Malware Analysis Report

2024-09-22 06:22

Sample ID 230330-vxsqcsde77
Target TLauncher-2.879-Installer-1.0.9.exe
SHA256 42a309cea201b01a1a135fd651fcbec0d079368ed34d5567d3cf3a3811b47266
Tags
bazarbackdoor backdoor discovery upx spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

42a309cea201b01a1a135fd651fcbec0d079368ed34d5567d3cf3a3811b47266

Threat Level: Known bad

The file TLauncher-2.879-Installer-1.0.9.exe was found to be: Known bad.

Malicious Activity Summary

bazarbackdoor backdoor discovery upx spyware stealer

BazarBackdoor

Bazar/Team9 Backdoor payload

Blocklisted process makes network request

Downloads MZ/PE file

Loads dropped DLL

UPX packed file

Checks computer location settings

Executes dropped EXE

Reads user/profile data of web browsers

Checks installed software on the system

Enumerates connected drives

Drops file in Windows directory

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Modifies system certificate store

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Modifies Internet Explorer settings

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK Matrix V6

Analysis: static1

Detonation Overview

Reported

2023-03-30 17:22

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-03-30 17:22

Reported

2023-03-30 17:26

Platform

win7-20230220-en

Max time kernel

145s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe"

Signatures

BazarBackdoor

backdoor bazarbackdoor

Bazar/Team9 Backdoor payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A

Downloads MZ/PE file

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jre-windows.exe N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\F: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Installer\6e1ef7.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\6e1ef7.msi C:\Windows\system32\msiexec.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1740 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 1740 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 1740 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 1740 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 1740 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 1740 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 1740 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 1584 wrote to memory of 468 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
PID 1584 wrote to memory of 468 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
PID 1584 wrote to memory of 468 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
PID 1584 wrote to memory of 468 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
PID 1584 wrote to memory of 468 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
PID 1584 wrote to memory of 468 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
PID 1584 wrote to memory of 468 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
PID 468 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
PID 468 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
PID 468 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
PID 468 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
PID 468 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
PID 468 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
PID 468 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
PID 1584 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
PID 1584 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
PID 1584 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
PID 1584 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
PID 1788 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\jre-windows.exe C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe
PID 1788 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\jre-windows.exe C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe
PID 1788 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\jre-windows.exe C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe

Processes

C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe

"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe"

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe" "__IRCT:3" "__IRTSS:23652905" "__IRSID:S-1-5-21-3499517378-2376672570-1134980332-1000"

C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

"C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816850 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:1841947" "__IRSID:S-1-5-21-3499517378-2376672570-1134980332-1000"

C:\Users\Admin\AppData\Local\Temp\jre-windows.exe

"C:\Users\Admin\AppData\Local\Temp\jre-windows.exe" STATIC=1

C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe

"C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe" "STATIC=1"

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\system32\MsiExec.exe

C:\Windows\system32\MsiExec.exe -Embedding F1DC5415B6A7248689A70C6E2447DCC2

C:\Program Files\Java\jre1.8.0_351\installer.exe

"C:\Program Files\Java\jre1.8.0_351\installer.exe" /s INSTALLDIR="C:\Program Files\Java\jre1.8.0_351\\" STATIC=1 INSTALL_SILENT=1 REPAIRMODE=0 ProductCode={26A24AE4-039D-4CA4-87B4-2F64180351F0}

Network

Country Destination Domain Proto
US 8.8.8.8:53 dl2.tlauncher.org udp
US 104.20.234.70:443 dl2.tlauncher.org tcp
US 8.8.8.8:53 tlauncher.org udp
US 104.20.234.70:443 tlauncher.org tcp
US 8.8.8.8:53 javadl.oracle.com udp
NL 104.98.135.185:80 javadl.oracle.com tcp
NL 104.98.135.185:443 javadl.oracle.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 sdlc-esd.oracle.com udp
NL 173.223.112.78:443 sdlc-esd.oracle.com tcp
US 8.8.8.8:53 javadl-esd-secure.oracle.com udp
NL 104.98.135.185:443 javadl-esd-secure.oracle.com tcp
US 8.8.8.8:53 rps-svcs.oracle.com udp
NL 104.98.135.185:443 rps-svcs.oracle.com tcp

Files

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 9597a91c491d87dfb8209de6b878fe8b
SHA1 da77262030402d701d697c65c7d60d70ff8af4be
SHA256 81fdafeef0c0e4c41a687b3072a86efc96a7d5df4c015d66ba2016e065544208
SHA512 b76480193c755e6d83ec7c257d3efe6800fb8f84169ca61096941aa5fa660218e0239e083fdbb9a1e49a0e0d317236c34de1232d827ec8e740d860bf46e9fcb6

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 9597a91c491d87dfb8209de6b878fe8b
SHA1 da77262030402d701d697c65c7d60d70ff8af4be
SHA256 81fdafeef0c0e4c41a687b3072a86efc96a7d5df4c015d66ba2016e065544208
SHA512 b76480193c755e6d83ec7c257d3efe6800fb8f84169ca61096941aa5fa660218e0239e083fdbb9a1e49a0e0d317236c34de1232d827ec8e740d860bf46e9fcb6

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 9597a91c491d87dfb8209de6b878fe8b
SHA1 da77262030402d701d697c65c7d60d70ff8af4be
SHA256 81fdafeef0c0e4c41a687b3072a86efc96a7d5df4c015d66ba2016e065544208
SHA512 b76480193c755e6d83ec7c257d3efe6800fb8f84169ca61096941aa5fa660218e0239e083fdbb9a1e49a0e0d317236c34de1232d827ec8e740d860bf46e9fcb6

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 9597a91c491d87dfb8209de6b878fe8b
SHA1 da77262030402d701d697c65c7d60d70ff8af4be
SHA256 81fdafeef0c0e4c41a687b3072a86efc96a7d5df4c015d66ba2016e065544208
SHA512 b76480193c755e6d83ec7c257d3efe6800fb8f84169ca61096941aa5fa660218e0239e083fdbb9a1e49a0e0d317236c34de1232d827ec8e740d860bf46e9fcb6

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 9597a91c491d87dfb8209de6b878fe8b
SHA1 da77262030402d701d697c65c7d60d70ff8af4be
SHA256 81fdafeef0c0e4c41a687b3072a86efc96a7d5df4c015d66ba2016e065544208
SHA512 b76480193c755e6d83ec7c257d3efe6800fb8f84169ca61096941aa5fa660218e0239e083fdbb9a1e49a0e0d317236c34de1232d827ec8e740d860bf46e9fcb6

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 9597a91c491d87dfb8209de6b878fe8b
SHA1 da77262030402d701d697c65c7d60d70ff8af4be
SHA256 81fdafeef0c0e4c41a687b3072a86efc96a7d5df4c015d66ba2016e065544208
SHA512 b76480193c755e6d83ec7c257d3efe6800fb8f84169ca61096941aa5fa660218e0239e083fdbb9a1e49a0e0d317236c34de1232d827ec8e740d860bf46e9fcb6

memory/1740-70-0x0000000002A40000-0x0000000002E28000-memory.dmp

memory/1740-71-0x0000000002A40000-0x0000000002E28000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

MD5 80d93d38badecdd2b134fe4699721223
SHA1 e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256 c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA512 9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

MD5 80d93d38badecdd2b134fe4699721223
SHA1 e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256 c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA512 9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

memory/1584-73-0x0000000000360000-0x0000000000748000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 9597a91c491d87dfb8209de6b878fe8b
SHA1 da77262030402d701d697c65c7d60d70ff8af4be
SHA256 81fdafeef0c0e4c41a687b3072a86efc96a7d5df4c015d66ba2016e065544208
SHA512 b76480193c755e6d83ec7c257d3efe6800fb8f84169ca61096941aa5fa660218e0239e083fdbb9a1e49a0e0d317236c34de1232d827ec8e740d860bf46e9fcb6

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico

MD5 e043a9cb014d641a56f50f9d9ac9a1b9
SHA1 61dc6aed3d0d1f3b8afe3d161410848c565247ed
SHA256 9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946
SHA512 4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

MD5 da1d0cd400e0b6ad6415fd4d90f69666
SHA1 de9083d2902906cacf57259cf581b1466400b799
SHA256 7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575
SHA512 f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

MD5 1bbf5dd0b6ca80e4c7c77495c3f33083
SHA1 e0520037e60eb641ec04d1e814394c9da0a6a862
SHA256 bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b
SHA512 97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

memory/1584-365-0x0000000010000000-0x0000000010051000-memory.dmp

memory/1584-366-0x0000000000F50000-0x0000000000F53000-memory.dmp

memory/1584-367-0x0000000000360000-0x0000000000748000-memory.dmp

memory/1584-368-0x0000000010000000-0x0000000010051000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe

MD5 8d26aecef0a7bdac2b104454d3ba1a87
SHA1 50c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256 e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA512 0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

memory/1584-389-0x0000000000360000-0x0000000000748000-memory.dmp

memory/1584-390-0x0000000010000000-0x0000000010051000-memory.dmp

memory/1584-392-0x0000000010000000-0x0000000010051000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.PNG

MD5 c26a8c3c8a1b4cfa66a04954682cbd00
SHA1 a0fe409f7c63212fa96af3d27e985d1b636d7f5e
SHA256 b215bf4f48b4f943c61a43675ca768f8ff8fa4da813fa3c969a26be550e37b15
SHA512 4088e0d60d5e88ca877af034ee3134a3dec626efcea9a498dfa93c532b77e17f90aca02e03262cf179562136f3b2928d330d3e18dcc9180d22f63c926699baad

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.PNG

MD5 ad413a1fa3406283529429463b3c3582
SHA1 541632da39b89d6370444569130a8780e4917886
SHA256 8fb2c6302a6f56fb23e6a2fd1e5e52136941ac1037c40c26ed5d63c9f71c1a27
SHA512 9dd27101508bc457257a58c4df2473c4050be11f55c6b8b9d670c63d52410e216ac99328aceb25035e88202cab177e9303834441fce3c84677173b2ae3f9ffa6

memory/1584-414-0x0000000000360000-0x0000000000748000-memory.dmp

memory/1584-415-0x0000000010000000-0x0000000010051000-memory.dmp

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 9597a91c491d87dfb8209de6b878fe8b
SHA1 da77262030402d701d697c65c7d60d70ff8af4be
SHA256 81fdafeef0c0e4c41a687b3072a86efc96a7d5df4c015d66ba2016e065544208
SHA512 b76480193c755e6d83ec7c257d3efe6800fb8f84169ca61096941aa5fa660218e0239e083fdbb9a1e49a0e0d317236c34de1232d827ec8e740d860bf46e9fcb6

\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

MD5 8d26aecef0a7bdac2b104454d3ba1a87
SHA1 50c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256 e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA512 0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

MD5 8d26aecef0a7bdac2b104454d3ba1a87
SHA1 50c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256 e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA512 0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

MD5 8d26aecef0a7bdac2b104454d3ba1a87
SHA1 50c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256 e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA512 0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

MD5 8d26aecef0a7bdac2b104454d3ba1a87
SHA1 50c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256 e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA512 0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

MD5 8d26aecef0a7bdac2b104454d3ba1a87
SHA1 50c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256 e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA512 0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

MD5 8d26aecef0a7bdac2b104454d3ba1a87
SHA1 50c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256 e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA512 0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG46.PNG

MD5 c2a26bbdeacb81dd7f8f6bb2bea4a932
SHA1 ed9add65433be66e6a62133632eacf505d23264d
SHA256 9c2e4c1cc89258d95ef6702b7a62d722fdd82ae18f7aab62278aff88ae55a6a9
SHA512 8303b6a274e1d663e9255429dedbbb1eb2b232303d2cce9a6942257c14cc358126684e4bf11f7c111a5cf0063067aa487854daefedf7a4917f6b75b0b6452dcd

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.PNG

MD5 bfd3f5e88b85b08269a1209c7efff5ef
SHA1 831bb68b2118d3037b34316e8290f3aaaa986a9b
SHA256 a1c5e2e49e3cc71793e79d5be2e8d6f7aa5490c9262675d6db0e3fd537fc42eb
SHA512 95b76358b3bfbd31914d6b1db578aa0e5a19b1e352833df9537a02dc6c2084676eaaeb36ac7fbf397a5ba43b16068df7109b3e84bfaa398b8b7175993bd2edd5

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

MD5 018c68cdf5ba005b4a380c20b13fee4c
SHA1 bf6043fbd31288e8667fcfc37cd74414bee1805f
SHA256 3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923
SHA512 506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

MD5 018c68cdf5ba005b4a380c20b13fee4c
SHA1 bf6043fbd31288e8667fcfc37cd74414bee1805f
SHA256 3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923
SHA512 506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

MD5 018c68cdf5ba005b4a380c20b13fee4c
SHA1 bf6043fbd31288e8667fcfc37cd74414bee1805f
SHA256 3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923
SHA512 506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

MD5 018c68cdf5ba005b4a380c20b13fee4c
SHA1 bf6043fbd31288e8667fcfc37cd74414bee1805f
SHA256 3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923
SHA512 506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

MD5 018c68cdf5ba005b4a380c20b13fee4c
SHA1 bf6043fbd31288e8667fcfc37cd74414bee1805f
SHA256 3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923
SHA512 506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

MD5 018c68cdf5ba005b4a380c20b13fee4c
SHA1 bf6043fbd31288e8667fcfc37cd74414bee1805f
SHA256 3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923
SHA512 506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

memory/1584-472-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

MD5 80d93d38badecdd2b134fe4699721223
SHA1 e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256 c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA512 9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

MD5 80d93d38badecdd2b134fe4699721223
SHA1 e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256 c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA512 9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

MD5 018c68cdf5ba005b4a380c20b13fee4c
SHA1 bf6043fbd31288e8667fcfc37cd74414bee1805f
SHA256 3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923
SHA512 506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

memory/468-477-0x0000000002CE0000-0x00000000030C8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat

MD5 bd5626a0237933e0f1dccf10e7c9fbd6
SHA1 10c47d382d4f44d8d44efaa203501749e42c6d50
SHA256 7dfc1176d8a507135140b23a0c014093b7e2673f0f3e5727c3d85df4e7323762
SHA512 1fd864a5386580cf8bbafbacb12a043ef51948b729b9aedfe6dc81e6c2948a100526c7c600069f22454d550f7f736ad3045a930cc2ef97458dc1d6c782928087

C:\Users\Admin\AppData\Local\Temp\setuparguments.ini

MD5 a7ffc9cfb682b3e3ce482add624b00d2
SHA1 0f1adc88e667992e02beb414e425265c02c1ecf9
SHA256 d9161ff32f19664afc1d38e1dfc93ce75f4f19f716eff2f9993bfabb984b4448
SHA512 2f19f4a82f296552ecc5953d1409568d79488ebc0577acd805650cc37225e4023b321baf1c7169c2e094c10debd029f793720126d1e11b0a89b0078433cf5059

memory/468-484-0x0000000002CE0000-0x00000000030C8000-memory.dmp

\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

MD5 8d26aecef0a7bdac2b104454d3ba1a87
SHA1 50c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256 e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA512 0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

MD5 8d26aecef0a7bdac2b104454d3ba1a87
SHA1 50c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256 e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA512 0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

memory/468-485-0x0000000002CE0000-0x00000000030C8000-memory.dmp

memory/468-486-0x0000000002CE0000-0x00000000030C8000-memory.dmp

memory/1584-487-0x0000000000360000-0x0000000000748000-memory.dmp

memory/2000-489-0x0000000001000000-0x00000000013E8000-memory.dmp

memory/2000-502-0x0000000001000000-0x00000000013E8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG45.PNG

MD5 93ab8d6d5e320bb55107ed481364e990
SHA1 151a55018eaf7e439791912786701068fbf3a401
SHA256 696bd78a46953d9314b3193983df419f4dcd016b5d31369bd3f3e3b364efc641
SHA512 7b19c69f69cff9f5505f4637eb71364a347fcfb4771f0c91a881f297a527fc347a73c26a259a69e5cbba164ec416d942d5c1188cd24f9dbb425b494db2d48823

C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

MD5 545c62b3d98ee4cc02af837a72dd09c4
SHA1 54446a007fd9b7363d9415673b0ac0232d5d70d5
SHA256 738029a4f974128180fa2cd239e873b01e456e8bf53bfdbf34b8ba8b57897be4
SHA512 8bf9c754861ed267efd2055ac09b4ad44df61b989859fccd14190592dca1dab0fa8f57360209eaceabb5137f742c9cea73a1a985ab1955f87a6875d0be95fdcf

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

MD5 4f7be9736242579cb8afa1af86980dfe
SHA1 1c486393847996db4f6b78532dd7bd9a0a924549
SHA256 9cecc28716f392d2394829f4cc3f307d08f5aecaf3e2124bdaaa0d6d9c3400b4
SHA512 4c55bc2698d8934713e791c015480248198e22efa66dd5ca79ea834b9835c9e85ca8c2869c9b40dc394ae7e27da039f79c392f88472dedc1adfa83dd1e94f1c9

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNG

MD5 233878a1dfdf615c0e1dc81530aa5302
SHA1 2cd4b1b5d072e3aec82eedf6a87b6c38bb59ef9a
SHA256 765cd11265661ef8aba10bafa1330b2311a309c6f8209cbef6ea1f4e7a6c922e
SHA512 c2fd7427dfe2fc564389ae1f86155901e11068ecf502d2e43c9e5f018b91a05e2952b08ea984b52e20ba8c83569b193bcf5ffb9b19b6e2e521d92c8086db6ed2

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG5.PNG

MD5 8aa76bec130c6e445b9afc13e069c705
SHA1 f33b780d401e898ce376dfcc17022efb282613f9
SHA256 f1a88c950c4342a6d2f972ed57d4b2d2bea8d17c76cfaa852aaf8247cb392918
SHA512 76a1a4ff5aad4a839d50e3ecb84130e0335dcbf7ddeaf4f5b36327fdacad92ee13cc3018ab706b3bf0553eca428fa0d2f9c4080007cbeba5042841387c505809

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG22.PNG

MD5 1d20e2d3d0534910b3ceb2659e36b202
SHA1 b36edff00ddd65e57196ca8b650e73fd3d5ee16d
SHA256 0e2c443067936fbcf70f7bcd3f957dcd691124a6684056c1e8407609f6d64226
SHA512 17e9dcb016a4609ea756fe8bf781aa0620f694c67b3135ee24ec03208033aea03ac8f70e445e4fe4a8d707aa7166e13bc284c58cf768a7b9ae1ddbe3ca5f1526

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG23.PNG

MD5 8402b903804427eb60533887407e9e3f
SHA1 9ff615c4441fd6e8c2a998e9728f2df91b79926d
SHA256 3c3728982174ca5451f0fd830e1c33f9c92faa46e2e0492186d980b969db6e2c
SHA512 9a193bdc7f17ea6ba20f8bc3fcde1aaf5925508e4d4cf5f3483f96226b79a2bbda27b888d30475c5967f67809454cee6a41108ab9a18a6e62206fb9ea28fc5de

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG41.PNG

MD5 b02439a5633e53e207a97fd5c3450109
SHA1 4cd39e991796c96bf2256f1b1adcb4a87e6d100c
SHA256 2eda05afa1dc64eb2ff1e5a5a3e07fab9b728a3249ffbd03ae6b78df2cfb9bcf
SHA512 1330302a734fe306c6edf001f1eb8f1abeea00338e507365035d4f78245716b93abf569cc613997b897547747fa6a8578d80e6084cb09c5d6d82d3c6dda2ee60

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG42.PNG

MD5 3ebb90db69ab4f89a809ae955ce084db
SHA1 99cc932c29c7195393a374891e86f2212caed004
SHA256 d20387a537000d2e53048ddf7554c02a3fe095a22d6d6232cf882a4eb4808d39
SHA512 4dab7ff56e46d08afe5649e7da7dd205d2a48ed4e600be03827828d5aa48abf4912f61f19dca0aa63f4243d848af67107caa4212a63c02a0cc6a804f9221361d

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.BMP

MD5 0b445ace8798426e7185f52b7b7b6d1e
SHA1 7a77b46e0848cc9b32283ccb3f91a18c0934c079
SHA256 2bbf97ccba3f87d469eac909c4ce8a3f13ed29c8f31b611e7d5cf89a0619eda6
SHA512 51523d5b711481293305465a3a3c6a3a50dca984cdc8cca1f4c44f3c21bfa430cd9aac1a8782d9605e6954cbafb307beb6b1a52e9785de1bc3f71067d80c6b6e

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG48.PNG

MD5 eb70c64eb9637567556946524aaba3c8
SHA1 5e5574aef69a542c92a366c82d1e5cbd54d9778f
SHA256 c1a8a2116ffea80a1ce556fc51174e46be705310e7cafd9a150035056de9c588
SHA512 8c547e03982e75b00801a4a56cf55705e13f26d17e578d0c7ceab0effd1576863416ee2cbf5f205c306b206bd0ff39ab950276dc4a554d8440d85ef4c7112d87

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG66.PNG

MD5 0339f5d817fd1dd5abee2deb93183118
SHA1 e49bbc34cca35193272b7ce66760dc32e5c19334
SHA256 f110d8f101c31fb2c09f6d41a35b8c561c706f88467923052750781bd5fce37f
SHA512 08e0f45b68cd9e83d018e988de0b0b76dd8b9433f5def67f2137336dbef28bce69f6754b64bd26b04931811351a74d4c58cba4dce547a86d937e4980f1416147

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG67.PNG

MD5 0d49244ce1c34d0ac58389f7403f60e8
SHA1 1c0a3b4b89a0b937231c86cb80e0d4f2214a29c5
SHA256 e5cb63d87eebf491c4fcef41e9a0a2a6f7ceb3f5685932f5f4e9ec158b7dfb65
SHA512 a4362b18c67d4881b952727005902ad9852a2dda45426d1077961199c0d22130a20a0447e05e588e20b0bdcc4224f8a271929864ce476477091d4349f4ce21f5

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG109.PNG

MD5 0e0557b9f62fce2322fa993c91b2e2e7
SHA1 3c31d21dcb323a3faf47dc04663275e2581013b1
SHA256 7cdc6702979255bdc4b0ee0099593e88c94e563f00bfcca3c7d680f2bb2df3dc
SHA512 48bcf980c20e5b9f587d3c9277855171120cf4ef2d3e7f9aed1bfc8e3f894e28043760c5febad7f3806752b1d388ea1a80092351fac107461023fb7bce9cdd6b

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG124.PNG

MD5 6bcf4aff24c28919bf7c8c76c1c13bfd
SHA1 87776afed17d9f9b3a21fabdb530b4083eca3635
SHA256 03a9cdf6e58e6fbf4158af65ba7465a6463a7d2cfefae2b2bcf705f33771149e
SHA512 12fabd4f1818f31d5ca42c7299b576a6b31232b1c2abb468b256df3d57727dce9395affc4ba6334d7362ba1e57022b5341ffc908e08d019bc1ddc4f94a400e68

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

MD5 da1d0cd400e0b6ad6415fd4d90f69666
SHA1 de9083d2902906cacf57259cf581b1466400b799
SHA256 7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575
SHA512 f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

MD5 1bbf5dd0b6ca80e4c7c77495c3f33083
SHA1 e0520037e60eb641ec04d1e814394c9da0a6a862
SHA256 bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b
SHA512 97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

MD5 3b80a0b3ad0a946589ae570516a22258
SHA1 e47333d5e06ba991b684020aaca681616dc96409
SHA256 92b87b4d63d372817deda2be5e158f44b7fe261d43fda728df3c758fecb8d180
SHA512 8b156e337c9e120f89a4020b80d0589724e7cde48afe5e03f118e838bf136f19a14a2d5f4e579c60d716c3b2f7a91b628545200098e83fd54c54acc082edb85d

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG86.PNG

MD5 9df48291509b109da6fa8565dc46ebd0
SHA1 15e0c52b88cd73f4e294c5b469461e1666fc280a
SHA256 19210a58182587ee81486ca8357177df48bcd667cc4fbdb434965988b02cbb4e
SHA512 4e0136b2170c52762a64d1232cfe2638f059d3cc5337336501f40c369672241cba955433d707d6f3e8bae6f326eff1083be0cecbba0c6da535947641626197b7

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG85.PNG

MD5 a99cea0ae59b6200452ce912f755ebbf
SHA1 84d44cb1e98d59c64b85dd1d447a01e11e18c9d8
SHA256 ae007f0ee65aa1ea5f0a11f116a7613aa61c67259817f3ac2d7fde299a63e174
SHA512 fc9e5f4aa8551a01e7567df4d1ea764966bb4ec7c177c662f4a82c2095fa12f30d67a64c30d03d08ce72267b924eb78c9bd1e0d9ac4da3797cef36f46d5eaa51

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG104.PNG

MD5 74cbb6a9510a5af4e84765729f03aef0
SHA1 44e70d3263b85bcbbf3f40c0b7710284eaed32f8
SHA256 224e1afab80a44dc6bf440bf4a3f3a9535485c271dd38eeefac83cad3a82536e
SHA512 305a8b0f3fd989af6460018bd88edeaf02ff50815d2d8f7553fa511f33eaee9427095f5d0412e7f53e769bf26ef3222cb6df95c4a68ae473fef85d285819641d

memory/1584-1330-0x0000000000360000-0x0000000000748000-memory.dmp

memory/1584-1332-0x0000000000360000-0x0000000000748000-memory.dmp

memory/1584-1336-0x0000000000360000-0x0000000000748000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab6D48.tmp

MD5 fc4666cbca561e864e7fdf883a9e6661
SHA1 2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA256 10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512 c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 860ff8934261faa301ba38e894ee1db8
SHA1 c03fd1d4b8849c81ca1808971e98d35de7b7dfa0
SHA256 574ed388475a90624b8e7c4f30d0bd550fad83ec43461df4da691900565903ed
SHA512 cf7232815c082a3cfe79727c3beb3bdde520ab646d53c233cbb38773002dda48d5429739126be58e7ab826e2d31fceb43b983dd2c6b05a444dc12238cc0c902a

memory/1584-1358-0x0000000000360000-0x0000000000748000-memory.dmp

memory/1584-1359-0x0000000010000000-0x0000000010051000-memory.dmp

\Users\Admin\AppData\Local\Temp\jre-windows.exe

MD5 7542ec421a2f6e90751e8b64c22e0542
SHA1 d207d221a28ede5c2c8415f82c555989aa7068ba
SHA256 188ca8ecc44de1b7f602e883c3054dc392792c3631bf362b1bc4f3e1dba323e6
SHA512 8987bf8aa1b401815fa9850e56954db6015bdd06ce78b65ba435724582ffa615dee4e1452fa237c53257dca8ee97b469d01c27757a5f070ce6f807a4f81094bc

C:\Users\Admin\AppData\Local\Temp\jre-windows.exe

MD5 7542ec421a2f6e90751e8b64c22e0542
SHA1 d207d221a28ede5c2c8415f82c555989aa7068ba
SHA256 188ca8ecc44de1b7f602e883c3054dc392792c3631bf362b1bc4f3e1dba323e6
SHA512 8987bf8aa1b401815fa9850e56954db6015bdd06ce78b65ba435724582ffa615dee4e1452fa237c53257dca8ee97b469d01c27757a5f070ce6f807a4f81094bc

C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe

MD5 dfcfc788d67437530a50177164db42b0
SHA1 2d9ed0dc5671a358186dcf83abb74bfe39c40e9f
SHA256 a90318bae7d99da633d9cac8ce322120d087e7b6f5eec0d1d0d7f9413fdd4dc1
SHA512 dbdfd02528c9f0e506232e8640a8602fade0d05f4139368187300ea2d537e41d2d167655ded30d938bd445a21c776a3c3721f8db4d3f03e3c06807a84cf232e3

\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe

MD5 dfcfc788d67437530a50177164db42b0
SHA1 2d9ed0dc5671a358186dcf83abb74bfe39c40e9f
SHA256 a90318bae7d99da633d9cac8ce322120d087e7b6f5eec0d1d0d7f9413fdd4dc1
SHA512 dbdfd02528c9f0e506232e8640a8602fade0d05f4139368187300ea2d537e41d2d167655ded30d938bd445a21c776a3c3721f8db4d3f03e3c06807a84cf232e3

C:\Users\Admin\AppData\Local\Temp\jusched.log

MD5 9e235860098e1bc10acf7822f12a4336
SHA1 d11c76770c7a35551b86227d978df1f9fc74252c
SHA256 70475cc48cc188ccf524370e8cacc3d49cef9ef6e7bf3f1c1316422832133ef2
SHA512 b2ead502c6f5b13f1acb995435b849d13d4bab97bb37c49b9315565d23dc2d2a66e690a1b3219061f40a9adf75554abb74d078e8742ca4c08f44fbddaeea7d8c

C:\Users\Admin\AppData\Local\Temp\jusched.log

MD5 b3a5e65c4baf56fecc8b9de7496bee75
SHA1 f8d4a1aeac11d4c201f966c44789e2955a946f62
SHA256 2cebcc02120d6950f59b35edd5607d872aeb290e325204fa237b73943495b98f
SHA512 576f42e3026b2bf934a04bce6aa53255a25118508256031027109888671d167d10081526c2601683c5c84caf893244aa1870caaf7753eae812d7d3bceb8f6b3e

C:\Users\Admin\AppData\Local\Temp\jusched.log

MD5 8359f007b757110defedd263d9ab44b3
SHA1 36ccae3f08649cded1f811ab60275b60bdcc5b7d
SHA256 4cc9613078629c078adeaf42ce4e187be99663505acd29cdd91b975fe19cf423
SHA512 93930e1d7e95e26369353713dd7c987118d35b139c6cab6a0c88ae2d0f5e4c61c6dbf67a5677ab95ba7ea3c16e9d7fcf87345db6616db5b5deba40a39f79abba

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\RMRAH9JX.txt

MD5 7d8c72bb493d42c42a1ccc7125a98abd
SHA1 1573bdc917fbd80c630180ae1bc04862edc4ba5a
SHA256 5ec12c8872d7111fa3979fb83ab1c05dba93a2fd787b103216f020fd84f7a182
SHA512 b9e825ee9ea2ef476661866589f28b65100e64ca9c6c38bf11a76af45be32df94a2196f5fd7a59f76369a947ad52413f3cb87b36bf9ba4cde56ef3168e471359

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

MD5 864909148ce83650eb30d4f885842641
SHA1 33f4afaa36d4b501e9ea1a30daec6fe65f194ef5
SHA256 0cbb1b3122ab4af5a84c9c18aafa8fb24eac414bb2e270b9684a356dbb5cabab
SHA512 d8e7ee50b2ce958421ae92506c10f551b511479d9daa60e9b0d975130c8d1c838cc9b0fd019349c59eb4d575b0221c66687639a7b650082b9e0829f67b49db30

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

MD5 ff1d2f8f4cbd85c72198fe952c6169ca
SHA1 13a707e95603a0ed5896fe6c354a0867b7b51a6b
SHA256 fda7dc54d26db8ebfc57765bd31496e82b8d1ee3825b3770af2e6292ac91166f
SHA512 5eb97148995df57aa25fb488e06e1211ded947e62d31583ab6e5cb5b379ba5d8dd1cd83e6f1c4c59a547d718a8d85f94081c773bf06b76b1706a8fcde11fd4bf

C:\Users\Admin\AppData\Local\Temp\TarAD61.tmp

MD5 73b4b714b42fc9a6aaefd0ae59adb009
SHA1 efdaffd5b0ad21913d22001d91bf6c19ecb4ac41
SHA256 c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd
SHA512 73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 4b3958334df317ee84f3aac8b6336b38
SHA1 8522911651613ecef025a9dcb928b77bde2fee6b
SHA256 d4db41dd9dcfbda6fb0e79deb981266db90e927d3833f672195690807484861f
SHA512 67b62e15262b7eb81712a846a9d05e2a01456b76bd908dc10072d1c05b46a15d9203bc1d3d2e52733188999b484c2a2ab5156c86c5b8ffcfe81090de27639542

C:\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe

MD5 dfcfc788d67437530a50177164db42b0
SHA1 2d9ed0dc5671a358186dcf83abb74bfe39c40e9f
SHA256 a90318bae7d99da633d9cac8ce322120d087e7b6f5eec0d1d0d7f9413fdd4dc1
SHA512 dbdfd02528c9f0e506232e8640a8602fade0d05f4139368187300ea2d537e41d2d167655ded30d938bd445a21c776a3c3721f8db4d3f03e3c06807a84cf232e3

\Users\Admin\AppData\Local\Temp\jds7180975.tmp\jre-windows.exe

MD5 dfcfc788d67437530a50177164db42b0
SHA1 2d9ed0dc5671a358186dcf83abb74bfe39c40e9f
SHA256 a90318bae7d99da633d9cac8ce322120d087e7b6f5eec0d1d0d7f9413fdd4dc1
SHA512 dbdfd02528c9f0e506232e8640a8602fade0d05f4139368187300ea2d537e41d2d167655ded30d938bd445a21c776a3c3721f8db4d3f03e3c06807a84cf232e3

memory/1584-1511-0x0000000000360000-0x0000000000748000-memory.dmp

memory/1584-1512-0x0000000010000000-0x0000000010051000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG106.PNG

MD5 b7cfb0f1ee970200738032c7fdfafb8a
SHA1 782983a0e45c87dab5cce32ff637a13080974ea0
SHA256 37c452dd1271e745104e4aebd7e7b8785b6af6951d10f875a627d4fb4b2a36dc
SHA512 2d7079311e5c034cb40da1dfefb42a84d722c84e8dcb532961f5848cb5f693c6876d29538ec120381ae1c838f4c5fdc988609f76c663ca34d41fd88c6edd772f

memory/1584-1526-0x0000000000360000-0x0000000000748000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_351_x64\jre1.8.0_35164.msi

MD5 1794aaa17d114a315a95473c9780fc8b
SHA1 7f250c022b916b88e22254985e7552bc3ac8db04
SHA256 7682233d155e6d19f30cf61b185a02055be0dbcacd2c9accf90a99de21547eb4
SHA512 fb9defdf73786528e82ffc7e1ccfa03cfb687365ec740e9620993da785414306f03a7e1fa523192a9d690a882b012d1e426afd1757639f3ef5f1e612c01e6516

memory/1584-1576-0x0000000000360000-0x0000000000748000-memory.dmp

C:\Windows\Installer\MSI3BA1.tmp

MD5 62cfeb86f117ad91b8bb52f1dda6f473
SHA1 c753b488938b3e08f7f47df209359c7b78764448
SHA256 f06cba20bd40e9d841add1877cf8d3b406f0acfa4800b80ae041ed3cc374eb7e
SHA512 c1b0e76cee4e2c3ca604dcc8f5665e72e70008acc824e20d89404f139d7e7e789e99dff131dafd76409f6ea0a813aa136f96089fbdadcf90d6485b1807762e4e

C:\Users\Admin\AppData\Local\Temp\jusched.log

MD5 9fc47bae48a150370af69665c1af72c9
SHA1 07a7ef12e35c65982de355276cf0c13cc36704bc
SHA256 ce754e02bb3c45f024db4425c0504bbdf10d8ddc5e5cae638146b506bfb088f5
SHA512 8198beb632edd4854b9fad1f367639837c3a141904ab4e1cd7774166e21c8bc33739b1ab562c8732ee13d620311f4c8530705a8b056a57469149a8d056838df7

\Windows\Installer\MSI3BA1.tmp

MD5 62cfeb86f117ad91b8bb52f1dda6f473
SHA1 c753b488938b3e08f7f47df209359c7b78764448
SHA256 f06cba20bd40e9d841add1877cf8d3b406f0acfa4800b80ae041ed3cc374eb7e
SHA512 c1b0e76cee4e2c3ca604dcc8f5665e72e70008acc824e20d89404f139d7e7e789e99dff131dafd76409f6ea0a813aa136f96089fbdadcf90d6485b1807762e4e

\Windows\Installer\MSI4005.tmp

MD5 62cfeb86f117ad91b8bb52f1dda6f473
SHA1 c753b488938b3e08f7f47df209359c7b78764448
SHA256 f06cba20bd40e9d841add1877cf8d3b406f0acfa4800b80ae041ed3cc374eb7e
SHA512 c1b0e76cee4e2c3ca604dcc8f5665e72e70008acc824e20d89404f139d7e7e789e99dff131dafd76409f6ea0a813aa136f96089fbdadcf90d6485b1807762e4e

C:\Windows\Installer\MSI4005.tmp

MD5 62cfeb86f117ad91b8bb52f1dda6f473
SHA1 c753b488938b3e08f7f47df209359c7b78764448
SHA256 f06cba20bd40e9d841add1877cf8d3b406f0acfa4800b80ae041ed3cc374eb7e
SHA512 c1b0e76cee4e2c3ca604dcc8f5665e72e70008acc824e20d89404f139d7e7e789e99dff131dafd76409f6ea0a813aa136f96089fbdadcf90d6485b1807762e4e

C:\Windows\Installer\MSI4351.tmp

MD5 62cfeb86f117ad91b8bb52f1dda6f473
SHA1 c753b488938b3e08f7f47df209359c7b78764448
SHA256 f06cba20bd40e9d841add1877cf8d3b406f0acfa4800b80ae041ed3cc374eb7e
SHA512 c1b0e76cee4e2c3ca604dcc8f5665e72e70008acc824e20d89404f139d7e7e789e99dff131dafd76409f6ea0a813aa136f96089fbdadcf90d6485b1807762e4e

C:\Windows\Installer\MSI4351.tmp

MD5 62cfeb86f117ad91b8bb52f1dda6f473
SHA1 c753b488938b3e08f7f47df209359c7b78764448
SHA256 f06cba20bd40e9d841add1877cf8d3b406f0acfa4800b80ae041ed3cc374eb7e
SHA512 c1b0e76cee4e2c3ca604dcc8f5665e72e70008acc824e20d89404f139d7e7e789e99dff131dafd76409f6ea0a813aa136f96089fbdadcf90d6485b1807762e4e

\Windows\Installer\MSI4351.tmp

MD5 62cfeb86f117ad91b8bb52f1dda6f473
SHA1 c753b488938b3e08f7f47df209359c7b78764448
SHA256 f06cba20bd40e9d841add1877cf8d3b406f0acfa4800b80ae041ed3cc374eb7e
SHA512 c1b0e76cee4e2c3ca604dcc8f5665e72e70008acc824e20d89404f139d7e7e789e99dff131dafd76409f6ea0a813aa136f96089fbdadcf90d6485b1807762e4e

C:\Windows\Installer\6e1ef7.msi

MD5 c897ec7c6cdd2cbd0b5aeb7268d62e35
SHA1 b207350c3e58a79f79d806c56c7b5ee768928909
SHA256 a63b6deffd25d575a4e016c8fab12c2cb26d9cf4355055cff1319916ba919ecd
SHA512 a609e5fbadd3a1a440963469faa6fdb55994138d2be6ba048a7cf4e8f348fe569b61c553b1463e450278cf00613cce379daeeebbaaca9b52f8ea81c0f0a4952a

C:\Users\Admin\AppData\Local\Temp\jusched.log

MD5 c72d1ab3a95ae244820001f4c1c55fac
SHA1 0d76c1b7c187d738f81faa2e275009b41d3fe985
SHA256 e7a441d447aa5c9ccb77615cc310c110192c036e9718e93b390332476a705cd7
SHA512 36bcec7e28e72e14f8790730766c4fc28053872ed60f66d0183838f1f346bee0aaee36f4382c2bbb8952483391f99fa4728c8487b1263eac9376f59daefbb658

C:\Program Files\Java\jre1.8.0_351\installer.exe

MD5 a937010e15e5cf4187bb2a9dd819d187
SHA1 a14a6342fca654d8b4438fca934f113a257d0008
SHA256 5703bece54ea1de0274b00e14d0844bbe81d8a5d626c6ed54aab2b6a42b7cf1d
SHA512 9932411b6c02308f27a6a5f56e166e20076b94d603c5b287e81149f3decd9eb81d66bc57ace1ddf60fa78ba3f0173c01b11ed63db7df5eda7a647e25d71a9677

\Program Files\Java\jre1.8.0_351\installer.exe

MD5 9c0625a43bdb254b1f6b0e6a086231c0
SHA1 f591dfa17f2aebfd85b6e2d55c4fb87e2cc85ffc
SHA256 1a793bcf8353986d90a5e865bc88a1519e59a060a0fdfafe2fffb368efad7329
SHA512 3e845207796e62d4bd62c156b5060e9f7fc855ee2a98c5f3f885d62834ee35f6cf2454b70f2607837be2fce49c45315e46c6eba7418d2a4cabe2967238fc6103

C:\Windows\Installer\6e1efb.msi

MD5 5b4d0d98aeab04337093ec88453b346a
SHA1 0abbb0167f427ad5168fa270f3e97ded69149016
SHA256 e1646317c8c1a8e0dbe7e67e5b06f00d7c0234bc2c1ebd67248a349a852bf7af
SHA512 c5dd47ea2bc7ad98ca16d00beb7b51d0597eb35b90e489fd6473d7058b093f745bcdefff12b64f7e18934351e6056f99c532bdaa50104a8e9bed782fd9f7fa71

Analysis: behavioral2

Detonation Overview

Submitted

2023-03-30 17:22

Reported

2023-03-30 17:26

Platform

win10v2004-20230220-en

Max time kernel

148s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe"

Signatures

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\D: C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe N/A
File opened (read-only) \??\D: C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe N/A

Enumerates physical storage devices

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c00000001000000040000000010000004000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303301924441\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303301924441\assistant\assistant_installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303301924441\assistant\assistant_installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4536 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 4536 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 4536 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 2448 wrote to memory of 4488 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
PID 2448 wrote to memory of 4488 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
PID 2448 wrote to memory of 4488 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
PID 4488 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
PID 4488 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
PID 4488 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
PID 2680 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
PID 2680 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
PID 2680 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
PID 1060 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
PID 1060 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
PID 1060 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
PID 1060 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
PID 1060 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
PID 1060 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
PID 1060 wrote to memory of 4608 N/A C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
PID 1060 wrote to memory of 4608 N/A C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
PID 1060 wrote to memory of 4608 N/A C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
PID 4608 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
PID 4608 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
PID 4608 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
PID 1060 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303301924441\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe
PID 1060 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303301924441\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe
PID 1060 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303301924441\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe
PID 1060 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303301924441\assistant\assistant_installer.exe
PID 1060 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303301924441\assistant\assistant_installer.exe
PID 1060 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303301924441\assistant\assistant_installer.exe
PID 5008 wrote to memory of 3188 N/A C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303301924441\assistant\assistant_installer.exe C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303301924441\assistant\assistant_installer.exe
PID 5008 wrote to memory of 3188 N/A C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303301924441\assistant\assistant_installer.exe C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303301924441\assistant\assistant_installer.exe
PID 5008 wrote to memory of 3188 N/A C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303301924441\assistant\assistant_installer.exe C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303301924441\assistant\assistant_installer.exe
PID 2448 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
PID 2448 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
PID 2448 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
PID 1472 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
PID 1472 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
PID 3100 wrote to memory of 3384 N/A C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
PID 3100 wrote to memory of 3384 N/A C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
PID 3432 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
PID 3432 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe

Processes

C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe

"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe"

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe" "__IRCT:3" "__IRTSS:23652905" "__IRSID:S-1-5-21-1675742406-747946869-1029867430-1000"

C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

"C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816850 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:1841947" "__IRSID:S-1-5-21-1675742406-747946869-1029867430-1000"

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

"C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=97.0.4719.43 --initial-client-data=0x340,0x344,0x348,0x32c,0x34c,0x6fa733e0,0x6fa733f0,0x6fa733fc

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe

"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe" --version

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

"C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=1060 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20230330192444" --session-guid=f226a2b2-bb7e-48ec-b519-ee86c43c2599 --server-tracking-blob="YjY5ODAxMzI0NTNlNmYyYWE1ZGQ4NmVkZGI0YTcxZTdhZGIwN2QzN2IzODkzZjdkYmU2NTM1NTE2OGQ1ZTI3NDp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTY4MDE5NzA4MC45NjM4IiwidXNlcmFnZW50IjoiU2V0dXAgRmFjdG9yeSA5LjAiLCJ1dG0iOnsiY2FtcGFpZ24iOiJPcGVyYURlc2t0b3AiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJNU1RMIn0sInV1aWQiOiI1YWRhYjM2Ni02NzRjLTQ3YzYtYTdmYi03YzE0NjNmOTVhZDAifQ== " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=F005000000000000

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=97.0.4719.43 --initial-client-data=0x34c,0x350,0x354,0x31c,0x358,0x6ef533e0,0x6ef533f0,0x6ef533fc

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303301924441\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe

"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303301924441\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe"

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303301924441\assistant\assistant_installer.exe

"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303301924441\assistant\assistant_installer.exe" --version

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303301924441\assistant\assistant_installer.exe

"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303301924441\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=96.0.4693.50 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x2fc,0xd46c28,0xd46c38,0xd46c44

C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

"C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"

C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe

"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"

C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

"C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"

C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe

"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"

C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

"C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"

C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe

"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"

Network

Country Destination Domain Proto
US 52.152.110.14:443 tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 76.38.195.152.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 dl2.tlauncher.org udp
US 8.8.8.8:53 176.122.125.40.in-addr.arpa udp
US 104.20.234.70:443 dl2.tlauncher.org tcp
US 8.8.8.8:53 176.122.125.40.in-addr.arpa udp
US 8.8.8.8:53 70.234.20.104.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 assets.msn.com udp
NL 95.101.74.151:443 assets.msn.com tcp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 151.74.101.95.in-addr.arpa udp
US 8.8.8.8:53 net.geo.opera.com udp
NL 185.26.182.111:443 net.geo.opera.com tcp
US 8.8.8.8:53 111.182.26.185.in-addr.arpa udp
US 8.8.8.8:53 autoupdate.geo.opera.com udp
US 8.8.8.8:53 desktop-netinstaller-sub.osp.opera.software udp
NL 82.145.217.121:443 desktop-netinstaller-sub.osp.opera.software tcp
NL 82.145.216.19:443 autoupdate.geo.opera.com tcp
NL 82.145.216.19:443 autoupdate.geo.opera.com tcp
US 8.8.8.8:53 features.opera-api2.com udp
US 8.8.8.8:53 download.opera.com udp
NL 82.145.216.15:443 features.opera-api2.com tcp
NL 185.26.182.122:443 download.opera.com tcp
US 8.8.8.8:53 download5.operacdn.com udp
US 104.18.3.211:443 download5.operacdn.com tcp
US 8.8.8.8:53 121.217.145.82.in-addr.arpa udp
US 8.8.8.8:53 19.216.145.82.in-addr.arpa udp
US 8.8.8.8:53 15.216.145.82.in-addr.arpa udp
US 8.8.8.8:53 122.182.26.185.in-addr.arpa udp
US 8.8.8.8:53 211.3.18.104.in-addr.arpa udp
NL 82.145.217.121:443 desktop-netinstaller-sub.osp.opera.software tcp
IE 13.69.239.72:443 tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 151.122.125.40.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 209.197.3.8:80 tcp
NL 82.145.217.121:443 desktop-netinstaller-sub.osp.opera.software tcp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 131.253.33.203:80 tcp
US 8.8.8.8:53 45.8.109.52.in-addr.arpa udp
US 93.184.221.240:80 tcp

Files

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 9597a91c491d87dfb8209de6b878fe8b
SHA1 da77262030402d701d697c65c7d60d70ff8af4be
SHA256 81fdafeef0c0e4c41a687b3072a86efc96a7d5df4c015d66ba2016e065544208
SHA512 b76480193c755e6d83ec7c257d3efe6800fb8f84169ca61096941aa5fa660218e0239e083fdbb9a1e49a0e0d317236c34de1232d827ec8e740d860bf46e9fcb6

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 9597a91c491d87dfb8209de6b878fe8b
SHA1 da77262030402d701d697c65c7d60d70ff8af4be
SHA256 81fdafeef0c0e4c41a687b3072a86efc96a7d5df4c015d66ba2016e065544208
SHA512 b76480193c755e6d83ec7c257d3efe6800fb8f84169ca61096941aa5fa660218e0239e083fdbb9a1e49a0e0d317236c34de1232d827ec8e740d860bf46e9fcb6

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 9597a91c491d87dfb8209de6b878fe8b
SHA1 da77262030402d701d697c65c7d60d70ff8af4be
SHA256 81fdafeef0c0e4c41a687b3072a86efc96a7d5df4c015d66ba2016e065544208
SHA512 b76480193c755e6d83ec7c257d3efe6800fb8f84169ca61096941aa5fa660218e0239e083fdbb9a1e49a0e0d317236c34de1232d827ec8e740d860bf46e9fcb6

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

MD5 80d93d38badecdd2b134fe4699721223
SHA1 e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256 c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA512 9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

MD5 80d93d38badecdd2b134fe4699721223
SHA1 e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256 c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA512 9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

memory/2448-147-0x0000000000B70000-0x0000000000F58000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico

MD5 e043a9cb014d641a56f50f9d9ac9a1b9
SHA1 61dc6aed3d0d1f3b8afe3d161410848c565247ed
SHA256 9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946
SHA512 4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

MD5 da1d0cd400e0b6ad6415fd4d90f69666
SHA1 de9083d2902906cacf57259cf581b1466400b799
SHA256 7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575
SHA512 f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

MD5 da1d0cd400e0b6ad6415fd4d90f69666
SHA1 de9083d2902906cacf57259cf581b1466400b799
SHA256 7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575
SHA512 f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

MD5 1bbf5dd0b6ca80e4c7c77495c3f33083
SHA1 e0520037e60eb641ec04d1e814394c9da0a6a862
SHA256 bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b
SHA512 97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

MD5 1bbf5dd0b6ca80e4c7c77495c3f33083
SHA1 e0520037e60eb641ec04d1e814394c9da0a6a862
SHA256 bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b
SHA512 97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

memory/2448-440-0x0000000010000000-0x0000000010051000-memory.dmp

memory/2448-441-0x0000000006560000-0x0000000006563000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe

MD5 8d26aecef0a7bdac2b104454d3ba1a87
SHA1 50c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256 e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA512 0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

memory/2448-461-0x0000000000B70000-0x0000000000F58000-memory.dmp

memory/2448-462-0x0000000010000000-0x0000000010051000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.PNG

MD5 ad413a1fa3406283529429463b3c3582
SHA1 541632da39b89d6370444569130a8780e4917886
SHA256 8fb2c6302a6f56fb23e6a2fd1e5e52136941ac1037c40c26ed5d63c9f71c1a27
SHA512 9dd27101508bc457257a58c4df2473c4050be11f55c6b8b9d670c63d52410e216ac99328aceb25035e88202cab177e9303834441fce3c84677173b2ae3f9ffa6

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.PNG

MD5 c26a8c3c8a1b4cfa66a04954682cbd00
SHA1 a0fe409f7c63212fa96af3d27e985d1b636d7f5e
SHA256 b215bf4f48b4f943c61a43675ca768f8ff8fa4da813fa3c969a26be550e37b15
SHA512 4088e0d60d5e88ca877af034ee3134a3dec626efcea9a498dfa93c532b77e17f90aca02e03262cf179562136f3b2928d330d3e18dcc9180d22f63c926699baad

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG41.PNG

MD5 b02439a5633e53e207a97fd5c3450109
SHA1 4cd39e991796c96bf2256f1b1adcb4a87e6d100c
SHA256 2eda05afa1dc64eb2ff1e5a5a3e07fab9b728a3249ffbd03ae6b78df2cfb9bcf
SHA512 1330302a734fe306c6edf001f1eb8f1abeea00338e507365035d4f78245716b93abf569cc613997b897547747fa6a8578d80e6084cb09c5d6d82d3c6dda2ee60

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG42.PNG

MD5 3ebb90db69ab4f89a809ae955ce084db
SHA1 99cc932c29c7195393a374891e86f2212caed004
SHA256 d20387a537000d2e53048ddf7554c02a3fe095a22d6d6232cf882a4eb4808d39
SHA512 4dab7ff56e46d08afe5649e7da7dd205d2a48ed4e600be03827828d5aa48abf4912f61f19dca0aa63f4243d848af67107caa4212a63c02a0cc6a804f9221361d

C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

MD5 8d26aecef0a7bdac2b104454d3ba1a87
SHA1 50c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256 e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA512 0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

MD5 8d26aecef0a7bdac2b104454d3ba1a87
SHA1 50c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256 e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA512 0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.PNG

MD5 bfd3f5e88b85b08269a1209c7efff5ef
SHA1 831bb68b2118d3037b34316e8290f3aaaa986a9b
SHA256 a1c5e2e49e3cc71793e79d5be2e8d6f7aa5490c9262675d6db0e3fd537fc42eb
SHA512 95b76358b3bfbd31914d6b1db578aa0e5a19b1e352833df9537a02dc6c2084676eaaeb36ac7fbf397a5ba43b16068df7109b3e84bfaa398b8b7175993bd2edd5

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

MD5 018c68cdf5ba005b4a380c20b13fee4c
SHA1 bf6043fbd31288e8667fcfc37cd74414bee1805f
SHA256 3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923
SHA512 506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

MD5 018c68cdf5ba005b4a380c20b13fee4c
SHA1 bf6043fbd31288e8667fcfc37cd74414bee1805f
SHA256 3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923
SHA512 506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

MD5 018c68cdf5ba005b4a380c20b13fee4c
SHA1 bf6043fbd31288e8667fcfc37cd74414bee1805f
SHA256 3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923
SHA512 506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

MD5 80d93d38badecdd2b134fe4699721223
SHA1 e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256 c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA512 9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

MD5 80d93d38badecdd2b134fe4699721223
SHA1 e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256 c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA512 9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat

MD5 bd5626a0237933e0f1dccf10e7c9fbd6
SHA1 10c47d382d4f44d8d44efaa203501749e42c6d50
SHA256 7dfc1176d8a507135140b23a0c014093b7e2673f0f3e5727c3d85df4e7323762
SHA512 1fd864a5386580cf8bbafbacb12a043ef51948b729b9aedfe6dc81e6c2948a100526c7c600069f22454d550f7f736ad3045a930cc2ef97458dc1d6c782928087

C:\Users\Admin\AppData\Local\Temp\setuparguments.ini

MD5 d328b9a6ccd2b61e92ad634b8f586317
SHA1 caa843f8cb916fb016b758e8ef4f5f8302a30414
SHA256 b58a26c241fe1de4ac4593fec33b47e968986521bcc27075b1ed71d4f5ba2d1c
SHA512 3b86e60a6352e0f763866c6df4e5ccd03abd5b34cc18948af322e03bace4a93eeb63643dbf3f90d05dd7a54e1a96bb37acfdf6c637578d3bd47f28895bb10934

memory/2680-532-0x00000000000E0000-0x00000000004C8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

MD5 0074ac44e0a83fbeab8176509b822f15
SHA1 3350a89035a644f219c1bd6c6cde20ff618e164c
SHA256 81ae55b4c2674406284557a62ecb3e0cdf94d303058d83ac1232a66bc7a8495c
SHA512 835204043a5b18604b868202fa9f4e1d9b6dd9d8b8e07cd4db9a307ff780fa6e12a260515836ba3ea57424ade1fa76047a8bb88676cdc9a09650b35e1b39b1b5

memory/2448-544-0x0000000000B70000-0x0000000000F58000-memory.dmp

memory/2448-545-0x0000000010000000-0x0000000010051000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

MD5 0074ac44e0a83fbeab8176509b822f15
SHA1 3350a89035a644f219c1bd6c6cde20ff618e164c
SHA256 81ae55b4c2674406284557a62ecb3e0cdf94d303058d83ac1232a66bc7a8495c
SHA512 835204043a5b18604b868202fa9f4e1d9b6dd9d8b8e07cd4db9a307ff780fa6e12a260515836ba3ea57424ade1fa76047a8bb88676cdc9a09650b35e1b39b1b5

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

MD5 0074ac44e0a83fbeab8176509b822f15
SHA1 3350a89035a644f219c1bd6c6cde20ff618e164c
SHA256 81ae55b4c2674406284557a62ecb3e0cdf94d303058d83ac1232a66bc7a8495c
SHA512 835204043a5b18604b868202fa9f4e1d9b6dd9d8b8e07cd4db9a307ff780fa6e12a260515836ba3ea57424ade1fa76047a8bb88676cdc9a09650b35e1b39b1b5

memory/1060-550-0x0000000000B70000-0x00000000010A8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Opera_installer_2303301924413211060.dll

MD5 bac04c920c1505e39636c6d473721292
SHA1 f45d06f54dc4f1dd2256bbe23843be4952aca2ab
SHA256 98c6a36fc123eabe83b724f3b41735a55784ddec0173739c50124e4d7e9d22f0
SHA512 8d2a6f0354aa1557e5ccec3adb9eab59237606c29b92883cfdf106a2f924ebfba06bed6cd65b64462465ad2f11c329ed06fe36b640905bd86427c023f50c4771

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG45.PNG

MD5 93ab8d6d5e320bb55107ed481364e990
SHA1 151a55018eaf7e439791912786701068fbf3a401
SHA256 696bd78a46953d9314b3193983df419f4dcd016b5d31369bd3f3e3b364efc641
SHA512 7b19c69f69cff9f5505f4637eb71364a347fcfb4771f0c91a881f297a527fc347a73c26a259a69e5cbba164ec416d942d5c1188cd24f9dbb425b494db2d48823

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

MD5 0074ac44e0a83fbeab8176509b822f15
SHA1 3350a89035a644f219c1bd6c6cde20ff618e164c
SHA256 81ae55b4c2674406284557a62ecb3e0cdf94d303058d83ac1232a66bc7a8495c
SHA512 835204043a5b18604b868202fa9f4e1d9b6dd9d8b8e07cd4db9a307ff780fa6e12a260515836ba3ea57424ade1fa76047a8bb88676cdc9a09650b35e1b39b1b5

C:\Users\Admin\AppData\Local\Temp\Opera_installer_2303301924424781864.dll

MD5 bac04c920c1505e39636c6d473721292
SHA1 f45d06f54dc4f1dd2256bbe23843be4952aca2ab
SHA256 98c6a36fc123eabe83b724f3b41735a55784ddec0173739c50124e4d7e9d22f0
SHA512 8d2a6f0354aa1557e5ccec3adb9eab59237606c29b92883cfdf106a2f924ebfba06bed6cd65b64462465ad2f11c329ed06fe36b640905bd86427c023f50c4771

C:\Users\Admin\AppData\Local\Temp\Opera_installer_2303301924424781864.dll

MD5 bac04c920c1505e39636c6d473721292
SHA1 f45d06f54dc4f1dd2256bbe23843be4952aca2ab
SHA256 98c6a36fc123eabe83b724f3b41735a55784ddec0173739c50124e4d7e9d22f0
SHA512 8d2a6f0354aa1557e5ccec3adb9eab59237606c29b92883cfdf106a2f924ebfba06bed6cd65b64462465ad2f11c329ed06fe36b640905bd86427c023f50c4771

memory/1864-564-0x0000000000B70000-0x00000000010A8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe

MD5 0074ac44e0a83fbeab8176509b822f15
SHA1 3350a89035a644f219c1bd6c6cde20ff618e164c
SHA256 81ae55b4c2674406284557a62ecb3e0cdf94d303058d83ac1232a66bc7a8495c
SHA512 835204043a5b18604b868202fa9f4e1d9b6dd9d8b8e07cd4db9a307ff780fa6e12a260515836ba3ea57424ade1fa76047a8bb88676cdc9a09650b35e1b39b1b5

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe

MD5 0074ac44e0a83fbeab8176509b822f15
SHA1 3350a89035a644f219c1bd6c6cde20ff618e164c
SHA256 81ae55b4c2674406284557a62ecb3e0cdf94d303058d83ac1232a66bc7a8495c
SHA512 835204043a5b18604b868202fa9f4e1d9b6dd9d8b8e07cd4db9a307ff780fa6e12a260515836ba3ea57424ade1fa76047a8bb88676cdc9a09650b35e1b39b1b5

C:\Users\Admin\AppData\Local\Temp\Opera_installer_2303301924442282076.dll

MD5 bac04c920c1505e39636c6d473721292
SHA1 f45d06f54dc4f1dd2256bbe23843be4952aca2ab
SHA256 98c6a36fc123eabe83b724f3b41735a55784ddec0173739c50124e4d7e9d22f0
SHA512 8d2a6f0354aa1557e5ccec3adb9eab59237606c29b92883cfdf106a2f924ebfba06bed6cd65b64462465ad2f11c329ed06fe36b640905bd86427c023f50c4771

memory/2076-578-0x00000000003C0000-0x00000000008F8000-memory.dmp

memory/2076-580-0x00000000003C0000-0x00000000008F8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

MD5 0074ac44e0a83fbeab8176509b822f15
SHA1 3350a89035a644f219c1bd6c6cde20ff618e164c
SHA256 81ae55b4c2674406284557a62ecb3e0cdf94d303058d83ac1232a66bc7a8495c
SHA512 835204043a5b18604b868202fa9f4e1d9b6dd9d8b8e07cd4db9a307ff780fa6e12a260515836ba3ea57424ade1fa76047a8bb88676cdc9a09650b35e1b39b1b5

C:\Users\Admin\AppData\Local\Temp\Opera_installer_2303301924448994608.dll

MD5 bac04c920c1505e39636c6d473721292
SHA1 f45d06f54dc4f1dd2256bbe23843be4952aca2ab
SHA256 98c6a36fc123eabe83b724f3b41735a55784ddec0173739c50124e4d7e9d22f0
SHA512 8d2a6f0354aa1557e5ccec3adb9eab59237606c29b92883cfdf106a2f924ebfba06bed6cd65b64462465ad2f11c329ed06fe36b640905bd86427c023f50c4771

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

MD5 0074ac44e0a83fbeab8176509b822f15
SHA1 3350a89035a644f219c1bd6c6cde20ff618e164c
SHA256 81ae55b4c2674406284557a62ecb3e0cdf94d303058d83ac1232a66bc7a8495c
SHA512 835204043a5b18604b868202fa9f4e1d9b6dd9d8b8e07cd4db9a307ff780fa6e12a260515836ba3ea57424ade1fa76047a8bb88676cdc9a09650b35e1b39b1b5

C:\Users\Admin\AppData\Local\Temp\Opera_installer_2303301924450564660.dll

MD5 bac04c920c1505e39636c6d473721292
SHA1 f45d06f54dc4f1dd2256bbe23843be4952aca2ab
SHA256 98c6a36fc123eabe83b724f3b41735a55784ddec0173739c50124e4d7e9d22f0
SHA512 8d2a6f0354aa1557e5ccec3adb9eab59237606c29b92883cfdf106a2f924ebfba06bed6cd65b64462465ad2f11c329ed06fe36b640905bd86427c023f50c4771

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

MD5 4f6d1b8b72b9f777738abbca22d3e632
SHA1 8eeef4e9cfd94de0db02c802e0d4a5dbfc513201
SHA256 0797a4f5497e7f64953cf0fde54892942331c185825ededd6875b2fb92511239
SHA512 dee6bb78e82e5e727bcd399dfdfa47dfc8f88e21bf40174803609f7c16bb3b1cc2dd6dec2f99b0382f06579d198491c32bb3b10a63115d2635c3374a72a78a09

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

MD5 6545355abd9f1a511f27711f11da6bfa
SHA1 541e16e101250db5fc7ff7d17dc09dd7a0871411
SHA256 2a182c22a1c92aee04d337fb19fd8b3d9d790e3509d1ffb10261af0ed1d32f96
SHA512 00e0ec9e7e15b7bec06bf566de60e58d9d8e1ae1193617a34163bc57db135b56446589cd8c0a781d34f431e657d0647f7e78fff8927850cb5cdee3be329fc152

memory/2680-627-0x00000000000E0000-0x00000000004C8000-memory.dmp

C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

MD5 62a2cfce53bdcd005678e7a25140da02
SHA1 7cedeaa33d00c52dc13bbc94e3ca082f610be804
SHA256 55155ace418748aa5256cd7c46cb0e5c9ef5de489dc521a1e22991f47de396ad
SHA512 e00fa611ef8022454e4a86b467a7ff344ed956c9c2e8428bf6b49df96dea0e3fd022d1ab77f4922814bc401d5938b115fc34ad4dc16c44ecb46ef5c4edbb2292

C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

MD5 62a2cfce53bdcd005678e7a25140da02
SHA1 7cedeaa33d00c52dc13bbc94e3ca082f610be804
SHA256 55155ace418748aa5256cd7c46cb0e5c9ef5de489dc521a1e22991f47de396ad
SHA512 e00fa611ef8022454e4a86b467a7ff344ed956c9c2e8428bf6b49df96dea0e3fd022d1ab77f4922814bc401d5938b115fc34ad4dc16c44ecb46ef5c4edbb2292

memory/4608-633-0x0000000000B70000-0x00000000010A8000-memory.dmp

memory/4660-634-0x0000000000B70000-0x00000000010A8000-memory.dmp

memory/2448-637-0x0000000000B70000-0x0000000000F58000-memory.dmp

memory/1060-639-0x0000000000B70000-0x00000000010A8000-memory.dmp

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

MD5 4f7be9736242579cb8afa1af86980dfe
SHA1 1c486393847996db4f6b78532dd7bd9a0a924549
SHA256 9cecc28716f392d2394829f4cc3f307d08f5aecaf3e2124bdaaa0d6d9c3400b4
SHA512 4c55bc2698d8934713e791c015480248198e22efa66dd5ca79ea834b9835c9e85ca8c2869c9b40dc394ae7e27da039f79c392f88472dedc1adfa83dd1e94f1c9

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG5.PNG

MD5 8aa76bec130c6e445b9afc13e069c705
SHA1 f33b780d401e898ce376dfcc17022efb282613f9
SHA256 f1a88c950c4342a6d2f972ed57d4b2d2bea8d17c76cfaa852aaf8247cb392918
SHA512 76a1a4ff5aad4a839d50e3ecb84130e0335dcbf7ddeaf4f5b36327fdacad92ee13cc3018ab706b3bf0553eca428fa0d2f9c4080007cbeba5042841387c505809

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNG

MD5 233878a1dfdf615c0e1dc81530aa5302
SHA1 2cd4b1b5d072e3aec82eedf6a87b6c38bb59ef9a
SHA256 765cd11265661ef8aba10bafa1330b2311a309c6f8209cbef6ea1f4e7a6c922e
SHA512 c2fd7427dfe2fc564389ae1f86155901e11068ecf502d2e43c9e5f018b91a05e2952b08ea984b52e20ba8c83569b193bcf5ffb9b19b6e2e521d92c8086db6ed2

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG19.PNG

MD5 1d20e2d3d0534910b3ceb2659e36b202
SHA1 b36edff00ddd65e57196ca8b650e73fd3d5ee16d
SHA256 0e2c443067936fbcf70f7bcd3f957dcd691124a6684056c1e8407609f6d64226
SHA512 17e9dcb016a4609ea756fe8bf781aa0620f694c67b3135ee24ec03208033aea03ac8f70e445e4fe4a8d707aa7166e13bc284c58cf768a7b9ae1ddbe3ca5f1526

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG23.PNG

MD5 8402b903804427eb60533887407e9e3f
SHA1 9ff615c4441fd6e8c2a998e9728f2df91b79926d
SHA256 3c3728982174ca5451f0fd830e1c33f9c92faa46e2e0492186d980b969db6e2c
SHA512 9a193bdc7f17ea6ba20f8bc3fcde1aaf5925508e4d4cf5f3483f96226b79a2bbda27b888d30475c5967f67809454cee6a41108ab9a18a6e62206fb9ea28fc5de

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.BMP

MD5 0b445ace8798426e7185f52b7b7b6d1e
SHA1 7a77b46e0848cc9b32283ccb3f91a18c0934c079
SHA256 2bbf97ccba3f87d469eac909c4ce8a3f13ed29c8f31b611e7d5cf89a0619eda6
SHA512 51523d5b711481293305465a3a3c6a3a50dca984cdc8cca1f4c44f3c21bfa430cd9aac1a8782d9605e6954cbafb307beb6b1a52e9785de1bc3f71067d80c6b6e

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG46.PNG

MD5 c2a26bbdeacb81dd7f8f6bb2bea4a932
SHA1 ed9add65433be66e6a62133632eacf505d23264d
SHA256 9c2e4c1cc89258d95ef6702b7a62d722fdd82ae18f7aab62278aff88ae55a6a9
SHA512 8303b6a274e1d663e9255429dedbbb1eb2b232303d2cce9a6942257c14cc358126684e4bf11f7c111a5cf0063067aa487854daefedf7a4917f6b75b0b6452dcd

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303301924441\opera_package

MD5 08ffaf39dc304e29b6d5d4b6d45e7d87
SHA1 0acb2b4057ffcae1c1b5659d4d897caf63946f9c
SHA256 497229bbce3750058cb5301215561d067bafad7c956db5eb7719faf16e5152b3
SHA512 5f60a042df1b45ad5363555cd685f4a24710f67996d7a1ae5cc0cf3b8bf3678d66946a8712ef5ac480942ef49eaa34d93d68c47fbdf26671298817f3a3f571dc

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG48.PNG

MD5 eb70c64eb9637567556946524aaba3c8
SHA1 5e5574aef69a542c92a366c82d1e5cbd54d9778f
SHA256 c1a8a2116ffea80a1ce556fc51174e46be705310e7cafd9a150035056de9c588
SHA512 8c547e03982e75b00801a4a56cf55705e13f26d17e578d0c7ceab0effd1576863416ee2cbf5f205c306b206bd0ff39ab950276dc4a554d8440d85ef4c7112d87

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG67.PNG

MD5 0d49244ce1c34d0ac58389f7403f60e8
SHA1 1c0a3b4b89a0b937231c86cb80e0d4f2214a29c5
SHA256 e5cb63d87eebf491c4fcef41e9a0a2a6f7ceb3f5685932f5f4e9ec158b7dfb65
SHA512 a4362b18c67d4881b952727005902ad9852a2dda45426d1077961199c0d22130a20a0447e05e588e20b0bdcc4224f8a271929864ce476477091d4349f4ce21f5

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG66.PNG

MD5 0339f5d817fd1dd5abee2deb93183118
SHA1 e49bbc34cca35193272b7ce66760dc32e5c19334
SHA256 f110d8f101c31fb2c09f6d41a35b8c561c706f88467923052750781bd5fce37f
SHA512 08e0f45b68cd9e83d018e988de0b0b76dd8b9433f5def67f2137336dbef28bce69f6754b64bd26b04931811351a74d4c58cba4dce547a86d937e4980f1416147

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG105.PNG

MD5 6bcf4aff24c28919bf7c8c76c1c13bfd
SHA1 87776afed17d9f9b3a21fabdb530b4083eca3635
SHA256 03a9cdf6e58e6fbf4158af65ba7465a6463a7d2cfefae2b2bcf705f33771149e
SHA512 12fabd4f1818f31d5ca42c7299b576a6b31232b1c2abb468b256df3d57727dce9395affc4ba6334d7362ba1e57022b5341ffc908e08d019bc1ddc4f94a400e68

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG108.PNG

MD5 0e0557b9f62fce2322fa993c91b2e2e7
SHA1 3c31d21dcb323a3faf47dc04663275e2581013b1
SHA256 7cdc6702979255bdc4b0ee0099593e88c94e563f00bfcca3c7d680f2bb2df3dc
SHA512 48bcf980c20e5b9f587d3c9277855171120cf4ef2d3e7f9aed1bfc8e3f894e28043760c5febad7f3806752b1d388ea1a80092351fac107461023fb7bce9cdd6b

memory/2448-1327-0x0000000000B70000-0x0000000000F58000-memory.dmp

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

MD5 2a376ff46f9c2d072e5ed6ab6484e08e
SHA1 bdbc796f56afc89cb027ac72047114cce63c5198
SHA256 7f260cc25d9c683d9c60975a0960e1ef317149d9f4a98fa6aad4265844ac97c0
SHA512 2f58f3ec5a146e8a27f38288f6b6edcb572f8d6ee1449a6a505909b5ff2ddeefad3840685325962cb1f6365189e40d5da53cb8c1f0f53aa51c23d7adeef979f6

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG104.PNG

MD5 74cbb6a9510a5af4e84765729f03aef0
SHA1 44e70d3263b85bcbbf3f40c0b7710284eaed32f8
SHA256 224e1afab80a44dc6bf440bf4a3f3a9535485c271dd38eeefac83cad3a82536e
SHA512 305a8b0f3fd989af6460018bd88edeaf02ff50815d2d8f7553fa511f33eaee9427095f5d0412e7f53e769bf26ef3222cb6df95c4a68ae473fef85d285819641d

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG85.PNG

MD5 a99cea0ae59b6200452ce912f755ebbf
SHA1 84d44cb1e98d59c64b85dd1d447a01e11e18c9d8
SHA256 ae007f0ee65aa1ea5f0a11f116a7613aa61c67259817f3ac2d7fde299a63e174
SHA512 fc9e5f4aa8551a01e7567df4d1ea764966bb4ec7c177c662f4a82c2095fa12f30d67a64c30d03d08ce72267b924eb78c9bd1e0d9ac4da3797cef36f46d5eaa51

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG86.PNG

MD5 9df48291509b109da6fa8565dc46ebd0
SHA1 15e0c52b88cd73f4e294c5b469461e1666fc280a
SHA256 19210a58182587ee81486ca8357177df48bcd667cc4fbdb434965988b02cbb4e
SHA512 4e0136b2170c52762a64d1232cfe2638f059d3cc5337336501f40c369672241cba955433d707d6f3e8bae6f326eff1083be0cecbba0c6da535947641626197b7

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303301924441\additional_file0.tmp

MD5 b386cdcb413405daa8219af8e4cbd318
SHA1 ce275ff8514fef0629c915a6ee7b5ac481b9043d
SHA256 408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e
SHA512 91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303301924441\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe

MD5 b386cdcb413405daa8219af8e4cbd318
SHA1 ce275ff8514fef0629c915a6ee7b5ac481b9043d
SHA256 408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e
SHA512 91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303301924441\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe

MD5 b386cdcb413405daa8219af8e4cbd318
SHA1 ce275ff8514fef0629c915a6ee7b5ac481b9043d
SHA256 408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e
SHA512 91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303301924441\assistant\assistant_installer.exe

MD5 2f3d9e21e232b9bfea064d3b2264db06
SHA1 bafddc657d8d1bb531683b29b0342cc065ee51d2
SHA256 25528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d
SHA512 94e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303301924441\assistant\assistant_installer.exe

MD5 2f3d9e21e232b9bfea064d3b2264db06
SHA1 bafddc657d8d1bb531683b29b0342cc065ee51d2
SHA256 25528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d
SHA512 94e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303301924441\assistant\assistant_installer.exe

MD5 2f3d9e21e232b9bfea064d3b2264db06
SHA1 bafddc657d8d1bb531683b29b0342cc065ee51d2
SHA256 25528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d
SHA512 94e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5

C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

MD5 62a2cfce53bdcd005678e7a25140da02
SHA1 7cedeaa33d00c52dc13bbc94e3ca082f610be804
SHA256 55155ace418748aa5256cd7c46cb0e5c9ef5de489dc521a1e22991f47de396ad
SHA512 e00fa611ef8022454e4a86b467a7ff344ed956c9c2e8428bf6b49df96dea0e3fd022d1ab77f4922814bc401d5938b115fc34ad4dc16c44ecb46ef5c4edbb2292

memory/2448-1656-0x0000000000B70000-0x0000000000F58000-memory.dmp

C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

MD5 545c62b3d98ee4cc02af837a72dd09c4
SHA1 54446a007fd9b7363d9415673b0ac0232d5d70d5
SHA256 738029a4f974128180fa2cd239e873b01e456e8bf53bfdbf34b8ba8b57897be4
SHA512 8bf9c754861ed267efd2055ac09b4ad44df61b989859fccd14190592dca1dab0fa8f57360209eaceabb5137f742c9cea73a1a985ab1955f87a6875d0be95fdcf

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG106.PNG

MD5 b7cfb0f1ee970200738032c7fdfafb8a
SHA1 782983a0e45c87dab5cce32ff637a13080974ea0
SHA256 37c452dd1271e745104e4aebd7e7b8785b6af6951d10f875a627d4fb4b2a36dc
SHA512 2d7079311e5c034cb40da1dfefb42a84d722c84e8dcb532961f5848cb5f693c6876d29538ec120381ae1c838f4c5fdc988609f76c663ca34d41fd88c6edd772f

C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

MD5 545c62b3d98ee4cc02af837a72dd09c4
SHA1 54446a007fd9b7363d9415673b0ac0232d5d70d5
SHA256 738029a4f974128180fa2cd239e873b01e456e8bf53bfdbf34b8ba8b57897be4
SHA512 8bf9c754861ed267efd2055ac09b4ad44df61b989859fccd14190592dca1dab0fa8f57360209eaceabb5137f742c9cea73a1a985ab1955f87a6875d0be95fdcf

C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

MD5 545c62b3d98ee4cc02af837a72dd09c4
SHA1 54446a007fd9b7363d9415673b0ac0232d5d70d5
SHA256 738029a4f974128180fa2cd239e873b01e456e8bf53bfdbf34b8ba8b57897be4
SHA512 8bf9c754861ed267efd2055ac09b4ad44df61b989859fccd14190592dca1dab0fa8f57360209eaceabb5137f742c9cea73a1a985ab1955f87a6875d0be95fdcf

memory/1472-1871-0x0000000000400000-0x0000000000417000-memory.dmp

memory/2448-1961-0x0000000000B70000-0x0000000000F58000-memory.dmp

memory/2680-1972-0x00000000000E0000-0x00000000004C8000-memory.dmp

C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

MD5 545c62b3d98ee4cc02af837a72dd09c4
SHA1 54446a007fd9b7363d9415673b0ac0232d5d70d5
SHA256 738029a4f974128180fa2cd239e873b01e456e8bf53bfdbf34b8ba8b57897be4
SHA512 8bf9c754861ed267efd2055ac09b4ad44df61b989859fccd14190592dca1dab0fa8f57360209eaceabb5137f742c9cea73a1a985ab1955f87a6875d0be95fdcf

memory/3100-1977-0x0000000000400000-0x0000000000417000-memory.dmp

memory/4464-1980-0x0000000000880000-0x0000000000881000-memory.dmp

C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

MD5 545c62b3d98ee4cc02af837a72dd09c4
SHA1 54446a007fd9b7363d9415673b0ac0232d5d70d5
SHA256 738029a4f974128180fa2cd239e873b01e456e8bf53bfdbf34b8ba8b57897be4
SHA512 8bf9c754861ed267efd2055ac09b4ad44df61b989859fccd14190592dca1dab0fa8f57360209eaceabb5137f742c9cea73a1a985ab1955f87a6875d0be95fdcf

C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

MD5 26f2139480dd1ea4491f5083af78697f
SHA1 4b7db183892456c7163fadfeab19fb21612bf3f2
SHA256 c331cce8f323a3732b835318b1b0a1438dac0fa978d48b86b93591cfdde2a9c1
SHA512 d58bc40e0b4ca6a3ca6354dc93e2bf543bdf846fdceb794cd33d77a20d042feecaa2aced8536b1b8b6d14f7dba2cfaaa47863f8d2dc3c330b2b30df0742249a3

memory/3384-1994-0x0000000001710000-0x0000000001711000-memory.dmp

memory/3432-1998-0x0000000000400000-0x0000000000417000-memory.dmp

memory/3384-1999-0x0000000001710000-0x0000000001711000-memory.dmp

C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

MD5 fbcc471d4e7be623d698d6ce5de81aff
SHA1 7675dd97fb67756426b3da7d165eb95500d8e103
SHA256 d6ec4244314583777e27fb08ad07546844654ed936856cd74e26a791d158c897
SHA512 9d535c8efa548627587ba0c0bde9d09ffe815e7e17810cb50c95458683a557a918e7b613b599ce4d0696f1e2a45532efc07df9d31a7b81824ad20a03acded12d

memory/3460-2023-0x00000000008F0000-0x00000000008F1000-memory.dmp

memory/3460-2027-0x00000000008F0000-0x00000000008F1000-memory.dmp