1dbb660f7047e606

              SHA1

              fb6756aff4d2e3708dd530520299198572161480

              SHA256

              7bda1ebb13b15b856bde93d3edf31b5679f9ba685a8e70f183550582bac1baba

              SHA512

              2f4d3924b6d0e5405dc63903b0572bac93efaabcc3f54a4045f03ca386b48d8e012ba324dd7743c1d6ddedeec7f7260ab94a37d2cd6c97182ad78193f1d1c1bb

            • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303250146261\opera_package
              Filesize

              86.9MB

              MD5

              6b7771354e081eb94cdbf7627799da4f

              SHA1

              199341a750443cc6e9b2b2fa1e657d0dd327711f

              SHA256

              494d1247e61eebf703a6eb19c14bde88edd2f85515fefa4f0465f43873e69aab

              SHA512

              33e781a102ba3f5c3b1895540bc9c43b78bf4f19af4b91ae0c765594f39d6569d1bad207b33f808426d8ebdcb00c419b7bb76bb050bae0bb843f96dd84355800

            • \Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
              Filesize

              1.8MB

              MD5

              52e46b1adf9cd40428b41755df527bd4

              SHA1

              5f0bb9c9c14208851beb5c93d9268c16ab39dc07

              SHA256

              a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

              SHA512

              813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

            • \Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
              Filesize

              1.8MB

              MD5

              52e46b1adf9cd40428b41755df527bd4

              SHA1

              5f0bb9c9c14208851beb5c93d9268c16ab39dc07

              SHA256

              a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

              SHA512

              813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

            • \Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
              Filesize

              1.8MB

              MD5

              52e46b1adf9cd40428b41755df527bd4

              SHA1

              5f0bb9c9c14208851beb5c93d9268c16ab39dc07

              SHA256

              a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

              SHA512

              813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

            • \Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
              Filesize

              1.8MB

              MD5

              52e46b1adf9cd40428b41755df527bd4

              SHA1

              5f0bb9c9c14208851beb5c93d9268c16ab39dc07

              SHA256

              a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

              SHA512

              813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

            • \Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
              Filesize

              1.8MB

              MD5

              52e46b1adf9cd40428b41755df527bd4

              SHA1

              5f0bb9c9c14208851beb5c93d9268c16ab39dc07

              SHA256

              a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

              SHA512

              813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

            • \Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
              Filesize

              1.8MB

              MD5

              52e46b1adf9cd40428b41755df527bd4

              SHA1

              5f0bb9c9c14208851beb5c93d9268c16ab39dc07

              SHA256

              a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

              SHA512

              813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

            • \Users\Admin\AppData\Local\Temp\Opera_installer_2303250146233862564.dll
              Filesize

              4.6MB

              MD5

              674e177ac04e98ce48f4df0d4c440568

              SHA1

              b08fa2014573f0af48c06357da323e79399ef144

              SHA256

              8e1ac3c2a3aeb52e26794368c1adf5e7b330aa3bc27ac1669cb3aed64da8fe86

              SHA512

              5d99f5837ec50ca2f46a8e8cfbb055eeedbc28f7e63c49a901984f1c884e2a6d790e91542174dc2808b4ead30a6204912f5f98af1b562210494574eb2328d3e4

            • \Users\Admin\AppData\Local\Temp\Opera_installer_2303250146245402928.dll
              Filesize

              4.6MB

              MD5

              674e177ac04e98ce48f4df0d4c440568

              SHA1

              b08fa2014573f0af48c06357da323e79399ef144

              SHA256

              8e1ac3c2a3aeb52e26794368c1adf5e7b330aa3bc27ac1669cb3aed64da8fe86

              SHA512

              5d99f5837ec50ca2f46a8e8cfbb055eeedbc28f7e63c49a901984f1c884e2a6d790e91542174dc2808b4ead30a6204912f5f98af1b562210494574eb2328d3e4

            • \Users\Admin\AppData\Local\Temp\Opera_installer_2303250146250082180.dll
              Filesize

              4.6MB

              MD5

              674e177ac04e98ce48f4df0d4c440568

              SHA1

              b08fa2014573f0af48c06357da323e79399ef144

              SHA256

              8e1ac3c2a3aeb52e26794368c1adf5e7b330aa3bc27ac1669cb3aed64da8fe86

              SHA512

              5d99f5837ec50ca2f46a8e8cfbb055eeedbc28f7e63c49a901984f1c884e2a6d790e91542174dc2808b4ead30a6204912f5f98af1b562210494574eb2328d3e4

            • \Users\Admin\AppData\Local\Temp\Opera_installer_2303250146262412272.dll
              Filesize

              4.6MB

              MD5

              674e177ac04e98ce48f4df0d4c440568

              SHA1

              b08fa2014573f0af48c06357da323e79399ef144

              SHA256

              8e1ac3c2a3aeb52e26794368c1adf5e7b330aa3bc27ac1669cb3aed64da8fe86

              SHA512

              5d99f5837ec50ca2f46a8e8cfbb055eeedbc28f7e63c49a901984f1c884e2a6d790e91542174dc2808b4ead30a6204912f5f98af1b562210494574eb2328d3e4

            • \Users\Admin\AppData\Local\Temp\Opera_installer_2303250146272702384.dll
              Filesize

              4.6MB

              MD5

              674e177ac04e98ce48f4df0d4c440568

              SHA1

              b08fa2014573f0af48c06357da323e79399ef144

              SHA256

              8e1ac3c2a3aeb52e26794368c1adf5e7b330aa3bc27ac1669cb3aed64da8fe86

              SHA512

              5d99f5837ec50ca2f46a8e8cfbb055eeedbc28f7e63c49a901984f1c884e2a6d790e91542174dc2808b4ead30a6204912f5f98af1b562210494574eb2328d3e4

            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
              Filesize

              1.7MB

              MD5

              1bbf5dd0b6ca80e4c7c77495c3f33083

              SHA1

              e0520037e60eb641ec04d1e814394c9da0a6a862

              SHA256

              bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

              SHA512

              97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
              Filesize

              97KB

              MD5

              da1d0cd400e0b6ad6415fd4d90f69666

              SHA1

              de9083d2902906cacf57259cf581b1466400b799

              SHA256

              7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

              SHA512

              f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
              Filesize

              1.3MB

              MD5

              111dddf2f308abc2a8f7555d5f642751

              SHA1

              11e6cdccbf29a71a97011b9444cf20c83ad8b57b

              SHA256

              c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

              SHA512

              11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
              Filesize

              1.3MB

              MD5

              111dddf2f308abc2a8f7555d5f642751

              SHA1

              11e6cdccbf29a71a97011b9444cf20c83ad8b57b

              SHA256

              c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

              SHA512

              11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
              Filesize

              1.3MB

              MD5

              111dddf2f308abc2a8f7555d5f642751

              SHA1

              11e6cdccbf29a71a97011b9444cf20c83ad8b57b

              SHA256

              c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

              SHA512

              11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
              Filesize

              1.3MB

              MD5

              111dddf2f308abc2a8f7555d5f642751

              SHA1

              11e6cdccbf29a71a97011b9444cf20c83ad8b57b

              SHA256

              c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

              SHA512

              11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
              Filesize

              1.3MB

              MD5

              111dddf2f308abc2a8f7555d5f642751

              SHA1

              11e6cdccbf29a71a97011b9444cf20c83ad8b57b

              SHA256

              c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

              SHA512

              11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
              Filesize

              326KB

              MD5

              80d93d38badecdd2b134fe4699721223

              SHA1

              e829e58091bae93bc64e0c6f9f0bac999cfda23d

              SHA256

              c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

              SHA512

              9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
              Filesize

              1.3MB

              MD5

              5027f3112ac2d6f764769102a9145c8e

              SHA1

              a369a0e1d4ace1a8d66908aa43543bea03c76f5b

              SHA256

              d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

              SHA512

              181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
              Filesize

              1.3MB

              MD5

              5027f3112ac2d6f764769102a9145c8e

              SHA1

              a369a0e1d4ace1a8d66908aa43543bea03c76f5b

              SHA256

              d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

              SHA512

              181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
              Filesize

              1.3MB

              MD5

              5027f3112ac2d6f764769102a9145c8e

              SHA1

              a369a0e1d4ace1a8d66908aa43543bea03c76f5b

              SHA256

              d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

              SHA512

              181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
              Filesize

              1.3MB

              MD5

              5027f3112ac2d6f764769102a9145c8e

              SHA1

              a369a0e1d4ace1a8d66908aa43543bea03c76f5b

              SHA256

              d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

              SHA512

              181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
              Filesize

              1.3MB

              MD5

              5027f3112ac2d6f764769102a9145c8e

              SHA1

              a369a0e1d4ace1a8d66908aa43543bea03c76f5b

              SHA256

              d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

              SHA512

              181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
              Filesize

              326KB

              MD5

              80d93d38badecdd2b134fe4699721223

              SHA1

              e829e58091bae93bc64e0c6f9f0bac999cfda23d

              SHA256

              c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

              SHA512

              9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

            • \Users\Admin\AppData\Local\Temp\jds7140680.tmp\jre-windows.exe
              Filesize

              84.1MB

              MD5

              dfcfc788d67437530a50177164db42b0

              SHA1

              2d9ed0dc5671a358186dcf83abb74bfe39c40e9f

              SHA256

              a90318bae7d99da633d9cac8ce322120d087e7b6f5eec0d1d0d7f9413fdd4dc1

              SHA512

              dbdfd02528c9f0e506232e8640a8602fade0d05f4139368187300ea2d537e41d2d167655ded30d938bd445a21c776a3c3721f8db4d3f03e3c06807a84cf232e3

            • \Users\Admin\AppData\Local\Temp\jds7140680.tmp\jre-windows.exe
              Filesize

              84.1MB

              MD5

              dfcfc788d67437530a50177164db42b0

              SHA1

              2d9ed0dc5671a358186dcf83abb74bfe39c40e9f

              SHA256

              a90318bae7d99da633d9cac8ce322120d087e7b6f5eec0d1d0d7f9413fdd4dc1

              SHA512

              dbdfd02528c9f0e506232e8640a8602fade0d05f4139368187300ea2d537e41d2d167655ded30d938bd445a21c776a3c3721f8db4d3f03e3c06807a84cf232e3

            • \Users\Admin\AppData\Local\Temp\jre-windows.exe
              Filesize

              84.5MB

              MD5

              7542ec421a2f6e90751e8b64c22e0542

              SHA1

              d207d221a28ede5c2c8415f82c555989aa7068ba

              SHA256

              188ca8ecc44de1b7f602e883c3054dc392792c3631bf362b1bc4f3e1dba323e6

              SHA512

              8987bf8aa1b401815fa9850e56954db6015bdd06ce78b65ba435724582ffa615dee4e1452fa237c53257dca8ee97b469d01c27757a5f070ce6f807a4f81094bc

            • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              Filesize

              2.7MB

              MD5

              955c78a8efe1838d1dbb660f7047e606

              SHA1

              fb6756aff4d2e3708dd530520299198572161480

              SHA256

              7bda1ebb13b15b856bde93d3edf31b5679f9ba685a8e70f183550582bac1baba

              SHA512

              2f4d3924b6d0e5405dc63903b0572bac93efaabcc3f54a4045f03ca386b48d8e012ba324dd7743c1d6ddedeec7f7260ab94a37d2cd6c97182ad78193f1d1c1bb

            • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              Filesize

              2.7MB

              MD5

              955c78a8efe1838d1dbb660f7047e606

              SHA1

              fb6756aff4d2e3708dd530520299198572161480

              SHA256

              7bda1ebb13b15b856bde93d3edf31b5679f9ba685a8e70f183550582bac1baba

              SHA512

              2f4d3924b6d0e5405dc63903b0572bac93efaabcc3f54a4045f03ca386b48d8e012ba324dd7743c1d6ddedeec7f7260ab94a37d2cd6c97182ad78193f1d1c1bb

            • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              Filesize

              2.7MB

              MD5

              955c78a8efe1838d1dbb660f7047e606

              SHA1

              fb6756aff4d2e3708dd530520299198572161480

              SHA256

              7bda1ebb13b15b856bde93d3edf31b5679f9ba685a8e70f183550582bac1baba

              SHA512

              2f4d3924b6d0e5405dc63903b0572bac93efaabcc3f54a4045f03ca386b48d8e012ba324dd7743c1d6ddedeec7f7260ab94a37d2cd6c97182ad78193f1d1c1bb

            • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              Filesize

              2.7MB

              MD5

              955c78a8efe1838d1dbb660f7047e606

              SHA1

              fb6756aff4d2e3708dd530520299198572161480

              SHA256

              7bda1ebb13b15b856bde93d3edf31b5679f9ba685a8e70f183550582bac1baba

              SHA512

              2f4d3924b6d0e5405dc63903b0572bac93efaabcc3f54a4045f03ca386b48d8e012ba324dd7743c1d6ddedeec7f7260ab94a37d2cd6c97182ad78193f1d1c1bb

            • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              Filesize

              2.7MB

              MD5

              955c78a8efe1838d1dbb660f7047e606

              SHA1

              fb6756aff4d2e3708dd530520299198572161480

              SHA256

              7bda1ebb13b15b856bde93d3edf31b5679f9ba685a8e70f183550582bac1baba

              SHA512

              2f4d3924b6d0e5405dc63903b0572bac93efaabcc3f54a4045f03ca386b48d8e012ba324dd7743c1d6ddedeec7f7260ab94a37d2cd6c97182ad78193f1d1c1bb

            • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              Filesize

              2.7MB

              MD5

              955c78a8efe1838d1dbb660f7047e606

              SHA1

              fb6756aff4d2e3708dd530520299198572161480

              SHA256

              7bda1ebb13b15b856bde93d3edf31b5679f9ba685a8e70f183550582bac1baba

              SHA512

              2f4d3924b6d0e5405dc63903b0572bac93efaabcc3f54a4045f03ca386b48d8e012ba324dd7743c1d6ddedeec7f7260ab94a37d2cd6c97182ad78193f1d1c1bb

            • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              Filesize

              2.7MB

              MD5

              955c78a8efe1838d1dbb660f7047e606

              SHA1

              fb6756aff4d2e3708dd530520299198572161480

              SHA256

              7bda1ebb13b15b856bde93d3edf31b5679f9ba685a8e70f183550582bac1baba

              SHA512

              2f4d3924b6d0e5405dc63903b0572bac93efaabcc3f54a4045f03ca386b48d8e012ba324dd7743c1d6ddedeec7f7260ab94a37d2cd6c97182ad78193f1d1c1bb

            • memory/1172-482-0x0000000002B60000-0x0000000002F48000-memory.dmp
              Filesize

              3.9MB

            • memory/1172-481-0x0000000002B60000-0x0000000002F48000-memory.dmp
              Filesize

              3.9MB

            • memory/1172-480-0x0000000002B60000-0x0000000002F48000-memory.dmp
              Filesize

              3.9MB

            • memory/1336-2033-0x0000000000400000-0x0000000000417000-memory.dmp
              Filesize

              92KB

            • memory/1336-2055-0x0000000000230000-0x0000000000247000-memory.dmp
              Filesize

              92KB

            • memory/1336-2056-0x0000000000230000-0x0000000000247000-memory.dmp
              Filesize

              92KB

            • memory/1336-2057-0x0000000000230000-0x0000000000247000-memory.dmp
              Filesize

              92KB

            • memory/1336-2051-0x0000000000400000-0x0000000000417000-memory.dmp
              Filesize

              92KB

            • memory/1336-2043-0x0000000000400000-0x0000000000417000-memory.dmp
              Filesize

              92KB

            • memory/1336-2036-0x0000000000230000-0x0000000000247000-memory.dmp
              Filesize

              92KB

            • memory/1336-2037-0x0000000000230000-0x0000000000247000-memory.dmp
              Filesize

              92KB

            • memory/1336-2035-0x0000000000230000-0x0000000000247000-memory.dmp
              Filesize

              92KB

            • memory/1336-2062-0x0000000000400000-0x0000000000417000-memory.dmp
              Filesize

              92KB

            • memory/1360-796-0x00000000057C0000-0x0000000005CF8000-memory.dmp
              Filesize

              5.2MB

            • memory/1360-795-0x00000000057C0000-0x0000000005CF8000-memory.dmp
              Filesize

              5.2MB

            • memory/1360-797-0x00000000057C0000-0x0000000005CF8000-memory.dmp
              Filesize

              5.2MB

            • memory/1360-483-0x0000000000E00000-0x00000000011E8000-memory.dmp
              Filesize

              3.9MB

            • memory/1360-1537-0x0000000000E00000-0x00000000011E8000-memory.dmp
              Filesize

              3.9MB

            • memory/1360-794-0x00000000057C0000-0x0000000005CF8000-memory.dmp
              Filesize

              5.2MB

            • memory/1360-576-0x00000000027B0000-0x00000000027C0000-memory.dmp
              Filesize

              64KB

            • memory/1360-1418-0x0000000000E00000-0x00000000011E8000-memory.dmp
              Filesize

              3.9MB

            • memory/1360-1564-0x00000000027B0000-0x00000000027C0000-memory.dmp
              Filesize

              64KB

            • memory/1524-388-0x0000000000060000-0x0000000000448000-memory.dmp
              Filesize

              3.9MB

            • memory/1524-74-0x0000000000060000-0x0000000000448000-memory.dmp
              Filesize

              3.9MB

            • memory/1524-389-0x0000000010000000-0x0000000010051000-memory.dmp
              Filesize

              324KB

            • memory/1524-761-0x0000000000060000-0x0000000000448000-memory.dmp
              Filesize

              3.9MB

            • memory/1524-1450-0x0000000004F20000-0x0000000004F30000-memory.dmp
              Filesize

              64KB

            • memory/1524-367-0x0000000000060000-0x0000000000448000-memory.dmp
              Filesize

              3.9MB

            • memory/1524-366-0x00000000025A0000-0x00000000025A3000-memory.dmp
              Filesize

              12KB

            • memory/1524-365-0x0000000010000000-0x0000000010051000-memory.dmp
              Filesize

              324KB

            • memory/1524-1443-0x0000000000060000-0x0000000000448000-memory.dmp
              Filesize

              3.9MB

            • memory/1524-1428-0x0000000000060000-0x0000000000448000-memory.dmp
              Filesize

              3.9MB

            • memory/1524-368-0x0000000010000000-0x0000000010051000-memory.dmp
              Filesize

              324KB

            • memory/1524-418-0x0000000010000000-0x0000000010051000-memory.dmp
              Filesize

              324KB

            • memory/1524-383-0x0000000000060000-0x0000000000448000-memory.dmp
              Filesize

              3.9MB

            • memory/1524-1429-0x0000000010000000-0x0000000010051000-memory.dmp
              Filesize

              324KB

            • memory/1524-440-0x0000000004F20000-0x0000000004F30000-memory.dmp
              Filesize

              64KB

            • memory/1524-1567-0x0000000010000000-0x0000000010051000-memory.dmp
              Filesize

              324KB

            • memory/1524-417-0x0000000000060000-0x0000000000448000-memory.dmp
              Filesize

              3.9MB

            • memory/1608-72-0x0000000002A00000-0x0000000002DE8000-memory.dmp
              Filesize

              3.9MB

            • memory/1608-71-0x0000000002A00000-0x0000000002DE8000-memory.dmp
              Filesize

              3.9MB

            • memory/2180-1362-0x0000000000140000-0x0000000000678000-memory.dmp
              Filesize

              5.2MB

            • memory/2272-1373-0x0000000000A40000-0x0000000000F78000-memory.dmp
              Filesize

              5.2MB

            • memory/2272-1424-0x0000000002BF0000-0x0000000003128000-memory.dmp
              Filesize

              5.2MB

            • memory/2272-1578-0x0000000002BF0000-0x0000000003128000-memory.dmp
              Filesize

              5.2MB

            • memory/2384-1425-0x0000000000A40000-0x0000000000F78000-memory.dmp
              Filesize

              5.2MB

            • memory/2564-1577-0x0000000004120000-0x0000000004658000-memory.dmp
              Filesize

              5.2MB

            • memory/2564-1370-0x0000000003AA0000-0x0000000003FD8000-memory.dmp
              Filesize

              5.2MB

            • memory/2564-1363-0x0000000002D50000-0x0000000003288000-memory.dmp
              Filesize

              5.2MB

            • memory/2564-798-0x0000000000A40000-0x0000000000F78000-memory.dmp
              Filesize

              5.2MB

            • memory/2564-1423-0x0000000004120000-0x0000000004658000-memory.dmp
              Filesize

              5.2MB

            • memory/2928-1368-0x0000000000A40000-0x0000000000F78000-memory.dmp
              Filesize

              5.2MB