bazarbackdoor | 78d84068b47cf28b76c88ba4474c7c187510f4e4e967d079d3761dcab7851655

Analysis

max time kernel
209s
max time network
212s
platform
windows7_x64
resource
win7-20230220-es
resource tags

arch:x64arch:x86image:win7-20230220-eslocale:es-esos:windows7-x64systemwindows
submitted
28-03-2023 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TLauncher-2.876-Installer-1.0.7-global.exe
Size

22.6MB
MD5

e89a95bce6075955a4e1acdb6bb56561
SHA1

8b17013cbf2ea69d625d7bcb1e578933c13678fc
SHA256

78d84068b47cf28b76c88ba4474c7c187510f4e4e967d079d3761dcab7851655
SHA512

4ccb33f60c9292e12daa53b49524a36bbe1c1ca86d794b5134b8b954736a532e9f202123b39036c6a9c557e128bd8361e5c1cb86d40723cc00784026741d5e65
SSDEEP

393216:DXkoYB+UAVl/Pfs/dQETVlOBbpFEjdGphRqV56HpkvQFa2Vj4h2cU:D0oYB+3fHHExi73qqHpU2Vj4hE

Score

10^/10

bazarbackdoor backdoor discovery spyware stealer upx

Malware Config

Signatures

BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
backdoor bazarbackdoor

Bazar/Team9 Backdoor payload 4 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\jre-windows.exe	BazarBackdoorVar3
C:\Users\Admin\AppData\Local\Temp\jre-windows.exe	BazarBackdoorVar3
\Users\Admin\AppData\Local\Temp\jds7170788.tmp\jre-windows.exe	BazarBackdoorVar3
C:\Users\Admin\AppData\Local\Temp\jds7170788.tmp\jre-windows.exe	BazarBackdoorVar3

Downloads MZ/PE file

Executes dropped EXE 13 IoCs

Processes:

irsetup.exeBrowserInstaller.exeirsetup.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exejre-windows.exejre-windows.exeAssistant_96.0.4693.50_Setup.exe_sfx.exeassistant_installer.exeassistant_installer.exe

pid	process
856	irsetup.exe
1028	BrowserInstaller.exe
1252	irsetup.exe
984	opera-installer-bro.exe
980	opera-installer-bro.exe
2236	opera-installer-bro.exe
2432	opera-installer-bro.exe
2496	opera-installer-bro.exe
1768	jre-windows.exe
2700	jre-windows.exe
2144	Assistant_96.0.4693.50_Setup.exe_sfx.exe
2112	assistant_installer.exe
2212	assistant_installer.exe

Loads dropped DLL 41 IoCs

Processes:

TLauncher-2.876-Installer-1.0.7-global.exeirsetup.exeBrowserInstaller.exeirsetup.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exejre-windows.exeassistant_installer.exe

pid	process
1396	TLauncher-2.876-Installer-1.0.7-global.exe
1396	TLauncher-2.876-Installer-1.0.7-global.exe
1396	TLauncher-2.876-Installer-1.0.7-global.exe
1396	TLauncher-2.876-Installer-1.0.7-global.exe
856	irsetup.exe
856	irsetup.exe
856	irsetup.exe
856	irsetup.exe
856	irsetup.exe
856	irsetup.exe
856	irsetup.exe
856	irsetup.exe
1028	BrowserInstaller.exe
1028	BrowserInstaller.exe
1028	BrowserInstaller.exe
1028	BrowserInstaller.exe
1252	irsetup.exe
1252	irsetup.exe
1252	irsetup.exe
1252	irsetup.exe
1252	irsetup.exe
1252	irsetup.exe
1252	irsetup.exe
1252	irsetup.exe
984	opera-installer-bro.exe
984	opera-installer-bro.exe
980	opera-installer-bro.exe
984	opera-installer-bro.exe
2236	opera-installer-bro.exe
984	opera-installer-bro.exe
2432	opera-installer-bro.exe
2432	opera-installer-bro.exe
2496	opera-installer-bro.exe
856	irsetup.exe
1768	jre-windows.exe
984	opera-installer-bro.exe
984	opera-installer-bro.exe
984	opera-installer-bro.exe
984	opera-installer-bro.exe
2112	assistant_installer.exe
1208

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

UPX packed file 48 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
behavioral1/memory/856-75-0x0000000000A50000-0x0000000000E38000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
behavioral1/memory/856-369-0x0000000000A50000-0x0000000000E38000-memory.dmp	upx
behavioral1/memory/856-371-0x0000000000A50000-0x0000000000E38000-memory.dmp	upx
behavioral1/memory/856-386-0x0000000000A50000-0x0000000000E38000-memory.dmp	upx
behavioral1/memory/856-414-0x0000000000A50000-0x0000000000E38000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
behavioral1/memory/1252-487-0x0000000001300000-0x00000000016E8000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
behavioral1/memory/984-598-0x0000000000BE0000-0x0000000001118000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
behavioral1/memory/856-1045-0x0000000000A50000-0x0000000000E38000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe	upx
behavioral1/memory/2236-1282-0x0000000001380000-0x00000000018B8000-memory.dmp	upx
behavioral1/memory/980-1277-0x0000000000BE0000-0x0000000001118000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
behavioral1/memory/2432-1409-0x0000000000BE0000-0x0000000001118000-memory.dmp	upx
behavioral1/memory/2496-1411-0x0000000000BE0000-0x0000000001118000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe	upx
behavioral1/memory/1252-1416-0x0000000001300000-0x00000000016E8000-memory.dmp	upx
behavioral1/memory/856-1434-0x0000000000A50000-0x0000000000E38000-memory.dmp	upx
behavioral1/memory/856-1449-0x0000000000A50000-0x0000000000E38000-memory.dmp	upx
behavioral1/memory/1252-1506-0x0000000001300000-0x00000000016E8000-memory.dmp	upx
behavioral1/memory/856-1730-0x0000000000A50000-0x0000000000E38000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

opera-installer-bro.exeopera-installer-bro.exe

description ioc process

File opened (read-only) \??\D: opera-installer-bro.exe
File opened (read-only) \??\D: opera-installer-bro.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened (read-only)	\??\D:	opera-installer-bro.exe
File opened (read-only)	\??\D:	opera-installer-bro.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

irsetup.exejre-windows.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main	irsetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main	jre-windows.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

irsetup.exeopera-installer-bro.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	opera-installer-bro.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	opera-installer-bro.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	opera-installer-bro.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	opera-installer-bro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	irsetup.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

irsetup.exeirsetup.exejre-windows.exe

pid	process
856	irsetup.exe
856	irsetup.exe
856	irsetup.exe
856	irsetup.exe
856	irsetup.exe
856	irsetup.exe
1252	irsetup.exe
1252	irsetup.exe
2700	jre-windows.exe
2700	jre-windows.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

TLauncher-2.876-Installer-1.0.7-global.exeirsetup.exeBrowserInstaller.exeirsetup.exeopera-installer-bro.exeopera-installer-bro.exejre-windows.exe

description	pid	process	target process
PID 1396 wrote to memory of 856	1396	TLauncher-2.876-Installer-1.0.7-global.exe	irsetup.exe
PID 1396 wrote to memory of 856	1396	TLauncher-2.876-Installer-1.0.7-global.exe	irsetup.exe
PID 1396 wrote to memory of 856	1396	TLauncher-2.876-Installer-1.0.7-global.exe	irsetup.exe
PID 1396 wrote to memory of 856	1396	TLauncher-2.876-Installer-1.0.7-global.exe	irsetup.exe
PID 1396 wrote to memory of 856	1396	TLauncher-2.876-Installer-1.0.7-global.exe	irsetup.exe
PID 1396 wrote to memory of 856	1396	TLauncher-2.876-Installer-1.0.7-global.exe	irsetup.exe
PID 1396 wrote to memory of 856	1396	TLauncher-2.876-Installer-1.0.7-global.exe	irsetup.exe
PID 856 wrote to memory of 1028	856	irsetup.exe	BrowserInstaller.exe
PID 856 wrote to memory of 1028	856	irsetup.exe	BrowserInstaller.exe
PID 856 wrote to memory of 1028	856	irsetup.exe	BrowserInstaller.exe
PID 856 wrote to memory of 1028	856	irsetup.exe	BrowserInstaller.exe
PID 856 wrote to memory of 1028	856	irsetup.exe	BrowserInstaller.exe
PID 856 wrote to memory of 1028	856	irsetup.exe	BrowserInstaller.exe
PID 856 wrote to memory of 1028	856	irsetup.exe	BrowserInstaller.exe
PID 1028 wrote to memory of 1252	1028	BrowserInstaller.exe	irsetup.exe
PID 1028 wrote to memory of 1252	1028	BrowserInstaller.exe	irsetup.exe
PID 1028 wrote to memory of 1252	1028	BrowserInstaller.exe	irsetup.exe
PID 1028 wrote to memory of 1252	1028	BrowserInstaller.exe	irsetup.exe
PID 1028 wrote to memory of 1252	1028	BrowserInstaller.exe	irsetup.exe
PID 1028 wrote to memory of 1252	1028	BrowserInstaller.exe	irsetup.exe
PID 1028 wrote to memory of 1252	1028	BrowserInstaller.exe	irsetup.exe
PID 1252 wrote to memory of 984	1252	irsetup.exe	opera-installer-bro.exe
PID 1252 wrote to memory of 984	1252	irsetup.exe	opera-installer-bro.exe
PID 1252 wrote to memory of 984	1252	irsetup.exe	opera-installer-bro.exe
PID 1252 wrote to memory of 984	1252	irsetup.exe	opera-installer-bro.exe
PID 1252 wrote to memory of 984	1252	irsetup.exe	opera-installer-bro.exe
PID 1252 wrote to memory of 984	1252	irsetup.exe	opera-installer-bro.exe
PID 1252 wrote to memory of 984	1252	irsetup.exe	opera-installer-bro.exe
PID 984 wrote to memory of 980	984	opera-installer-bro.exe	opera-installer-bro.exe
PID 984 wrote to memory of 980	984	opera-installer-bro.exe	opera-installer-bro.exe
PID 984 wrote to memory of 980	984	opera-installer-bro.exe	opera-installer-bro.exe
PID 984 wrote to memory of 980	984	opera-installer-bro.exe	opera-installer-bro.exe
PID 984 wrote to memory of 980	984	opera-installer-bro.exe	opera-installer-bro.exe
PID 984 wrote to memory of 980	984	opera-installer-bro.exe	opera-installer-bro.exe
PID 984 wrote to memory of 980	984	opera-installer-bro.exe	opera-installer-bro.exe
PID 984 wrote to memory of 2236	984	opera-installer-bro.exe	opera-installer-bro.exe
PID 984 wrote to memory of 2236	984	opera-installer-bro.exe	opera-installer-bro.exe
PID 984 wrote to memory of 2236	984	opera-installer-bro.exe	opera-installer-bro.exe
PID 984 wrote to memory of 2236	984	opera-installer-bro.exe	opera-installer-bro.exe
PID 984 wrote to memory of 2236	984	opera-installer-bro.exe	opera-installer-bro.exe
PID 984 wrote to memory of 2236	984	opera-installer-bro.exe	opera-installer-bro.exe
PID 984 wrote to memory of 2236	984	opera-installer-bro.exe	opera-installer-bro.exe
PID 984 wrote to memory of 2432	984	opera-installer-bro.exe	opera-installer-bro.exe
PID 984 wrote to memory of 2432	984	opera-installer-bro.exe	opera-installer-bro.exe
PID 984 wrote to memory of 2432	984	opera-installer-bro.exe	opera-installer-bro.exe
PID 984 wrote to memory of 2432	984	opera-installer-bro.exe	opera-installer-bro.exe
PID 984 wrote to memory of 2432	984	opera-installer-bro.exe	opera-installer-bro.exe
PID 984 wrote to memory of 2432	984	opera-installer-bro.exe	opera-installer-bro.exe
PID 984 wrote to memory of 2432	984	opera-installer-bro.exe	opera-installer-bro.exe
PID 2432 wrote to memory of 2496	2432	opera-installer-bro.exe	opera-installer-bro.exe
PID 2432 wrote to memory of 2496	2432	opera-installer-bro.exe	opera-installer-bro.exe
PID 2432 wrote to memory of 2496	2432	opera-installer-bro.exe	opera-installer-bro.exe
PID 2432 wrote to memory of 2496	2432	opera-installer-bro.exe	opera-installer-bro.exe
PID 2432 wrote to memory of 2496	2432	opera-installer-bro.exe	opera-installer-bro.exe
PID 2432 wrote to memory of 2496	2432	opera-installer-bro.exe	opera-installer-bro.exe
PID 2432 wrote to memory of 2496	2432	opera-installer-bro.exe	opera-installer-bro.exe
PID 856 wrote to memory of 1768	856	irsetup.exe	jre-windows.exe
PID 856 wrote to memory of 1768	856	irsetup.exe	jre-windows.exe
PID 856 wrote to memory of 1768	856	irsetup.exe	jre-windows.exe
PID 856 wrote to memory of 1768	856	irsetup.exe	jre-windows.exe
PID 1768 wrote to memory of 2700	1768	jre-windows.exe	jre-windows.exe
PID 1768 wrote to memory of 2700	1768	jre-windows.exe	jre-windows.exe
PID 1768 wrote to memory of 2700	1768	jre-windows.exe	jre-windows.exe
PID 984 wrote to memory of 2144	984	opera-installer-bro.exe	Assistant_96.0.4693.50_Setup.exe_sfx.exe

C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe
"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1396

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe" "__IRCT:3" "__IRTSS:23645635" "__IRSID:S-1-5-21-3430344531-3702557399-3004411149-1000"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:856

C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1028

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816338 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:1840798" "__IRSID:S-1-5-21-3430344531-3702557399-3004411149-1000"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
"C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:984

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=97.0.4719.28 --initial-client-data=0x1a4,0x1a8,0x1ac,0x178,0x1b0,0x711c33e0,0x711c33f0,0x711c33fc
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:980

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe" --version
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
"C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=es --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=984 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20230328123408" --session-guid=ab3be498-3ff0-4eb5-854b-68e2cd402af3 --server-tracking-blob=OWEyMDAwZmI1NDAyNWMzYTRjMGJmNjAzYTMxYjlkNDI0YzdjNDIyZWZlMWNmNzZkZWRhNWQwNmEzZWZlMTgxNzp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjciLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNjc5OTk5NjQ1LjUyMzEiLCJ1c2VyYWdlbnQiOiJTZXR1cCBGYWN0b3J5IDkuMCIsInV0bSI6eyJjYW1wYWlnbiI6Ik9wZXJhRGVza3RvcCIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Ik1TVEwifSwidXVpZCI6IjQzOWE1ZmMxLTEzYTYtNDUyMS05OWQ4LTkzMGExNmExZDcwMiJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=0803000000000000
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:2432

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303281234081\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303281234081\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe"
6⤵
- Executes dropped EXE
PID:2144

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303281234081\assistant\assistant_installer.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303281234081\assistant\assistant_installer.exe" --version
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303281234081\assistant\assistant_installer.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303281234081\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=96.0.4693.50 --initial-client-data=0x148,0x14c,0x150,0x11c,0x154,0xf86c28,0xf86c38,0xf86c44
7⤵
- Executes dropped EXE
PID:2212

C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
"C:\Users\Admin\AppData\Local\Temp\jre-windows.exe" STATIC=1
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1768

C:\Users\Admin\AppData\Local\Temp\jds7170788.tmp\jre-windows.exe
"C:\Users\Admin\AppData\Local\Temp\jds7170788.tmp\jre-windows.exe" "STATIC=1"
4⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2700

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=97.0.4719.28 --initial-client-data=0x1b0,0x1b4,0x1b8,0x178,0x1bc,0x706a33e0,0x706a33f0,0x706a33fc
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2496

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Filesize
471B

MD5
c0beffd3dd0db195fe31ce8265e9094f

SHA1
bf9e183202f8283aad218eda5049abc566903ae0

SHA256
e769ed75ff7a96b74a16fcd412d683686bcb611a0b7905808c139f15526cd7c0

SHA512
369253adaec3d990c0dcc99c8450900ae8619db635b9c2b35e9515f39ec903469ef4faa4ee4a85f31158dccbd4991700478c27e613dafbc5e26817c32fa58e83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
Filesize
471B

MD5
92a6e5070529f066d5dd8ba0ee4ad21f

SHA1
d53c4c60e56c8ca7079183bdb36f4ba002c8cdf7

SHA256
2d90916a8fc4e8bd1ea4d2d76ce7f3c37aaaa8aef3ecf7b8478cb3b3853f69d9

SHA512
eeab5b46bbb9beb43e68cc771118183cdd61b0f248e1bd168f84b216b8cda84d632affda1fa5bcd78e7588bcfba2e47c4f5d2ef1f92820493251be0ff2d7c73b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
c504d1c627a188694475ab1745d063d9

SHA1
457bd300e7876d0a926ad28e8666ccc4fcc177c6

SHA256
7d2eb776f1a8d0e8d141fb1bd826fae16b71f14817aaa681d3f3d4274e3dfb9d

SHA512
1e91589560d5ff37047832b954a29ac6a6fc821c23abdda83355a1d10cccd345f66a934def820b8e5e2d470736e42a888c871022f749059c3b6ad8b52d7e6318

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
e67d412fde969b0c52e01dcb1d282a3b

SHA1
e3b0f942a255b282880f56d75df207926efd025f

SHA256
950c45ac02e3b8c81316e92714816d1f5c87608bc62bbb2f52e97522da2decc5

SHA512
3809afe119a816273fabb36e3e37d5395842a795d600ed4e4148ea9309b26a4bbcf0b01bbe2363ab6de8ef2e5eba712fa9ba8affc480e599945ce06260ef3ed9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Filesize
430B

MD5
2165ba5b56b9f6fbd8b8cfe5ec92ea9e

SHA1
263d5324f6ce0230befd807307a92738974a9da1

SHA256
68d693d6fbe9713fd3ed5436464c61660266261da70f506d2eafc61b92a0d0ab

SHA512
bb898299022fd7cb32af03e87a1bf63d1b1a72a522b198c34edd8881e31c6cffe7431e4792fe225e35df5ba77228f146d49a0372a73997574d07d02eb212e404

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
Filesize
434B

MD5
f5edb00421a0b0b8e35bfb289910caf2

SHA1
0f58268dd915c4f3eed91ee9efeb9321a565910b

SHA256
e14d00e05b4d10b606402388fce2e339126de857d23b5381909ffab7263102e7

SHA512
400c8ff21f06520d4f3ba99ed194ca44e7c364bf1e6ed5bb99e4c047be6166307d94c65cf7313c70b34b0579e1ecc8082820543987e31fdbca71489da8878133

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
be0bc5dcec73cf6a369ad8d370cf79d4

SHA1
627beb987135e727bc20f174ffe7bd4f974e477b

SHA256
bfad604449462dc068667db2e4394c6f64cf172bf6c5acc99af3da188fb098ff

SHA512
d31f111ca99304b6cc3130bda8ce21a2be790b0f45a4f0772362037256ea0bc98e584b733d2679d4da5d365fca63aaa188644de33b4246a4737a57b1389ad55b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
be0bc5dcec73cf6a369ad8d370cf79d4

SHA1
627beb987135e727bc20f174ffe7bd4f974e477b

SHA256
bfad604449462dc068667db2e4394c6f64cf172bf6c5acc99af3da188fb098ff

SHA512
d31f111ca99304b6cc3130bda8ce21a2be790b0f45a4f0772362037256ea0bc98e584b733d2679d4da5d365fca63aaa188644de33b4246a4737a57b1389ad55b

Download Submit
C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.8.0_351\Java3BillDevices.png
Filesize
11KB

MD5
b3c9f084b052e95aa3014e492d16bfa6

SHA1
0e33962b2191e7b1a5d85102cdf3c74fcd1254e4

SHA256
a68ddd67f6fcb0bbf1defa0778ee543e92c1074c442197ab623f733cc6285948

SHA512
06f51ac2962a0ec5f05ad6c90a2ba85b851d1fa2f0c079dc264fe930316cead959f68f6e34ff591b131867b482c266ac42400b06385dae712637ff0a90f902d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
5b967ec029ccb78304c6ca220f6966d5

SHA1
1f760a937ec0cc2cbc2847e02b4f49fd5b9ac7c2

SHA256
94d73f594f210bcc7d29e69de70327c40234b4115edf3fd500dbb2c879c425b3

SHA512
984a0fdfbbb448c9214b31f42ff8ddd894a67e0facc472ed07b7476f177d790c5a1a6860e2be3eaab5adf600bf4df22601624d95a28a6680312af6a5cf130768

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303281234081\additional_file0.tmp
Filesize
1.7MB

MD5
b386cdcb413405daa8219af8e4cbd318

SHA1
ce275ff8514fef0629c915a6ee7b5ac481b9043d

SHA256
408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e

SHA512
91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303281234081\opera_package
Filesize
86.9MB

MD5
6b7771354e081eb94cdbf7627799da4f

SHA1
199341a750443cc6e9b2b2fa1e657d0dd327711f

SHA256
494d1247e61eebf703a6eb19c14bde88edd2f85515fefa4f0465f43873e69aab

SHA512
33e781a102ba3f5c3b1895540bc9c43b78bf4f19af4b91ae0c765594f39d6569d1bad207b33f808426d8ebdcb00c419b7bb76bb050bae0bb843f96dd84355800

Download Submit
C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
Filesize
1.8MB

MD5
52e46b1adf9cd40428b41755df527bd4

SHA1
5f0bb9c9c14208851beb5c93d9268c16ab39dc07

SHA256
a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

SHA512
813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

Download Submit
C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
Filesize
1.8MB

MD5
52e46b1adf9cd40428b41755df527bd4

SHA1
5f0bb9c9c14208851beb5c93d9268c16ab39dc07

SHA256
a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

SHA512
813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab12E6.tmp
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2303281234076402236.dll
Filesize
4.6MB

MD5
674e177ac04e98ce48f4df0d4c440568

SHA1
b08fa2014573f0af48c06357da323e79399ef144

SHA256
8e1ac3c2a3aeb52e26794368c1adf5e7b330aa3bc27ac1669cb3aed64da8fe86

SHA512
5d99f5837ec50ca2f46a8e8cfbb055eeedbc28f7e63c49a901984f1c884e2a6d790e91542174dc2808b4ead30a6204912f5f98af1b562210494574eb2328d3e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar259F.tmp
Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6DD0.tmp
Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico
Filesize
116KB

MD5
e043a9cb014d641a56f50f9d9ac9a1b9

SHA1
61dc6aed3d0d1f3b8afe3d161410848c565247ed

SHA256
9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946

SHA512
4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe
Filesize
1.8MB

MD5
52e46b1adf9cd40428b41755df527bd4

SHA1
5f0bb9c9c14208851beb5c93d9268c16ab39dc07

SHA256
a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

SHA512
813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.PNG
Filesize
339B

MD5
bbdf2e8c0262e7e606d41ddbe5a3cd12

SHA1
acbb25f729af14b692ec9c8187a23b1a696f8e47

SHA256
d7c76896d206d977739556ad2d5811f7cf3117252afcd439a5aa0f2b645f6949

SHA512
0334fae3682889adbc18594b7917d8c93252a86bc04d08efc6860d5714ba4eb8aabc39c51e532c4aee57a938021540d2f2899781d9cd1de311036e1850a65067

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG104.PNG
Filesize
644B

MD5
38c12e1a54f8fd216ed3f13b36798cc6

SHA1
ccf1fe585d3374ebce4c1ec025e2d8ec39968a7c

SHA256
608924ba294590b5b706658d9aaa71b480ad9aa1b6797bbc5cf1632ac6c616b1

SHA512
0918af63f006d7fa04a3faeeb813e61c060316a126c4742a948a30f5b6ea368c3b8592011319dad3dbf8427dfcc095aa72f7b651d6fc31061f861f070447331b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG109.PNG
Filesize
2KB

MD5
03b1d78771eb279766efb2d9f2fa8463

SHA1
8f10e304fd65e58136ccd6ab012ffc594e6fb707

SHA256
eec16d2cb57e38b485b6a269e9c2554c1dfc3b70dec9f7bbddc2b62526b3d832

SHA512
ca51cbaf20e6f62eb6ec69555d259ef61828d3166d09106bcd335dd417ed30660af71e7fd8db6bd22bf134cc530e1a55ecdd2c307e64e8edb28af95299d66f5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.PNG
Filesize
280B

MD5
5a7901f7df307fba45b1c377f2c94ccc

SHA1
d6630cf733033cdfbda7af3213d49b32f5b06919

SHA256
d8471d5a5b4792c4b49e80b5cb22ef1e938dc3069b210646704f658548d7a9f8

SHA512
fc0036a7ed4b53edd72b91c4824919e6e8a82b5be1e82cdc134e267ef4792424124fb6ba5d7c86cf686910da0baba8453d7a6c12b39a5b4c0cb70658580f3bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG22.PNG
Filesize
1KB

MD5
46a65321aa1fce57d465c26e8b6eb392

SHA1
9efb9a3acd5b32556ea66398c74b014f91087559

SHA256
61df7a1f0367209668d4f0f6a285b8baff864d1341d382ebbc7fd4e71036b666

SHA512
094d69016f066ae835c71d7a950217b9ad09e8cd4d74131787203cae950e572c18213dc1ded139b1fa46c7f803cc15bf4f596c9d51aefe0d43850ae2865f3707

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.PNG
Filesize
281B

MD5
05d7bba3d6ac92766c4495b8928202a6

SHA1
50b65a8ba5ed2633e43929ee4bd58c95a91a3363

SHA256
4804f3c4fae714657fdb85e98244828acc6ac938505c2da1ed694ae7b58f2949

SHA512
1544d5cd6f85aaeeacd26f2deb9da9eb510226b41079ee78c4dede14386e5ea3446efdfd475bfbfa3a6846fa2ff23d64f4dad3a4ddd304e32de80e4d7bcbc600

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG45.PNG
Filesize
438B

MD5
09229c3bfb801177839a7c2e22e33a1b

SHA1
f679c05c4c7b2f3722069420c6d6481fc856e7aa

SHA256
cbf81d779b469942613297a3ca6c09d885e3b1d4aa952dc1994a7175fbfc7e3f

SHA512
503bfa063b29dda95f15da303f707e5b78a6bdb74662c222d8a8b7e3a33264016a66acdd9de44aea932e7cde80a43c2406ea6f0250d3df8e182217bc4a0a7ed7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG85.PNG
Filesize
43KB

MD5
667b0b54ee5ba0d1cb66190226596e46

SHA1
b8658b35e7cf44b24053e4d01d3b51233d6526f6

SHA256
3a9ab8c3640f1b40b33553d7d3dd3d15bd6e702ef510ec0b66a2f14aa744bf83

SHA512
9ccc773214a0074634be66801d81d7a593ab154351fdbd1b93f56ffa80cf824ee31ff2e13f26536d5f3096e90df43fa223080b4dc55340614b076c08ef976dcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG92.PNG
Filesize
1KB

MD5
5f84b4bf9384d9fea8faecb0ca1abc97

SHA1
71c514dcdc0ac966a4c072949fcfadc0150618a5

SHA256
fa6875692ce4824a5ea7b054e513a6d85351304ef327aa6d179482fad49b91ec

SHA512
61546cb94e9dd560e483d5ef912212116c20e18b989dcefa3a99444417061ad9038c0806d903ecc39c970ea6b225f80c9df3804a48a91bcd5b7e078cb878d6e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
Filesize
1.7MB

MD5
1bbf5dd0b6ca80e4c7c77495c3f33083

SHA1
e0520037e60eb641ec04d1e814394c9da0a6a862

SHA256
bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

SHA512
97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
Filesize
97KB

MD5
da1d0cd400e0b6ad6415fd4d90f69666

SHA1
de9083d2902906cacf57259cf581b1466400b799

SHA256
7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

SHA512
f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Filesize
1.3MB

MD5
111dddf2f308abc2a8f7555d5f642751

SHA1
11e6cdccbf29a71a97011b9444cf20c83ad8b57b

SHA256
c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

SHA512
11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Filesize
1.3MB

MD5
111dddf2f308abc2a8f7555d5f642751

SHA1
11e6cdccbf29a71a97011b9444cf20c83ad8b57b

SHA256
c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

SHA512
11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Filesize
1.3MB

MD5
111dddf2f308abc2a8f7555d5f642751

SHA1
11e6cdccbf29a71a97011b9444cf20c83ad8b57b

SHA256
c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

SHA512
11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat
Filesize
108KB

MD5
aec508468d53ab8d55f5b4beb82c347d

SHA1
477d1ffb28834243f5811a4a2a54b4f0ca240120

SHA256
ebee84e34e221ad822486432333bad9e6357af2fb0d9651cc61c7fab8ec9b5bf

SHA512
26a0278af2a9e75ef966bc3f7f40d7669204c2004a043adaad102ef440caa6282e69372ca0c3c7d39a8450691d528c2dc77a4386bfb0c6e5a2a76c3fef900fbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
Filesize
1.3MB

MD5
5027f3112ac2d6f764769102a9145c8e

SHA1
a369a0e1d4ace1a8d66908aa43543bea03c76f5b

SHA256
d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

SHA512
181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
Filesize
1.3MB

MD5
5027f3112ac2d6f764769102a9145c8e

SHA1
a369a0e1d4ace1a8d66908aa43543bea03c76f5b

SHA256
d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

SHA512
181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
Filesize
1.3MB

MD5
5027f3112ac2d6f764769102a9145c8e

SHA1
a369a0e1d4ace1a8d66908aa43543bea03c76f5b

SHA256
d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

SHA512
181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jds7170788.tmp\jre-windows.exe
Filesize
84.1MB

MD5
dfcfc788d67437530a50177164db42b0

SHA1
2d9ed0dc5671a358186dcf83abb74bfe39c40e9f

SHA256
a90318bae7d99da633d9cac8ce322120d087e7b6f5eec0d1d0d7f9413fdd4dc1

SHA512
dbdfd02528c9f0e506232e8640a8602fade0d05f4139368187300ea2d537e41d2d167655ded30d938bd445a21c776a3c3721f8db4d3f03e3c06807a84cf232e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
Filesize
84.5MB

MD5
7542ec421a2f6e90751e8b64c22e0542

SHA1
d207d221a28ede5c2c8415f82c555989aa7068ba

SHA256
188ca8ecc44de1b7f602e883c3054dc392792c3631bf362b1bc4f3e1dba323e6

SHA512
8987bf8aa1b401815fa9850e56954db6015bdd06ce78b65ba435724582ffa615dee4e1452fa237c53257dca8ee97b469d01c27757a5f070ce6f807a4f81094bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\jusched.log
Filesize
3KB

MD5
4eba818420fa2ad11341643333240027

SHA1
4b902bffa2526bbf8a5097773099751a4adf3a06

SHA256
693796c5ba5c20dcc49aac6dceee12cafb070b2f201252ac4b4158ce04a2a862

SHA512
7443df4114d2ec6ae09f4799d5b53ffb6e647d1a70aff2571930dd9fdf110a1dce3dc7b8d9b76d055186c67fe16e7373bd61e01d2ad2820dbf9053680add43a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\jusched.log
Filesize
3KB

MD5
4eba818420fa2ad11341643333240027

SHA1
4b902bffa2526bbf8a5097773099751a4adf3a06

SHA256
693796c5ba5c20dcc49aac6dceee12cafb070b2f201252ac4b4158ce04a2a862

SHA512
7443df4114d2ec6ae09f4799d5b53ffb6e647d1a70aff2571930dd9fdf110a1dce3dc7b8d9b76d055186c67fe16e7373bd61e01d2ad2820dbf9053680add43a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\jusched.log
Filesize
12KB

MD5
c4793038f9dbd888cbec9bd890cc84f7

SHA1
24168b09743dbb29227dd5422aa0c7c8d0884c06

SHA256
3495b4a4c62530e3061fdf8f2359ff3ada22d7065302817ff5a661bf65d90306

SHA512
efa514562356d3d7e8c9247770ca7264da2b31727e2fbcfcfba59a5f1798f66d753c028f8d028fbbf53b4d8f764e2047f88736985fc65d25ff0f1aa60a0a0a34

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
5b967ec029ccb78304c6ca220f6966d5

SHA1
1f760a937ec0cc2cbc2847e02b4f49fd5b9ac7c2

SHA256
94d73f594f210bcc7d29e69de70327c40234b4115edf3fd500dbb2c879c425b3

SHA512
984a0fdfbbb448c9214b31f42ff8ddd894a67e0facc472ed07b7476f177d790c5a1a6860e2be3eaab5adf600bf4df22601624d95a28a6680312af6a5cf130768

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
5b967ec029ccb78304c6ca220f6966d5

SHA1
1f760a937ec0cc2cbc2847e02b4f49fd5b9ac7c2

SHA256
94d73f594f210bcc7d29e69de70327c40234b4115edf3fd500dbb2c879c425b3

SHA512
984a0fdfbbb448c9214b31f42ff8ddd894a67e0facc472ed07b7476f177d790c5a1a6860e2be3eaab5adf600bf4df22601624d95a28a6680312af6a5cf130768

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
5b967ec029ccb78304c6ca220f6966d5

SHA1
1f760a937ec0cc2cbc2847e02b4f49fd5b9ac7c2

SHA256
94d73f594f210bcc7d29e69de70327c40234b4115edf3fd500dbb2c879c425b3

SHA512
984a0fdfbbb448c9214b31f42ff8ddd894a67e0facc472ed07b7476f177d790c5a1a6860e2be3eaab5adf600bf4df22601624d95a28a6680312af6a5cf130768

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
5b967ec029ccb78304c6ca220f6966d5

SHA1
1f760a937ec0cc2cbc2847e02b4f49fd5b9ac7c2

SHA256
94d73f594f210bcc7d29e69de70327c40234b4115edf3fd500dbb2c879c425b3

SHA512
984a0fdfbbb448c9214b31f42ff8ddd894a67e0facc472ed07b7476f177d790c5a1a6860e2be3eaab5adf600bf4df22601624d95a28a6680312af6a5cf130768

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
5b967ec029ccb78304c6ca220f6966d5

SHA1
1f760a937ec0cc2cbc2847e02b4f49fd5b9ac7c2

SHA256
94d73f594f210bcc7d29e69de70327c40234b4115edf3fd500dbb2c879c425b3

SHA512
984a0fdfbbb448c9214b31f42ff8ddd894a67e0facc472ed07b7476f177d790c5a1a6860e2be3eaab5adf600bf4df22601624d95a28a6680312af6a5cf130768

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
5b967ec029ccb78304c6ca220f6966d5

SHA1
1f760a937ec0cc2cbc2847e02b4f49fd5b9ac7c2

SHA256
94d73f594f210bcc7d29e69de70327c40234b4115edf3fd500dbb2c879c425b3

SHA512
984a0fdfbbb448c9214b31f42ff8ddd894a67e0facc472ed07b7476f177d790c5a1a6860e2be3eaab5adf600bf4df22601624d95a28a6680312af6a5cf130768

Download Submit
C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
Filesize
602B

MD5
0e8bbf343a54a440df105bbbdaf99729

SHA1
6e7235f35d72277f272040d9bfc8582b0873d153

SHA256
8105d38f5985b43e1f7eea166285616fa62fe83d15b37507ceca25453131650c

SHA512
159d483503114e3b181485754ce3c0138dc4b196a6f5160359b045f39e61770cf12b1fb69683e569d94be25bada9f6dd516389356b6d6e108203741a70654450

Download Submit
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
Filesize
6.3MB

MD5
f08d9bbc61cff8e8c3504524c3220bef

SHA1
b4268c667469620bb528c04eaa819d508159b398

SHA256
2c4d8b48344ae221e349e525ac16eb364ffb5ab8deae80c7caa28dd5967cabdb

SHA512
a64a03d959487399fb57e1bd062c0e9f88a17ff9b3ad15e6b96a4b7332341d0fc9186ef99b2ab9bdcfa51864f21d08bce48479202c01d15470916e90fb09fef4

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.BMP
Filesize
451KB

MD5
0b445ace8798426e7185f52b7b7b6d1e

SHA1
7a77b46e0848cc9b32283ccb3f91a18c0934c079

SHA256
2bbf97ccba3f87d469eac909c4ce8a3f13ed29c8f31b611e7d5cf89a0619eda6

SHA512
51523d5b711481293305465a3a3c6a3a50dca984cdc8cca1f4c44f3c21bfa430cd9aac1a8782d9605e6954cbafb307beb6b1a52e9785de1bc3f71067d80c6b6e

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG11.PNG
Filesize
1KB

MD5
a7abdc35d821b444be3ff4c2c076b9df

SHA1
1b8b0bef1a10a8b22d32a288efbd32b25dbf46fc

SHA256
7fae8a0524f3bb30ef060439eefd7660ff67c30b9c22910e124cc1275a55c2df

SHA512
69b4c2acd15c8dff520c8d1031a344a8cc762440b4eff3b43934709fec2402d558e9bfddd828f0a6dbff45813d57e1d587a65f7d8a79f724729317d87aa16003

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG29.PNG
Filesize
1KB

MD5
e6663f52235742a1dc27b96241538ff5

SHA1
37234351ade7563f9dc8fb05eba0a13d3fd65a7d

SHA256
26a99701ea3b890bc5e09dab86f5ed6db99a4d62db5b35b55e2b5a3598478e49

SHA512
090719e1745c1e23b7ac623d6a102797c206e03529e7706af7e2cd35b17352750587a5689997a923134ebe988e94843da8deab770bca60935f08964fa7ce6e2b

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNG
Filesize
45KB

MD5
2799f9daca46770a871ce1b5eed32e7c

SHA1
a2792f571210a7f38cdbe49391017300ee7b1ce4

SHA256
fc22676f5b6cdae17b78ddfd16bb070687516fbc827a7edd0541f3a32d85c9e9

SHA512
c41f2e4c4ca59d6f9d11fac11296ab87f1b508b5d64e5db7762f2f6dd387aa96206b2b0fa127f17c0b8c24a0b56e81af12d5937474a450222d9c4416c1acb16a

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG41.PNG
Filesize
457B

MD5
ce17d7ce06488f394ce124f17d5acafc

SHA1
8a5dceae9ea369b686123c8f940bb0ea07870ffa

SHA256
c4b04568930f03979d71f48a57b9ad06b4cdf687272f6753ff662006e8e6237f

SHA512
c33f1370213cabd1b84c936f1ac14f9bcc83bc03a633bbe25efe1e906bcee515d0e615c86b7ee3b34404dd1d95ce74d1a00908de8cdacbf9961de3f1ceb8362b

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG42.PNG
Filesize
352B

MD5
1f5c8939031a7f93762862cfc88a8e56

SHA1
6dc4df87344db0ddf09c777e7a80d1b5661559b8

SHA256
14be26e969eb15ef7e76e0ad02d8aa0516c5391e8b09dba0a9a6c5f57ae24aba

SHA512
de45d700c86329c704777917863fd1ddeca90d2bed67a72794164882bf15725ce83c7733f664ee0a2af7df54a6be2def729d19237fb2c434115396ac126ff47f

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG46.PNG
Filesize
206B

MD5
d8a095202e08fa1ac2578982e9a486db

SHA1
397ffc8af43ac18466b8df245b4faa6b278659e6

SHA256
28fed2b9a3cbde34da4b6b5d1af2d2844437d21f6dec85b3ca2faa5cd3b512e5

SHA512
ac751386a0004e335f4e5f4ea24bf6a474478c8a7ca54d018734e7cd44b8e9a0eb262b00fe1219b1c62c96b018b08ba6b1056d3a13e64b55c7e70d748a6ae9c6

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG54.PNG
Filesize
2KB

MD5
6c6f8e031e196f2f57c70ea411091c28

SHA1
266c1b4feb60f06387c30ec810c52b5a570706b9

SHA256
ea64efad0cabdb9300ba83804b7b98e36393e1626a684ce0abd38d1ed1d34e90

SHA512
f4018b1a0bc65390cb96581dbf4f4032317304cbaf8526ef1cbb2f700ab501859b007c13989f5df81247d959c35e721cfceb5ff6c95cbf2cd198a74198d68a58

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG66.PNG
Filesize
41KB

MD5
1557c08e187b7783083e0b80051fd321

SHA1
2c6ee47799d713e88fd589609b81912a4522044e

SHA256
0c0e74dd07c45833a5dd7ba931e5d528eb16334defdd06171df2f632d6e47842

SHA512
485f69b3878b2bd7fdf52ad020dde2cbc34dd1970aaa4e5eb8f8618f6091b5b827b428447859499c3d61ea9cde2edcbb97c8fb0560cd0aaff50027c0f97ee6f3

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG73.PNG
Filesize
1KB

MD5
44411a40791606c0445226eff31e43ee

SHA1
f482762866ad847b10b11a3108709cb554d1f9f1

SHA256
2205b4c552bcc49ffa7964b61b6c20dc4bbad14c941e8f695db1dbb6719349e4

SHA512
e5e4e67fc3a5564e7cc5c267f816362558439d0c3c33f6ad52d2f4ebfeb01f0dac4f6e4b72fb6da53ea343d306d4cc662cde54c149d7f8a4767c2f8a57e84066

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG8.BMP
Filesize
451KB

MD5
d2b43decae0a14deb90423bfb687dc63

SHA1
c191705fcb927d476d4fc639860bd52e324a274c

SHA256
3266fb3a33a97fac7d71652129865c3d0dd06e70af6ed5a3b2506d842eb69e70

SHA512
3cd903b0c4590e25502cd0f91b678c1e798989211e174d5a6dbfd52b343a426b867204979cc078a4919d63a4c4401c4f8eaa295227cec0ccc043c7e285d3d2df

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
Filesize
33KB

MD5
23ab96644cb4ee20c7cce84ac3c354e2

SHA1
d433d070373a4bd45b19331d28d7e652a9c876af

SHA256
dd9f6620a3d77fe08fa3814eca83fa1bac9e37e404ae19e169087b2d042fa6f0

SHA512
5c9c8f0f59f1e6ea98999c424198b77fa7b2151e0dbbd16e7b2a3e6ff2eb61422bd79d2b5d28ef442cce2ba9c9f37e079963701bd38e84b82fc1cdfe753a5840

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
Filesize
18KB

MD5
8522ec7139f115ce532fd162251f04e7

SHA1
b20109cd0fcd7bb1e65205b6c94c7a087ee1a51e

SHA256
0674ec1f540accc3c0818a2e66b0f05753958da9548d0c6645208cf8afcab896

SHA512
7dfd044ccae7e0e66d5741b6d77a319ff63a4573dd81f4b1ee57964834f8221f96e5be88fcc75323017f2875939468cdb32d6dc30d27faedf460456c1c16d29c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\1OW082MC.txt
Filesize
869B

MD5
0eb60a7980f931b5e6dfeab998f8bf46

SHA1
8d04f235312ac35dae24062152cb9b6a223656bb

SHA256
69696ca499259824ec5600616640dfacee6136f003c83398c97a5cfa86c1922e

SHA512
9910422834be0e5fd0146d0a6ac1cd80c022ececa3e8ac468b1e88b867d6127102b9b7a26e3ebcc47990b5a1513703c3b29e3f02f77ae7e58b7e152941b2421e

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Filesize
40B

MD5
10bd6892c094d7e09a1eac78a734dab3

SHA1
ec1cbac01cc6675e484db6873a9efc9ab6c782a5

SHA256
3537f154076cf648e2d77b727dab66b2828b10503846e2c6b03469c7b49aaa97

SHA512
5f5f63942895fc320633abde78af7f4943cf91bfdeb4a71dd2fa1e0c50a3afd739fac0a5053ccfd56549bb67ed5b9f34c3a79814b2d23fcbf2040cb361f4dadb

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Filesize
40B

MD5
10bd6892c094d7e09a1eac78a734dab3

SHA1
ec1cbac01cc6675e484db6873a9efc9ab6c782a5

SHA256
3537f154076cf648e2d77b727dab66b2828b10503846e2c6b03469c7b49aaa97

SHA512
5f5f63942895fc320633abde78af7f4943cf91bfdeb4a71dd2fa1e0c50a3afd739fac0a5053ccfd56549bb67ed5b9f34c3a79814b2d23fcbf2040cb361f4dadb

Download Submit
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
5b967ec029ccb78304c6ca220f6966d5

SHA1
1f760a937ec0cc2cbc2847e02b4f49fd5b9ac7c2

SHA256
94d73f594f210bcc7d29e69de70327c40234b4115edf3fd500dbb2c879c425b3

SHA512
984a0fdfbbb448c9214b31f42ff8ddd894a67e0facc472ed07b7476f177d790c5a1a6860e2be3eaab5adf600bf4df22601624d95a28a6680312af6a5cf130768

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
Filesize
1.8MB

MD5
52e46b1adf9cd40428b41755df527bd4

SHA1
5f0bb9c9c14208851beb5c93d9268c16ab39dc07

SHA256
a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

SHA512
813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
Filesize
1.8MB

MD5
52e46b1adf9cd40428b41755df527bd4

SHA1
5f0bb9c9c14208851beb5c93d9268c16ab39dc07

SHA256
a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

SHA512
813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
Filesize
1.8MB

MD5
52e46b1adf9cd40428b41755df527bd4

SHA1
5f0bb9c9c14208851beb5c93d9268c16ab39dc07

SHA256
a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

SHA512
813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
Filesize
1.8MB

MD5
52e46b1adf9cd40428b41755df527bd4

SHA1
5f0bb9c9c14208851beb5c93d9268c16ab39dc07

SHA256
a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

SHA512
813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
Filesize
1.8MB

MD5
52e46b1adf9cd40428b41755df527bd4

SHA1
5f0bb9c9c14208851beb5c93d9268c16ab39dc07

SHA256
a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

SHA512
813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
Filesize
1.8MB

MD5
52e46b1adf9cd40428b41755df527bd4

SHA1
5f0bb9c9c14208851beb5c93d9268c16ab39dc07

SHA256
a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

SHA512
813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_230328123403912984.dll
Filesize
4.6MB

MD5
674e177ac04e98ce48f4df0d4c440568

SHA1
b08fa2014573f0af48c06357da323e79399ef144

SHA256
8e1ac3c2a3aeb52e26794368c1adf5e7b330aa3bc27ac1669cb3aed64da8fe86

SHA512
5d99f5837ec50ca2f46a8e8cfbb055eeedbc28f7e63c49a901984f1c884e2a6d790e91542174dc2808b4ead30a6204912f5f98af1b562210494574eb2328d3e4

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_230328123406018980.dll
Filesize
4.6MB

MD5
674e177ac04e98ce48f4df0d4c440568

SHA1
b08fa2014573f0af48c06357da323e79399ef144

SHA256
8e1ac3c2a3aeb52e26794368c1adf5e7b330aa3bc27ac1669cb3aed64da8fe86

SHA512
5d99f5837ec50ca2f46a8e8cfbb055eeedbc28f7e63c49a901984f1c884e2a6d790e91542174dc2808b4ead30a6204912f5f98af1b562210494574eb2328d3e4

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_2303281234076402236.dll
Filesize
4.6MB

MD5
674e177ac04e98ce48f4df0d4c440568

SHA1
b08fa2014573f0af48c06357da323e79399ef144

SHA256
8e1ac3c2a3aeb52e26794368c1adf5e7b330aa3bc27ac1669cb3aed64da8fe86

SHA512
5d99f5837ec50ca2f46a8e8cfbb055eeedbc28f7e63c49a901984f1c884e2a6d790e91542174dc2808b4ead30a6204912f5f98af1b562210494574eb2328d3e4

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_2303281234084202432.dll
Filesize
4.6MB

MD5
674e177ac04e98ce48f4df0d4c440568

SHA1
b08fa2014573f0af48c06357da323e79399ef144

SHA256
8e1ac3c2a3aeb52e26794368c1adf5e7b330aa3bc27ac1669cb3aed64da8fe86

SHA512
5d99f5837ec50ca2f46a8e8cfbb055eeedbc28f7e63c49a901984f1c884e2a6d790e91542174dc2808b4ead30a6204912f5f98af1b562210494574eb2328d3e4

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_2303281234086232496.dll
Filesize
4.6MB

MD5
674e177ac04e98ce48f4df0d4c440568

SHA1
b08fa2014573f0af48c06357da323e79399ef144

SHA256
8e1ac3c2a3aeb52e26794368c1adf5e7b330aa3bc27ac1669cb3aed64da8fe86

SHA512
5d99f5837ec50ca2f46a8e8cfbb055eeedbc28f7e63c49a901984f1c884e2a6d790e91542174dc2808b4ead30a6204912f5f98af1b562210494574eb2328d3e4

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
Filesize
1.7MB

MD5
1bbf5dd0b6ca80e4c7c77495c3f33083

SHA1
e0520037e60eb641ec04d1e814394c9da0a6a862

SHA256
bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

SHA512
97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
Filesize
97KB

MD5
da1d0cd400e0b6ad6415fd4d90f69666

SHA1
de9083d2902906cacf57259cf581b1466400b799

SHA256
7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

SHA512
f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Filesize
1.3MB

MD5
111dddf2f308abc2a8f7555d5f642751

SHA1
11e6cdccbf29a71a97011b9444cf20c83ad8b57b

SHA256
c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

SHA512
11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Filesize
1.3MB

MD5
111dddf2f308abc2a8f7555d5f642751

SHA1
11e6cdccbf29a71a97011b9444cf20c83ad8b57b

SHA256
c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

SHA512
11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Filesize
1.3MB

MD5
111dddf2f308abc2a8f7555d5f642751

SHA1
11e6cdccbf29a71a97011b9444cf20c83ad8b57b

SHA256
c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

SHA512
11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Filesize
1.3MB

MD5
111dddf2f308abc2a8f7555d5f642751

SHA1
11e6cdccbf29a71a97011b9444cf20c83ad8b57b

SHA256
c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

SHA512
11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Filesize
1.3MB

MD5
111dddf2f308abc2a8f7555d5f642751

SHA1
11e6cdccbf29a71a97011b9444cf20c83ad8b57b

SHA256
c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

SHA512
11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
Filesize
1.3MB

MD5
5027f3112ac2d6f764769102a9145c8e

SHA1
a369a0e1d4ace1a8d66908aa43543bea03c76f5b

SHA256
d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

SHA512
181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
Filesize
1.3MB

MD5
5027f3112ac2d6f764769102a9145c8e

SHA1
a369a0e1d4ace1a8d66908aa43543bea03c76f5b

SHA256
d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

SHA512
181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
Filesize
1.3MB

MD5
5027f3112ac2d6f764769102a9145c8e

SHA1
a369a0e1d4ace1a8d66908aa43543bea03c76f5b

SHA256
d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

SHA512
181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
Filesize
1.3MB

MD5
5027f3112ac2d6f764769102a9145c8e

SHA1
a369a0e1d4ace1a8d66908aa43543bea03c76f5b

SHA256
d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

SHA512
181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
Filesize
1.3MB

MD5
5027f3112ac2d6f764769102a9145c8e

SHA1
a369a0e1d4ace1a8d66908aa43543bea03c76f5b

SHA256
d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

SHA512
181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
\Users\Admin\AppData\Local\Temp\jds7170788.tmp\jre-windows.exe
Filesize
84.1MB

MD5
dfcfc788d67437530a50177164db42b0

SHA1
2d9ed0dc5671a358186dcf83abb74bfe39c40e9f

SHA256
a90318bae7d99da633d9cac8ce322120d087e7b6f5eec0d1d0d7f9413fdd4dc1

SHA512
dbdfd02528c9f0e506232e8640a8602fade0d05f4139368187300ea2d537e41d2d167655ded30d938bd445a21c776a3c3721f8db4d3f03e3c06807a84cf232e3

Download Submit
\Users\Admin\AppData\Local\Temp\jre-windows.exe
Filesize
84.5MB

MD5
7542ec421a2f6e90751e8b64c22e0542

SHA1
d207d221a28ede5c2c8415f82c555989aa7068ba

SHA256
188ca8ecc44de1b7f602e883c3054dc392792c3631bf362b1bc4f3e1dba323e6

SHA512
8987bf8aa1b401815fa9850e56954db6015bdd06ce78b65ba435724582ffa615dee4e1452fa237c53257dca8ee97b469d01c27757a5f070ce6f807a4f81094bc

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
5b967ec029ccb78304c6ca220f6966d5

SHA1
1f760a937ec0cc2cbc2847e02b4f49fd5b9ac7c2

SHA256
94d73f594f210bcc7d29e69de70327c40234b4115edf3fd500dbb2c879c425b3

SHA512
984a0fdfbbb448c9214b31f42ff8ddd894a67e0facc472ed07b7476f177d790c5a1a6860e2be3eaab5adf600bf4df22601624d95a28a6680312af6a5cf130768

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
5b967ec029ccb78304c6ca220f6966d5

SHA1
1f760a937ec0cc2cbc2847e02b4f49fd5b9ac7c2

SHA256
94d73f594f210bcc7d29e69de70327c40234b4115edf3fd500dbb2c879c425b3

SHA512
984a0fdfbbb448c9214b31f42ff8ddd894a67e0facc472ed07b7476f177d790c5a1a6860e2be3eaab5adf600bf4df22601624d95a28a6680312af6a5cf130768

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
5b967ec029ccb78304c6ca220f6966d5

SHA1
1f760a937ec0cc2cbc2847e02b4f49fd5b9ac7c2

SHA256
94d73f594f210bcc7d29e69de70327c40234b4115edf3fd500dbb2c879c425b3

SHA512
984a0fdfbbb448c9214b31f42ff8ddd894a67e0facc472ed07b7476f177d790c5a1a6860e2be3eaab5adf600bf4df22601624d95a28a6680312af6a5cf130768

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
5b967ec029ccb78304c6ca220f6966d5

SHA1
1f760a937ec0cc2cbc2847e02b4f49fd5b9ac7c2

SHA256
94d73f594f210bcc7d29e69de70327c40234b4115edf3fd500dbb2c879c425b3

SHA512
984a0fdfbbb448c9214b31f42ff8ddd894a67e0facc472ed07b7476f177d790c5a1a6860e2be3eaab5adf600bf4df22601624d95a28a6680312af6a5cf130768

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
5b967ec029ccb78304c6ca220f6966d5

SHA1
1f760a937ec0cc2cbc2847e02b4f49fd5b9ac7c2

SHA256
94d73f594f210bcc7d29e69de70327c40234b4115edf3fd500dbb2c879c425b3

SHA512
984a0fdfbbb448c9214b31f42ff8ddd894a67e0facc472ed07b7476f177d790c5a1a6860e2be3eaab5adf600bf4df22601624d95a28a6680312af6a5cf130768

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
5b967ec029ccb78304c6ca220f6966d5

SHA1
1f760a937ec0cc2cbc2847e02b4f49fd5b9ac7c2

SHA256
94d73f594f210bcc7d29e69de70327c40234b4115edf3fd500dbb2c879c425b3

SHA512
984a0fdfbbb448c9214b31f42ff8ddd894a67e0facc472ed07b7476f177d790c5a1a6860e2be3eaab5adf600bf4df22601624d95a28a6680312af6a5cf130768

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
5b967ec029ccb78304c6ca220f6966d5

SHA1
1f760a937ec0cc2cbc2847e02b4f49fd5b9ac7c2

SHA256
94d73f594f210bcc7d29e69de70327c40234b4115edf3fd500dbb2c879c425b3

SHA512
984a0fdfbbb448c9214b31f42ff8ddd894a67e0facc472ed07b7476f177d790c5a1a6860e2be3eaab5adf600bf4df22601624d95a28a6680312af6a5cf130768

Download Submit
memory/856-387-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/856-371-0x0000000000A50000-0x0000000000E38000-memory.dmp

Filesize
3.9MB

Download
memory/856-1730-0x0000000000A50000-0x0000000000E38000-memory.dmp

Filesize
3.9MB

Download
memory/856-367-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/856-75-0x0000000000A50000-0x0000000000E38000-memory.dmp

Filesize
3.9MB

Download
memory/856-1045-0x0000000000A50000-0x0000000000E38000-memory.dmp

Filesize
3.9MB

Download
memory/856-415-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/856-368-0x0000000000930000-0x0000000000933000-memory.dmp

Filesize
12KB

Download
memory/856-369-0x0000000000A50000-0x0000000000E38000-memory.dmp

Filesize
3.9MB

Download
memory/856-1451-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/856-386-0x0000000000A50000-0x0000000000E38000-memory.dmp

Filesize
3.9MB

Download
memory/856-1449-0x0000000000A50000-0x0000000000E38000-memory.dmp

Filesize
3.9MB

Download
memory/856-482-0x0000000003310000-0x0000000003320000-memory.dmp

Filesize
64KB

Download
memory/856-414-0x0000000000A50000-0x0000000000E38000-memory.dmp

Filesize
3.9MB

Download
memory/856-1434-0x0000000000A50000-0x0000000000E38000-memory.dmp

Filesize
3.9MB

Download
memory/856-1435-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/856-1439-0x0000000003310000-0x0000000003320000-memory.dmp

Filesize
64KB

Download
memory/856-389-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/980-1277-0x0000000000BE0000-0x0000000001118000-memory.dmp

Filesize
5.2MB

Download
memory/984-1357-0x0000000003A50000-0x0000000003F88000-memory.dmp

Filesize
5.2MB

Download
memory/984-598-0x0000000000BE0000-0x0000000001118000-memory.dmp

Filesize
5.2MB

Download
memory/984-1214-0x0000000002AB0000-0x0000000002FE8000-memory.dmp

Filesize
5.2MB

Download
memory/984-1408-0x0000000003EE0000-0x0000000004418000-memory.dmp

Filesize
5.2MB

Download
memory/1028-483-0x0000000002C20000-0x0000000003008000-memory.dmp

Filesize
3.9MB

Download
memory/1028-1440-0x0000000002C20000-0x0000000003008000-memory.dmp

Filesize
3.9MB

Download
memory/1028-485-0x0000000002C20000-0x0000000003008000-memory.dmp

Filesize
3.9MB

Download
memory/1028-484-0x0000000002C20000-0x0000000003008000-memory.dmp

Filesize
3.9MB

Download
memory/1252-487-0x0000000001300000-0x00000000016E8000-memory.dmp

Filesize
3.9MB

Download
memory/1252-1506-0x0000000001300000-0x00000000016E8000-memory.dmp

Filesize
3.9MB

Download
memory/1252-545-0x0000000001100000-0x0000000001110000-memory.dmp

Filesize
64KB

Download
memory/1252-1416-0x0000000001300000-0x00000000016E8000-memory.dmp

Filesize
3.9MB

Download
memory/1252-570-0x0000000005610000-0x0000000005B48000-memory.dmp

Filesize
5.2MB

Download
memory/1252-580-0x0000000005610000-0x0000000005B48000-memory.dmp

Filesize
5.2MB

Download
memory/1252-582-0x0000000005610000-0x0000000005B48000-memory.dmp

Filesize
5.2MB

Download
memory/1252-591-0x0000000005610000-0x0000000005B48000-memory.dmp

Filesize
5.2MB

Download
memory/1252-1445-0x0000000001100000-0x0000000001110000-memory.dmp

Filesize
64KB

Download
memory/1252-1447-0x0000000005610000-0x0000000005B48000-memory.dmp

Filesize
5.2MB

Download
memory/1396-74-0x0000000002C90000-0x0000000003078000-memory.dmp

Filesize
3.9MB

Download
memory/1396-73-0x0000000002C90000-0x0000000003078000-memory.dmp

Filesize
3.9MB

Download
memory/1396-72-0x0000000002C90000-0x0000000003078000-memory.dmp

Filesize
3.9MB

Download
memory/1396-71-0x0000000002C90000-0x0000000003078000-memory.dmp

Filesize
3.9MB

Download
memory/2236-1282-0x0000000001380000-0x00000000018B8000-memory.dmp

Filesize
5.2MB

Download
memory/2432-1409-0x0000000000BE0000-0x0000000001118000-memory.dmp

Filesize
5.2MB

Download
memory/2432-1410-0x0000000002A10000-0x0000000002F48000-memory.dmp

Filesize
5.2MB

Download
memory/2496-1411-0x0000000000BE0000-0x0000000001118000-memory.dmp

Filesize
5.2MB

Download