78d84068b47cf28b76c88ba4474c7c187510f4e4e967d079d3761dcab7851655

Analysis

max time kernel
96s
max time network
98s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
31-03-2023 20:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TLauncher-2.876-Installer-1.0.7-global.exe
Size

22.6MB
MD5

e89a95bce6075955a4e1acdb6bb56561
SHA1

8b17013cbf2ea69d625d7bcb1e578933c13678fc
SHA256

78d84068b47cf28b76c88ba4474c7c187510f4e4e967d079d3761dcab7851655
SHA512

4ccb33f60c9292e12daa53b49524a36bbe1c1ca86d794b5134b8b954736a532e9f202123b39036c6a9c557e128bd8361e5c1cb86d40723cc00784026741d5e65
SSDEEP

393216:DXkoYB+UAVl/Pfs/dQETVlOBbpFEjdGphRqV56HpkvQFa2Vj4h2cU:D0oYB+3fHHExi73qqHpU2Vj4hE

Score

8^/10

discovery spyware stealer upx

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 11 IoCs

Processes:

irsetup.exeBrowserInstaller.exeirsetup.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exeAssistant_96.0.4693.50_Setup.exe_sfx.exeassistant_installer.exeassistant_installer.exe

pid	process
2556	irsetup.exe
1268	BrowserInstaller.exe
1772	irsetup.exe
4420	opera-installer-bro.exe
2804	opera-installer-bro.exe
2628	opera-installer-bro.exe
4824	opera-installer-bro.exe
2716	opera-installer-bro.exe
780	Assistant_96.0.4693.50_Setup.exe_sfx.exe
3588	assistant_installer.exe
4064	assistant_installer.exe

Loads dropped DLL 9 IoCs

Processes:

irsetup.exeirsetup.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exe

pid	process
2556	irsetup.exe
2556	irsetup.exe
2556	irsetup.exe
1772	irsetup.exe
4420	opera-installer-bro.exe
2804	opera-installer-bro.exe
2628	opera-installer-bro.exe
4824	opera-installer-bro.exe
2716	opera-installer-bro.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

UPX packed file 30 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
behavioral1/memory/2556-131-0x0000000000330000-0x0000000000718000-memory.dmp	upx
behavioral1/memory/2556-438-0x0000000000330000-0x0000000000718000-memory.dmp	upx
behavioral1/memory/2556-462-0x0000000000330000-0x0000000000718000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
behavioral1/memory/1772-496-0x0000000000080000-0x0000000000468000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
behavioral1/memory/4420-516-0x0000000000990000-0x0000000000EC8000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe	upx
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe	upx
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe	upx
behavioral1/memory/2804-549-0x0000000000990000-0x0000000000EC8000-memory.dmp	upx
behavioral1/memory/2628-557-0x0000000000160000-0x0000000000698000-memory.dmp	upx
behavioral1/memory/2628-554-0x0000000000160000-0x0000000000698000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
behavioral1/memory/4824-589-0x0000000000990000-0x0000000000EC8000-memory.dmp	upx
behavioral1/memory/2716-591-0x0000000000990000-0x0000000000EC8000-memory.dmp	upx
behavioral1/memory/2556-611-0x0000000000330000-0x0000000000718000-memory.dmp	upx
behavioral1/memory/1772-613-0x0000000000080000-0x0000000000468000-memory.dmp	upx
behavioral1/memory/4420-1102-0x0000000000990000-0x0000000000EC8000-memory.dmp	upx
behavioral1/memory/2556-1567-0x0000000000330000-0x0000000000718000-memory.dmp	upx
behavioral1/memory/2556-1631-0x0000000000330000-0x0000000000718000-memory.dmp	upx
behavioral1/memory/2556-1651-0x0000000000330000-0x0000000000718000-memory.dmp	upx
behavioral1/memory/2556-1743-0x0000000000330000-0x0000000000718000-memory.dmp	upx
behavioral1/memory/2556-2036-0x0000000000330000-0x0000000000718000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

opera-installer-bro.exeopera-installer-bro.exe

description ioc process

File opened (read-only) \??\D: opera-installer-bro.exe
File opened (read-only) \??\D: opera-installer-bro.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened (read-only)	\??\D:	opera-installer-bro.exe
File opened (read-only)	\??\D:	opera-installer-bro.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies registry class 1 IoCs

Processes:

firefox.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings firefox.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings	firefox.exe

Modifies system certificate store 2 TTPs 10 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

opera-installer-bro.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	opera-installer-bro.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	opera-installer-bro.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	opera-installer-bro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	opera-installer-bro.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	opera-installer-bro.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	opera-installer-bro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	opera-installer-bro.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	opera-installer-bro.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c00000001000000040000000010000004000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	opera-installer-bro.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	opera-installer-bro.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

firefox.exe

pid process

4160 firefox.exe
4160 firefox.exe
4160 firefox.exe
4160 firefox.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

4160 firefox.exe
4160 firefox.exe
4160 firefox.exe

pid	process
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe

pid	process
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe

Suspicious use of SetWindowsHookEx 20 IoCs

Processes:

pid	process
2556	irsetup.exe
2556	irsetup.exe
2556	irsetup.exe
2556	irsetup.exe
2556	irsetup.exe
2556	irsetup.exe
2556	irsetup.exe
1268	BrowserInstaller.exe
1772	irsetup.exe
1772	irsetup.exe
1772	irsetup.exe
4420	opera-installer-bro.exe
2804	opera-installer-bro.exe
2628	opera-installer-bro.exe
4824	opera-installer-bro.exe
2716	opera-installer-bro.exe
780	Assistant_96.0.4693.50_Setup.exe_sfx.exe
3588	assistant_installer.exe
4064	assistant_installer.exe
4160	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

TLauncher-2.876-Installer-1.0.7-global.exeirsetup.exeBrowserInstaller.exeirsetup.exeopera-installer-bro.exeopera-installer-bro.exeassistant_installer.exefirefox.exefirefox.exe

description	pid	process	target process
PID 2284 wrote to memory of 2556	2284	TLauncher-2.876-Installer-1.0.7-global.exe	irsetup.exe
PID 2284 wrote to memory of 2556	2284	TLauncher-2.876-Installer-1.0.7-global.exe	irsetup.exe
PID 2284 wrote to memory of 2556	2284	TLauncher-2.876-Installer-1.0.7-global.exe	irsetup.exe
PID 2556 wrote to memory of 1268	2556	irsetup.exe	BrowserInstaller.exe
PID 2556 wrote to memory of 1268	2556	irsetup.exe	BrowserInstaller.exe
PID 2556 wrote to memory of 1268	2556	irsetup.exe	BrowserInstaller.exe
PID 1268 wrote to memory of 1772	1268	BrowserInstaller.exe	irsetup.exe
PID 1268 wrote to memory of 1772	1268	BrowserInstaller.exe	irsetup.exe
PID 1268 wrote to memory of 1772	1268	BrowserInstaller.exe	irsetup.exe
PID 1772 wrote to memory of 4420	1772	irsetup.exe	opera-installer-bro.exe
PID 1772 wrote to memory of 4420	1772	irsetup.exe	opera-installer-bro.exe
PID 1772 wrote to memory of 4420	1772	irsetup.exe	opera-installer-bro.exe
PID 4420 wrote to memory of 2804	4420	opera-installer-bro.exe	opera-installer-bro.exe
PID 4420 wrote to memory of 2804	4420	opera-installer-bro.exe	opera-installer-bro.exe
PID 4420 wrote to memory of 2804	4420	opera-installer-bro.exe	opera-installer-bro.exe
PID 4420 wrote to memory of 2628	4420	opera-installer-bro.exe	opera-installer-bro.exe
PID 4420 wrote to memory of 2628	4420	opera-installer-bro.exe	opera-installer-bro.exe
PID 4420 wrote to memory of 2628	4420	opera-installer-bro.exe	opera-installer-bro.exe
PID 4420 wrote to memory of 4824	4420	opera-installer-bro.exe	opera-installer-bro.exe
PID 4420 wrote to memory of 4824	4420	opera-installer-bro.exe	opera-installer-bro.exe
PID 4420 wrote to memory of 4824	4420	opera-installer-bro.exe	opera-installer-bro.exe
PID 4824 wrote to memory of 2716	4824	opera-installer-bro.exe	opera-installer-bro.exe
PID 4824 wrote to memory of 2716	4824	opera-installer-bro.exe	opera-installer-bro.exe
PID 4824 wrote to memory of 2716	4824	opera-installer-bro.exe	opera-installer-bro.exe
PID 4420 wrote to memory of 780	4420	opera-installer-bro.exe	Assistant_96.0.4693.50_Setup.exe_sfx.exe
PID 4420 wrote to memory of 780	4420	opera-installer-bro.exe	Assistant_96.0.4693.50_Setup.exe_sfx.exe
PID 4420 wrote to memory of 780	4420	opera-installer-bro.exe	Assistant_96.0.4693.50_Setup.exe_sfx.exe
PID 4420 wrote to memory of 3588	4420	opera-installer-bro.exe	assistant_installer.exe
PID 4420 wrote to memory of 3588	4420	opera-installer-bro.exe	assistant_installer.exe
PID 4420 wrote to memory of 3588	4420	opera-installer-bro.exe	assistant_installer.exe
PID 3588 wrote to memory of 4064	3588	assistant_installer.exe	assistant_installer.exe
PID 3588 wrote to memory of 4064	3588	assistant_installer.exe	assistant_installer.exe
PID 3588 wrote to memory of 4064	3588	assistant_installer.exe	assistant_installer.exe
PID 2308 wrote to memory of 4160	2308	firefox.exe	firefox.exe
PID 2308 wrote to memory of 4160	2308	firefox.exe	firefox.exe
PID 2308 wrote to memory of 4160	2308	firefox.exe	firefox.exe
PID 2308 wrote to memory of 4160	2308	firefox.exe	firefox.exe
PID 2308 wrote to memory of 4160	2308	firefox.exe	firefox.exe
PID 2308 wrote to memory of 4160	2308	firefox.exe	firefox.exe
PID 2308 wrote to memory of 4160	2308	firefox.exe	firefox.exe
PID 2308 wrote to memory of 4160	2308	firefox.exe	firefox.exe
PID 2308 wrote to memory of 4160	2308	firefox.exe	firefox.exe
PID 2308 wrote to memory of 4160	2308	firefox.exe	firefox.exe
PID 2308 wrote to memory of 4160	2308	firefox.exe	firefox.exe
PID 4160 wrote to memory of 2676	4160	firefox.exe	firefox.exe
PID 4160 wrote to memory of 2676	4160	firefox.exe	firefox.exe
PID 4160 wrote to memory of 4472	4160	firefox.exe	firefox.exe
PID 4160 wrote to memory of 4472	4160	firefox.exe	firefox.exe
PID 4160 wrote to memory of 4472	4160	firefox.exe	firefox.exe
PID 4160 wrote to memory of 4472	4160	firefox.exe	firefox.exe
PID 4160 wrote to memory of 4472	4160	firefox.exe	firefox.exe
PID 4160 wrote to memory of 4472	4160	firefox.exe	firefox.exe
PID 4160 wrote to memory of 4472	4160	firefox.exe	firefox.exe
PID 4160 wrote to memory of 4472	4160	firefox.exe	firefox.exe
PID 4160 wrote to memory of 4472	4160	firefox.exe	firefox.exe
PID 4160 wrote to memory of 4472	4160	firefox.exe	firefox.exe
PID 4160 wrote to memory of 4472	4160	firefox.exe	firefox.exe
PID 4160 wrote to memory of 4472	4160	firefox.exe	firefox.exe
PID 4160 wrote to memory of 4472	4160	firefox.exe	firefox.exe
PID 4160 wrote to memory of 4472	4160	firefox.exe	firefox.exe
PID 4160 wrote to memory of 4472	4160	firefox.exe	firefox.exe
PID 4160 wrote to memory of 4472	4160	firefox.exe	firefox.exe
PID 4160 wrote to memory of 4472	4160	firefox.exe	firefox.exe
PID 4160 wrote to memory of 4472	4160	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe
"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2284

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe" "__IRCT:3" "__IRTSS:23645635" "__IRSID:S-1-5-21-1311743041-1167936498-546579926-1000"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556

C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1268

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816338 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:1840798" "__IRSID:S-1-5-21-1311743041-1167936498-546579926-1000"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1772

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
"C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4420

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=97.0.4719.43 --initial-client-data=0x2fc,0x300,0x304,0x2d8,0x308,0x6f1133e0,0x6f1133f0,0x6f1133fc
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2804

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe" --version
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2628

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
"C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=4420 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20230331200642" --session-guid=c93033f8-40e4-4e07-8811-db882949d1be --server-tracking-blob="MzFmYWFlMDUzOTE1MzAwOWIxZjI1MDRhNzIwNTFhZDA4MTI3NzViOGY3ZTg1YzljZWNmZGZiMzY2YjQ4NjdhMzp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTY4MDI5MzIwMi4zMjIzIiwidXNlcmFnZW50IjoiU2V0dXAgRmFjdG9yeSA5LjAiLCJ1dG0iOnsiY2FtcGFpZ24iOiJPcGVyYURlc2t0b3AiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJNU1RMIn0sInV1aWQiOiIxYmE3YWM3Mi1lYmI3LTRhZDgtOTdjYS0yYTkxYjVkNjgyNWIifQ== " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=DC04000000000000
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4824

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=97.0.4719.43 --initial-client-data=0x308,0x30c,0x310,0x2d8,0x314,0x6e5f33e0,0x6e5f33f0,0x6e5f33fc
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2716

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303312006421\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303312006421\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:780

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303312006421\assistant\assistant_installer.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303312006421\assistant\assistant_installer.exe" --version
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3588

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303312006421\assistant\assistant_installer.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303312006421\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=96.0.4693.50 --initial-client-data=0x2b4,0x2b8,0x2bc,0x290,0x2c0,0x1106c28,0x1106c38,0x1106c44
7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4064

C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
"C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
3⤵
PID:2308

C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
4⤵
PID:5444

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2308

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4160

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4160.0.1573642248\791900236" -parentBuildID 20221007134813 -prefsHandle 1652 -prefMapHandle 1640 -prefsLen 20888 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {73c6176d-08a6-4f2b-8389-fbf5c401cc6c} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" 1732 1cf42f18358 gpu
3⤵
PID:2676

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4160.1.107923302\64322082" -parentBuildID 20221007134813 -prefsHandle 2076 -prefMapHandle 2072 -prefsLen 20969 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0b22afaa-5016-4248-a0c5-9f8aaebf600c} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" 2088 1cf41e0e658 socket
3⤵
PID:4472

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4160.2.273418474\1968342901" -childID 1 -isForBrowser -prefsHandle 2648 -prefMapHandle 2764 -prefsLen 21117 -prefMapSize 232675 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {31cbcba0-eca0-4dd1-885b-f74f7f57f2f6} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" 2756 1cf45c3ab58 tab
3⤵
PID:4340

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4160.3.1338768067\774345181" -childID 2 -isForBrowser -prefsHandle 3540 -prefMapHandle 3536 -prefsLen 26562 -prefMapSize 232675 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6794e149-7f53-4d41-bf69-1331822608bc} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" 3084 1cf3675df58 tab
3⤵
PID:1628

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4160.4.1324800282\243131135" -childID 3 -isForBrowser -prefsHandle 3756 -prefMapHandle 3752 -prefsLen 26562 -prefMapSize 232675 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {285ab384-b19e-4e45-95d1-e17c805adefc} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" 3772 1cf472eb258 tab
3⤵
PID:800

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4160.5.1869609168\196770477" -childID 4 -isForBrowser -prefsHandle 4688 -prefMapHandle 4628 -prefsLen 26781 -prefMapSize 232675 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {435c71f0-eb55-4ae4-b1d8-5726e18080b3} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" 4568 1cf477d1b58 tab
3⤵
PID:4276

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4160.6.1083224934\1443543423" -childID 5 -isForBrowser -prefsHandle 4896 -prefMapHandle 4892 -prefsLen 26781 -prefMapSize 232675 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {670ea4b6-3a50-4301-9d8e-a2e4120d72ed} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" 4812 1cf48a86358 tab
3⤵
PID:1296

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4160.7.48231693\997343840" -childID 6 -isForBrowser -prefsHandle 5040 -prefMapHandle 5044 -prefsLen 26781 -prefMapSize 232675 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d997d9c1-ad14-408f-9e2c-3dc9719cedfb} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" 5032 1cf48656b58 tab
3⤵
PID:4020

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4160.8.2118759198\143218343" -childID 7 -isForBrowser -prefsHandle 5376 -prefMapHandle 4628 -prefsLen 26781 -prefMapSize 232675 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f7bb51dd-39cc-4558-a8ad-283c5a454436} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" 5388 1cf444c4758 tab
3⤵
PID:6088

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
Filesize
471B

MD5
84b1f477c90dbeb15a36b2ccac368a13

SHA1
98258bc6548a59dbdbf2baedc3a8ba94140c7d57

SHA256
00af63b52d5ab007911925c905af313aefb5f6b61e8dfd17bed35abf8b0786ef

SHA512
ab277579fb932eb95fb2b84ec4e8c12aecc196113e24d6cea3a7d182af20266a8997dd55ccf878c8e65332ae081635e8420da84fe13b2908087e8c46054ccc8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
Filesize
434B

MD5
82ecc1d11742eceaa00e2bebbf733319

SHA1
e6778d0e62f5d57516cf9747197b66b17ae0d9eb

SHA256
62982168f998099ddef06caa09852e32d77a4b8cd733058a17db419c0009ff9b

SHA512
eaba072e9dbfa831bc9abe38b871d8a259cb2777caf7608a34ddafd037fff9c42a955ac6de8deb2dd0fefdcfb813b860e9cb3db7c059de93a18483e3557137d7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\p4wuoroe.default-release\activity-stream.discovery_stream.json.tmp
Filesize
149KB

MD5
12955b3e0edc7644711aceceff3ba918

SHA1
e5ea4c80878f96f1e3840490dbf0f97309b17209

SHA256
942c902af8c4a187dc982f7dfc13d534d3b252d51825f81c9bd528ddc2f2d08f

SHA512
2451d3cea9e689ab99ca5276d370291b4627e8bec3c9b3e04f51fc32a8c720bff130c75690aa462c367d496ca97c44b40f0d9e69038cfb2b30d9a342471ba9d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
3ddb61bd70b733f70006fbb44604945b

SHA1
79dc1aba07afc359fd2cf49847db5d50b9fb7bfe

SHA256
3c2e3421444da833233010004ef5a53c9d924ea2303b266373def3c09f6322b3

SHA512
9a7db757c166df5605c835dd42b996abc8e3b905a9ea6bb125a34754102a83021be0b289efd76e19b8e859b08f1cf8fee722060023f2139baac2c3b8bc932597

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
3ddb61bd70b733f70006fbb44604945b

SHA1
79dc1aba07afc359fd2cf49847db5d50b9fb7bfe

SHA256
3c2e3421444da833233010004ef5a53c9d924ea2303b266373def3c09f6322b3

SHA512
9a7db757c166df5605c835dd42b996abc8e3b905a9ea6bb125a34754102a83021be0b289efd76e19b8e859b08f1cf8fee722060023f2139baac2c3b8bc932597

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
3ddb61bd70b733f70006fbb44604945b

SHA1
79dc1aba07afc359fd2cf49847db5d50b9fb7bfe

SHA256
3c2e3421444da833233010004ef5a53c9d924ea2303b266373def3c09f6322b3

SHA512
9a7db757c166df5605c835dd42b996abc8e3b905a9ea6bb125a34754102a83021be0b289efd76e19b8e859b08f1cf8fee722060023f2139baac2c3b8bc932597

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303312006421\additional_file0.tmp
Filesize
1.7MB

MD5
b386cdcb413405daa8219af8e4cbd318

SHA1
ce275ff8514fef0629c915a6ee7b5ac481b9043d

SHA256
408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e

SHA512
91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303312006421\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe
Filesize
1.7MB

MD5
b386cdcb413405daa8219af8e4cbd318

SHA1
ce275ff8514fef0629c915a6ee7b5ac481b9043d

SHA256
408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e

SHA512
91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303312006421\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe
Filesize
1.7MB

MD5
b386cdcb413405daa8219af8e4cbd318

SHA1
ce275ff8514fef0629c915a6ee7b5ac481b9043d

SHA256
408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e

SHA512
91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303312006421\assistant\assistant_installer.exe
Filesize
2.1MB

MD5
2f3d9e21e232b9bfea064d3b2264db06

SHA1
bafddc657d8d1bb531683b29b0342cc065ee51d2

SHA256
25528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d

SHA512
94e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303312006421\assistant\assistant_installer.exe
Filesize
2.1MB

MD5
2f3d9e21e232b9bfea064d3b2264db06

SHA1
bafddc657d8d1bb531683b29b0342cc065ee51d2

SHA256
25528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d

SHA512
94e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303312006421\assistant\assistant_installer.exe
Filesize
2.1MB

MD5
2f3d9e21e232b9bfea064d3b2264db06

SHA1
bafddc657d8d1bb531683b29b0342cc065ee51d2

SHA256
25528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d

SHA512
94e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303312006421\opera_package
Filesize
89.4MB

MD5
08ffaf39dc304e29b6d5d4b6d45e7d87

SHA1
0acb2b4057ffcae1c1b5659d4d897caf63946f9c

SHA256
497229bbce3750058cb5301215561d067bafad7c956db5eb7719faf16e5152b3

SHA512
5f60a042df1b45ad5363555cd685f4a24710f67996d7a1ae5cc0cf3b8bf3678d66946a8712ef5ac480942ef49eaa34d93d68c47fbdf26671298817f3a3f571dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
Filesize
1.8MB

MD5
52e46b1adf9cd40428b41755df527bd4

SHA1
5f0bb9c9c14208851beb5c93d9268c16ab39dc07

SHA256
a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

SHA512
813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

Download Submit
C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
Filesize
1.8MB

MD5
52e46b1adf9cd40428b41755df527bd4

SHA1
5f0bb9c9c14208851beb5c93d9268c16ab39dc07

SHA256
a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

SHA512
813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2303312006414942804.dll
Filesize
4.6MB

MD5
bac04c920c1505e39636c6d473721292

SHA1
f45d06f54dc4f1dd2256bbe23843be4952aca2ab

SHA256
98c6a36fc123eabe83b724f3b41735a55784ddec0173739c50124e4d7e9d22f0

SHA512
8d2a6f0354aa1557e5ccec3adb9eab59237606c29b92883cfdf106a2f924ebfba06bed6cd65b64462465ad2f11c329ed06fe36b640905bd86427c023f50c4771

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico
Filesize
116KB

MD5
e043a9cb014d641a56f50f9d9ac9a1b9

SHA1
61dc6aed3d0d1f3b8afe3d161410848c565247ed

SHA256
9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946

SHA512
4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe
Filesize
1.8MB

MD5
52e46b1adf9cd40428b41755df527bd4

SHA1
5f0bb9c9c14208851beb5c93d9268c16ab39dc07

SHA256
a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

SHA512
813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.PNG
Filesize
339B

MD5
bbdf2e8c0262e7e606d41ddbe5a3cd12

SHA1
acbb25f729af14b692ec9c8187a23b1a696f8e47

SHA256
d7c76896d206d977739556ad2d5811f7cf3117252afcd439a5aa0f2b645f6949

SHA512
0334fae3682889adbc18594b7917d8c93252a86bc04d08efc6860d5714ba4eb8aabc39c51e532c4aee57a938021540d2f2899781d9cd1de311036e1850a65067

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG104.PNG
Filesize
644B

MD5
38c12e1a54f8fd216ed3f13b36798cc6

SHA1
ccf1fe585d3374ebce4c1ec025e2d8ec39968a7c

SHA256
608924ba294590b5b706658d9aaa71b480ad9aa1b6797bbc5cf1632ac6c616b1

SHA512
0918af63f006d7fa04a3faeeb813e61c060316a126c4742a948a30f5b6ea368c3b8592011319dad3dbf8427dfcc095aa72f7b651d6fc31061f861f070447331b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG105.PNG
Filesize
40KB

MD5
98abbfa2908f51f4eda33f465ccacc03

SHA1
1bd17c0835b1c8196d0a8166b4818b3138f65a28

SHA256
10438b49eeac103534a5fd867888437b761f346cec8714daeb95fdd246cc540a

SHA512
9eaa76ab654a786f5af84e9a20e7d0efb22ee00977e662ab5a057da1aff1a7552150bba0253704f00e60115347bfb4fe1784a703ad3846e221dbee41ea7a1470

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG106.PNG
Filesize
1KB

MD5
0f414e91b67121d55587e7c004f35cb2

SHA1
6d63b4c6fa858f8cfd4b257600037e9c370355a8

SHA256
015dd2b2df51cd90438286d28b5719cbdf9a2e7bebf326b99c6c091ad98e4cc1

SHA512
1b7d8bbb97f6acb4984cd93578b5045cd4ce0813645a28d3b778489b646194e68b2a931f26a9c6a7026f98de29719132972eb983d771affdfe42c42622b786e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG108.PNG
Filesize
2KB

MD5
03b1d78771eb279766efb2d9f2fa8463

SHA1
8f10e304fd65e58136ccd6ab012ffc594e6fb707

SHA256
eec16d2cb57e38b485b6a269e9c2554c1dfc3b70dec9f7bbddc2b62526b3d832

SHA512
ca51cbaf20e6f62eb6ec69555d259ef61828d3166d09106bcd335dd417ed30660af71e7fd8db6bd22bf134cc530e1a55ecdd2c307e64e8edb28af95299d66f5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG19.PNG
Filesize
1KB

MD5
46a65321aa1fce57d465c26e8b6eb392

SHA1
9efb9a3acd5b32556ea66398c74b014f91087559

SHA256
61df7a1f0367209668d4f0f6a285b8baff864d1341d382ebbc7fd4e71036b666

SHA512
094d69016f066ae835c71d7a950217b9ad09e8cd4d74131787203cae950e572c18213dc1ded139b1fa46c7f803cc15bf4f596c9d51aefe0d43850ae2865f3707

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.PNG
Filesize
280B

MD5
5a7901f7df307fba45b1c377f2c94ccc

SHA1
d6630cf733033cdfbda7af3213d49b32f5b06919

SHA256
d8471d5a5b4792c4b49e80b5cb22ef1e938dc3069b210646704f658548d7a9f8

SHA512
fc0036a7ed4b53edd72b91c4824919e6e8a82b5be1e82cdc134e267ef4792424124fb6ba5d7c86cf686910da0baba8453d7a6c12b39a5b4c0cb70658580f3bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.PNG
Filesize
281B

MD5
05d7bba3d6ac92766c4495b8928202a6

SHA1
50b65a8ba5ed2633e43929ee4bd58c95a91a3363

SHA256
4804f3c4fae714657fdb85e98244828acc6ac938505c2da1ed694ae7b58f2949

SHA512
1544d5cd6f85aaeeacd26f2deb9da9eb510226b41079ee78c4dede14386e5ea3446efdfd475bfbfa3a6846fa2ff23d64f4dad3a4ddd304e32de80e4d7bcbc600

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG45.PNG
Filesize
438B

MD5
09229c3bfb801177839a7c2e22e33a1b

SHA1
f679c05c4c7b2f3722069420c6d6481fc856e7aa

SHA256
cbf81d779b469942613297a3ca6c09d885e3b1d4aa952dc1994a7175fbfc7e3f

SHA512
503bfa063b29dda95f15da303f707e5b78a6bdb74662c222d8a8b7e3a33264016a66acdd9de44aea932e7cde80a43c2406ea6f0250d3df8e182217bc4a0a7ed7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG85.PNG
Filesize
43KB

MD5
667b0b54ee5ba0d1cb66190226596e46

SHA1
b8658b35e7cf44b24053e4d01d3b51233d6526f6

SHA256
3a9ab8c3640f1b40b33553d7d3dd3d15bd6e702ef510ec0b66a2f14aa744bf83

SHA512
9ccc773214a0074634be66801d81d7a593ab154351fdbd1b93f56ffa80cf824ee31ff2e13f26536d5f3096e90df43fa223080b4dc55340614b076c08ef976dcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG86.PNG
Filesize
1KB

MD5
5bc85d12eb492baa3be9230f1fbdc342

SHA1
456fe4284fa916ad3817e7c3d419c13f4c949737

SHA256
9a27f240758513aa1cc05500171fe22fdb3a485781cba4798cefc29f6944373c

SHA512
3d55c597ac29d7f810980dfd89404d3ecbd2e652ae1bc5e6710668ad5386a0caecf3149289df13f6dabed6b2e4305a26684ab3bd21b255b37f8a596fe8d641b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
Filesize
1.7MB

MD5
1bbf5dd0b6ca80e4c7c77495c3f33083

SHA1
e0520037e60eb641ec04d1e814394c9da0a6a862

SHA256
bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

SHA512
97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
Filesize
97KB

MD5
da1d0cd400e0b6ad6415fd4d90f69666

SHA1
de9083d2902906cacf57259cf581b1466400b799

SHA256
7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

SHA512
f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Filesize
1.3MB

MD5
111dddf2f308abc2a8f7555d5f642751

SHA1
11e6cdccbf29a71a97011b9444cf20c83ad8b57b

SHA256
c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

SHA512
11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Filesize
1.3MB

MD5
111dddf2f308abc2a8f7555d5f642751

SHA1
11e6cdccbf29a71a97011b9444cf20c83ad8b57b

SHA256
c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

SHA512
11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat
Filesize
108KB

MD5
aec508468d53ab8d55f5b4beb82c347d

SHA1
477d1ffb28834243f5811a4a2a54b4f0ca240120

SHA256
ebee84e34e221ad822486432333bad9e6357af2fb0d9651cc61c7fab8ec9b5bf

SHA512
26a0278af2a9e75ef966bc3f7f40d7669204c2004a043adaad102ef440caa6282e69372ca0c3c7d39a8450691d528c2dc77a4386bfb0c6e5a2a76c3fef900fbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
Filesize
1.3MB

MD5
5027f3112ac2d6f764769102a9145c8e

SHA1
a369a0e1d4ace1a8d66908aa43543bea03c76f5b

SHA256
d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

SHA512
181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
Filesize
1.3MB

MD5
5027f3112ac2d6f764769102a9145c8e

SHA1
a369a0e1d4ace1a8d66908aa43543bea03c76f5b

SHA256
d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

SHA512
181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
3ddb61bd70b733f70006fbb44604945b

SHA1
79dc1aba07afc359fd2cf49847db5d50b9fb7bfe

SHA256
3c2e3421444da833233010004ef5a53c9d924ea2303b266373def3c09f6322b3

SHA512
9a7db757c166df5605c835dd42b996abc8e3b905a9ea6bb125a34754102a83021be0b289efd76e19b8e859b08f1cf8fee722060023f2139baac2c3b8bc932597

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
3ddb61bd70b733f70006fbb44604945b

SHA1
79dc1aba07afc359fd2cf49847db5d50b9fb7bfe

SHA256
3c2e3421444da833233010004ef5a53c9d924ea2303b266373def3c09f6322b3

SHA512
9a7db757c166df5605c835dd42b996abc8e3b905a9ea6bb125a34754102a83021be0b289efd76e19b8e859b08f1cf8fee722060023f2139baac2c3b8bc932597

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
3ddb61bd70b733f70006fbb44604945b

SHA1
79dc1aba07afc359fd2cf49847db5d50b9fb7bfe

SHA256
3c2e3421444da833233010004ef5a53c9d924ea2303b266373def3c09f6322b3

SHA512
9a7db757c166df5605c835dd42b996abc8e3b905a9ea6bb125a34754102a83021be0b289efd76e19b8e859b08f1cf8fee722060023f2139baac2c3b8bc932597

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
3ddb61bd70b733f70006fbb44604945b

SHA1
79dc1aba07afc359fd2cf49847db5d50b9fb7bfe

SHA256
3c2e3421444da833233010004ef5a53c9d924ea2303b266373def3c09f6322b3

SHA512
9a7db757c166df5605c835dd42b996abc8e3b905a9ea6bb125a34754102a83021be0b289efd76e19b8e859b08f1cf8fee722060023f2139baac2c3b8bc932597

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
Filesize
2.7MB

MD5
3ddb61bd70b733f70006fbb44604945b

SHA1
79dc1aba07afc359fd2cf49847db5d50b9fb7bfe

SHA256
3c2e3421444da833233010004ef5a53c9d924ea2303b266373def3c09f6322b3

SHA512
9a7db757c166df5605c835dd42b996abc8e3b905a9ea6bb125a34754102a83021be0b289efd76e19b8e859b08f1cf8fee722060023f2139baac2c3b8bc932597

Download Submit
C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
Filesize
647B

MD5
fbec5e3269e4f1553338d1784ea47850

SHA1
f7cc71d642d50f300dc19645ce4df8c4bb638fef

SHA256
31980235cf908b81dadc65189560ce3cb1045d2272289b5246f9d7c0920fbebb

SHA512
e2ef634a19c3188d2a143edefc6b1d90d48707bbe64c48422ba7df68f2f1d2c443623aedab30ec44423dad861c9917290e9984de650fdb83aaea0a9215dde90b

Download Submit
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
Filesize
6.3MB

MD5
f08d9bbc61cff8e8c3504524c3220bef

SHA1
b4268c667469620bb528c04eaa819d508159b398

SHA256
2c4d8b48344ae221e349e525ac16eb364ffb5ab8deae80c7caa28dd5967cabdb

SHA512
a64a03d959487399fb57e1bd062c0e9f88a17ff9b3ad15e6b96a4b7332341d0fc9186ef99b2ab9bdcfa51864f21d08bce48479202c01d15470916e90fb09fef4

Download Submit
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
Filesize
6.3MB

MD5
f08d9bbc61cff8e8c3504524c3220bef

SHA1
b4268c667469620bb528c04eaa819d508159b398

SHA256
2c4d8b48344ae221e349e525ac16eb364ffb5ab8deae80c7caa28dd5967cabdb

SHA512
a64a03d959487399fb57e1bd062c0e9f88a17ff9b3ad15e6b96a4b7332341d0fc9186ef99b2ab9bdcfa51864f21d08bce48479202c01d15470916e90fb09fef4

Download Submit
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
Filesize
6.3MB

MD5
f08d9bbc61cff8e8c3504524c3220bef

SHA1
b4268c667469620bb528c04eaa819d508159b398

SHA256
2c4d8b48344ae221e349e525ac16eb364ffb5ab8deae80c7caa28dd5967cabdb

SHA512
a64a03d959487399fb57e1bd062c0e9f88a17ff9b3ad15e6b96a4b7332341d0fc9186ef99b2ab9bdcfa51864f21d08bce48479202c01d15470916e90fb09fef4

Download Submit
C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\com\github\junrar\junrar\0.7\junrar-0.7.jar
Filesize
151KB

MD5
75a215b9e921044cd2c88e73f6cb9745

SHA1
18cc717b85af0b12ba922abf415c2ff4716f8219

SHA256
7c764fa1af319b98ff452189ab31bb722ea74ed7a52b17b0c6282249c10a61fc

SHA512
1a44af2f3f8dbfbf38ad5f71ef11b32d5822d734f77af2cdea419fb6af845e894acb60bffbcebb4533068d86b55a22a8b0f74be20b204c2343bdb165d9c787f9

Download Submit
C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\com\google\guava\guava\19.0\guava-19.0.jar
Filesize
320KB

MD5
fc49cf0a055692e64e817b908ee21a67

SHA1
593e7594abc48310123c0e55bb2b4fb8a5fa99c2

SHA256
2c7d9038a44c2d1fbd989695206e4b0a9719ce60c3149bc83089ce325bb3334f

SHA512
63734e43c93a461a51bf7721f6c28a84072aff971fe6418bb9978c300009392b9b2d0459d875ccfba130dd2806bcbd230cdb1849590bcb1592fe9456f1bc0b2e

Download Submit
C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\com\google\inject\guice\4.1.0\guice-4.1.0.jar
Filesize
576KB

MD5
451dda22c55d43ae8c70b17e796b2915

SHA1
fbca9beaef8f2ec353980d00974ed70a868486b4

SHA256
7a0187664c7a1e7c09841d27e81fd494b26bf79e0158140cf8ca29572391125d

SHA512
9e80aff6551eb18bdce2bb108740b3aba4eb2803d1fa9eee801fd2a348589d2446e807fae7b85baed77dd5a82d39e6fa8a89c92e566ae331603f6e63dedeacb2

Download Submit
C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\dnsjava\dnsjava\2.1.8\dnsjava-2.1.8.jar
Filesize
256KB

MD5
96e26fc469eb950a7221551301a8a5c8

SHA1
e3899860d0e2980fcb0f0d70fa8cbbbca009f36f

SHA256
f5bd43f3b3fe8708500902abd6dca2008be250adccf63ef7dbbb6167d70f90e6

SHA512
9da4692cbd468d9805687a8a42e37ef16aba394c221fbbd219f98f24dfa313322d0736824364753f072be2e731dbc2220735658a097c3b55159b8ca14ebaa3eb

Download Submit
C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\apache\httpcomponents\fluent-hc\4.5.13\fluent-hc-4.5.13.jar
Filesize
30KB

MD5
8f7e4f1a95a870ebee87ddacc425362c

SHA1
300bf1846737e34b9ea10faae257ca8fdcd0616f

SHA256
f883b6b027d5e05c53e48e4fe3548715c52dbd590ffa3f52d039574f1a4d0728

SHA512
98e30ed27d6ac078450efe5e236117445c93e05eb280399e056816c52643a3a33adce5e3a885ce8488186f38d05e0fb6c65dfcbaa509be8c6047ef2f0870d9b0

Download Submit
C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\apache\logging\log4j\log4j-core\2.14.1\log4j-core-2.14.1.jar
Filesize
256KB

MD5
41fd39f0ffa70e99de25f68d0269a674

SHA1
8c800ac2e2046586533423a2171902d5516a9b6d

SHA256
5de7dda10b568588631ba09c9dc97eba220c044cf6daddf7fea880c6cccd3c8c

SHA512
e70527388df3b10236079f4000932250e184502ece79d329bc6bc2fb04a50f1a262e0294d5ac8d95628cb04b58947458c0a84e2b82ab93bf232a427b45ab1b42

Download Submit
C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\tlauncher\tlauncher-resource\1.4\tlauncher-resource-1.4.jar
Filesize
256KB

MD5
17c9d6549b8ef10f71069986a53dbe98

SHA1
29fe45b6331c056abba337cdbf9fe51f462a7b4c

SHA256
0edad990e997070292d6ee46cf5256227cfb43e5dfe6e725b49c84281dffc097

SHA512
61cf3dc297fc3c37fb3e2122cce4c6261113658397ff677765bef360319e7de969735196388faea4cd6009d65b79c10b2dc28908d6061aa30226dc2d6c31ffd3

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.BMP
Filesize
451KB

MD5
0b445ace8798426e7185f52b7b7b6d1e

SHA1
7a77b46e0848cc9b32283ccb3f91a18c0934c079

SHA256
2bbf97ccba3f87d469eac909c4ce8a3f13ed29c8f31b611e7d5cf89a0619eda6

SHA512
51523d5b711481293305465a3a3c6a3a50dca984cdc8cca1f4c44f3c21bfa430cd9aac1a8782d9605e6954cbafb307beb6b1a52e9785de1bc3f71067d80c6b6e

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG23.PNG
Filesize
1KB

MD5
fa8aa84ef4bf0de505f6e3447d4b55b3

SHA1
b99654dfa5f6c56857b4f4102af2d27503bcdc74

SHA256
f3b7e85e8e5e41496fb563816fbf79e6640feb1591bd5e0c0b876d80053ad913

SHA512
b3a7d0d5abe554301b8745bd738662d80e439fba8df6f984cc05151ec8c081a61f0538765653e8587b431cdc97d384ee35d17ab3324c06a2ca40a069e1525ba6

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNG
Filesize
45KB

MD5
2799f9daca46770a871ce1b5eed32e7c

SHA1
a2792f571210a7f38cdbe49391017300ee7b1ce4

SHA256
fc22676f5b6cdae17b78ddfd16bb070687516fbc827a7edd0541f3a32d85c9e9

SHA512
c41f2e4c4ca59d6f9d11fac11296ab87f1b508b5d64e5db7762f2f6dd387aa96206b2b0fa127f17c0b8c24a0b56e81af12d5937474a450222d9c4416c1acb16a

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG41.PNG
Filesize
457B

MD5
ce17d7ce06488f394ce124f17d5acafc

SHA1
8a5dceae9ea369b686123c8f940bb0ea07870ffa

SHA256
c4b04568930f03979d71f48a57b9ad06b4cdf687272f6753ff662006e8e6237f

SHA512
c33f1370213cabd1b84c936f1ac14f9bcc83bc03a633bbe25efe1e906bcee515d0e615c86b7ee3b34404dd1d95ce74d1a00908de8cdacbf9961de3f1ceb8362b

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG42.PNG
Filesize
352B

MD5
1f5c8939031a7f93762862cfc88a8e56

SHA1
6dc4df87344db0ddf09c777e7a80d1b5661559b8

SHA256
14be26e969eb15ef7e76e0ad02d8aa0516c5391e8b09dba0a9a6c5f57ae24aba

SHA512
de45d700c86329c704777917863fd1ddeca90d2bed67a72794164882bf15725ce83c7733f664ee0a2af7df54a6be2def729d19237fb2c434115396ac126ff47f

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG46.PNG
Filesize
206B

MD5
d8a095202e08fa1ac2578982e9a486db

SHA1
397ffc8af43ac18466b8df245b4faa6b278659e6

SHA256
28fed2b9a3cbde34da4b6b5d1af2d2844437d21f6dec85b3ca2faa5cd3b512e5

SHA512
ac751386a0004e335f4e5f4ea24bf6a474478c8a7ca54d018734e7cd44b8e9a0eb262b00fe1219b1c62c96b018b08ba6b1056d3a13e64b55c7e70d748a6ae9c6

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG48.PNG
Filesize
1KB

MD5
59d6f22fdc11d6b116b38193ed5f4b97

SHA1
cddc7eb2110b3179dd6d1e32b4b37f3568a22ebf

SHA256
782cafea76d24d76885d88ee1302e5f78d75a4e335529dc20ad476fdb9e34744

SHA512
5b0fab5139736d30a69c98ea88d95a5c70f59aab1b82394c58b33617b824447b861a6e6067b62dd1ca1812a4989937e06ad473c6c94376af957871e9e63553fa

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG5.PNG
Filesize
1KB

MD5
3094925a8de871bcc72ae50882d2a6f7

SHA1
9f7894bc4b2a498ad20b14b2b3cac175bf4d7a9f

SHA256
523e7230db0c47a436abbc442db93e41b6f549b32da6c2a10db7a18228491216

SHA512
bf2349354321397652d834507aae4c32885273209d1409b796170292e37ebf35878e2934d3f53545e66724561e646cc660f952e0bb5006cd7a262a790b64e39e

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG66.PNG
Filesize
41KB

MD5
1557c08e187b7783083e0b80051fd321

SHA1
2c6ee47799d713e88fd589609b81912a4522044e

SHA256
0c0e74dd07c45833a5dd7ba931e5d528eb16334defdd06171df2f632d6e47842

SHA512
485f69b3878b2bd7fdf52ad020dde2cbc34dd1970aaa4e5eb8f8618f6091b5b827b428447859499c3d61ea9cde2edcbb97c8fb0560cd0aaff50027c0f97ee6f3

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG67.PNG
Filesize
1KB

MD5
5eecdc666e6dc0b8e5e8d2fc3b9cc1b2

SHA1
72a16d461bd2410d5749c6bf939a127683d83a95

SHA256
052f0289886f9cc0931d7026dfe1f5253ad39123479627e37afa5c430e8f8ff1

SHA512
5d465d2c61d97ec2a52db3aeee8d42ececdef08930692842f9c6a41b0611cb774015d369e4fe5186079e97839acc78e8403ea6a6c33ee54a7aef3eea41c3d7db

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
Filesize
33KB

MD5
19930610524104699699705ae796672c

SHA1
2229788c82da992cb04960a2974fc6f3fa2fd174

SHA256
88adbe70959a1bfd861cb039390031703080f8e590dabb5baafa72a99d100e66

SHA512
d0e1229a0b3faed656ad75219bfd40c4c10d287005be1f28a3bbce648127a5f977e85b75087313d692f919bc9730a0d071b1e0c7bf30063fd057cb8843a312d2

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
Filesize
10KB

MD5
27701da4abfee86807438a26a05e602f

SHA1
8c5964f3eb12aeafbe7b6c1fa4b699b0cd4a6de6

SHA256
5ce4b3cde1651cc6a7d164a24c4258d24b1bb9004e4da823f1259fb2be5a96f1

SHA512
9fecc698c47fcaf60bc8543154eea4d21b146cf4592e43ea00f6d3b1b89792aee2e81569f35776b336d42ee73fde02fd17ec3650a2b011b07fc0dc2be2743222

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p4wuoroe.default-release\prefs.js
Filesize
6KB

MD5
fc03769491e92557713bff75b3dcae44

SHA1
a4f4687575dba8a950a014c93d8f9f086a2b68d6

SHA256
3e943e423e8dd73d3afd2444234e9c1ca4eebd430da878f5bcc15e2141da7375

SHA512
8e2266f0af8f7833397b36b31482a43a4bd798693e069f8aeb823d12b767bcdac3aed772ce10b8907fca777436e4efc39ecb5172e81d2672f1165a2427b709b4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p4wuoroe.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
d00aa548c853e542c276731c7f924fed

SHA1
a4f3cec4d7d19b85900088ad6d58bb73e7dc8d6b

SHA256
c5040863ed6c0cd3d4697329831b964b7ff7acc233a0d7d7acc34791e05b3900

SHA512
bbb25750e71e54f7bb480d308fd50890e011b22eea2b46e1ed4ede3a5219e7af8295c1b79e0c2f64a2a412931840e2e651b6abd877c0a4f4eaf538a71c7ebdc3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p4wuoroe.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize
184KB

MD5
2868ade33b3fc157edc3d0e6b6b88d96

SHA1
2fbc5d21e4b5b51b85aa242c5f1094b78b42f06f

SHA256
463716a72dce3b7c34a12818ca051fc044627890946b4437b6998bcc24a20534

SHA512
0756622f5ab9deb31b5cb909c570b236b58fd594d9ff52b92a670761f1b447a1f15f9032a50dce0bbd9b176a761fe7a5f2095938c1642bfe04b93ba83147ee0d

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Filesize
40B

MD5
b42a3b0c2895be8e6574c46680fe98bc

SHA1
82d6d71296d82c9c5520eeda0a543eddf4d49729

SHA256
f6b2176010f043b6cc9fe4427664f7e29f8d2ee68658ee6fd770eaa105a0b2e9

SHA512
60f08a5340c9811961fcac2e5fd878b760d4603ab6ae6cdff473438e1fb5eae1ea205cd38465dd6388963c00fc8c758f579cf7b09b9513f8f57dd97b1c944059

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Filesize
40B

MD5
b42a3b0c2895be8e6574c46680fe98bc

SHA1
82d6d71296d82c9c5520eeda0a543eddf4d49729

SHA256
f6b2176010f043b6cc9fe4427664f7e29f8d2ee68658ee6fd770eaa105a0b2e9

SHA512
60f08a5340c9811961fcac2e5fd878b760d4603ab6ae6cdff473438e1fb5eae1ea205cd38465dd6388963c00fc8c758f579cf7b09b9513f8f57dd97b1c944059

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Filesize
40B

MD5
b42a3b0c2895be8e6574c46680fe98bc

SHA1
82d6d71296d82c9c5520eeda0a543eddf4d49729

SHA256
f6b2176010f043b6cc9fe4427664f7e29f8d2ee68658ee6fd770eaa105a0b2e9

SHA512
60f08a5340c9811961fcac2e5fd878b760d4603ab6ae6cdff473438e1fb5eae1ea205cd38465dd6388963c00fc8c758f579cf7b09b9513f8f57dd97b1c944059

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_2303312006410874420.dll
Filesize
4.6MB

MD5
bac04c920c1505e39636c6d473721292

SHA1
f45d06f54dc4f1dd2256bbe23843be4952aca2ab

SHA256
98c6a36fc123eabe83b724f3b41735a55784ddec0173739c50124e4d7e9d22f0

SHA512
8d2a6f0354aa1557e5ccec3adb9eab59237606c29b92883cfdf106a2f924ebfba06bed6cd65b64462465ad2f11c329ed06fe36b640905bd86427c023f50c4771

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_2303312006414942804.dll
Filesize
4.6MB

MD5
bac04c920c1505e39636c6d473721292

SHA1
f45d06f54dc4f1dd2256bbe23843be4952aca2ab

SHA256
98c6a36fc123eabe83b724f3b41735a55784ddec0173739c50124e4d7e9d22f0

SHA512
8d2a6f0354aa1557e5ccec3adb9eab59237606c29b92883cfdf106a2f924ebfba06bed6cd65b64462465ad2f11c329ed06fe36b640905bd86427c023f50c4771

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_2303312006423532628.dll
Filesize
4.6MB

MD5
bac04c920c1505e39636c6d473721292

SHA1
f45d06f54dc4f1dd2256bbe23843be4952aca2ab

SHA256
98c6a36fc123eabe83b724f3b41735a55784ddec0173739c50124e4d7e9d22f0

SHA512
8d2a6f0354aa1557e5ccec3adb9eab59237606c29b92883cfdf106a2f924ebfba06bed6cd65b64462465ad2f11c329ed06fe36b640905bd86427c023f50c4771

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_2303312006431034824.dll
Filesize
4.6MB

MD5
bac04c920c1505e39636c6d473721292

SHA1
f45d06f54dc4f1dd2256bbe23843be4952aca2ab

SHA256
98c6a36fc123eabe83b724f3b41735a55784ddec0173739c50124e4d7e9d22f0

SHA512
8d2a6f0354aa1557e5ccec3adb9eab59237606c29b92883cfdf106a2f924ebfba06bed6cd65b64462465ad2f11c329ed06fe36b640905bd86427c023f50c4771

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_2303312006438532716.dll
Filesize
4.6MB

MD5
bac04c920c1505e39636c6d473721292

SHA1
f45d06f54dc4f1dd2256bbe23843be4952aca2ab

SHA256
98c6a36fc123eabe83b724f3b41735a55784ddec0173739c50124e4d7e9d22f0

SHA512
8d2a6f0354aa1557e5ccec3adb9eab59237606c29b92883cfdf106a2f924ebfba06bed6cd65b64462465ad2f11c329ed06fe36b640905bd86427c023f50c4771

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
Filesize
1.7MB

MD5
1bbf5dd0b6ca80e4c7c77495c3f33083

SHA1
e0520037e60eb641ec04d1e814394c9da0a6a862

SHA256
bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

SHA512
97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
Filesize
97KB

MD5
da1d0cd400e0b6ad6415fd4d90f69666

SHA1
de9083d2902906cacf57259cf581b1466400b799

SHA256
7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

SHA512
f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
memory/1772-613-0x0000000000080000-0x0000000000468000-memory.dmp

Filesize
3.9MB

Download
memory/1772-496-0x0000000000080000-0x0000000000468000-memory.dmp

Filesize
3.9MB

Download
memory/2308-2028-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2556-1568-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2556-1631-0x0000000000330000-0x0000000000718000-memory.dmp

Filesize
3.9MB

Download
memory/2556-612-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2556-131-0x0000000000330000-0x0000000000718000-memory.dmp

Filesize
3.9MB

Download
memory/2556-611-0x0000000000330000-0x0000000000718000-memory.dmp

Filesize
3.9MB

Download
memory/2556-1651-0x0000000000330000-0x0000000000718000-memory.dmp

Filesize
3.9MB

Download
memory/2556-469-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2556-438-0x0000000000330000-0x0000000000718000-memory.dmp

Filesize
3.9MB

Download
memory/2556-1567-0x0000000000330000-0x0000000000718000-memory.dmp

Filesize
3.9MB

Download
memory/2556-1743-0x0000000000330000-0x0000000000718000-memory.dmp

Filesize
3.9MB

Download
memory/2556-462-0x0000000000330000-0x0000000000718000-memory.dmp

Filesize
3.9MB

Download
memory/2556-439-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2556-416-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2556-2036-0x0000000000330000-0x0000000000718000-memory.dmp

Filesize
3.9MB

Download
memory/2556-418-0x0000000006540000-0x0000000006543000-memory.dmp

Filesize
12KB

Download
memory/2628-554-0x0000000000160000-0x0000000000698000-memory.dmp

Filesize
5.2MB

Download
memory/2628-557-0x0000000000160000-0x0000000000698000-memory.dmp

Filesize
5.2MB

Download
memory/2716-591-0x0000000000990000-0x0000000000EC8000-memory.dmp

Filesize
5.2MB

Download
memory/2804-549-0x0000000000990000-0x0000000000EC8000-memory.dmp

Filesize
5.2MB

Download
memory/4420-1102-0x0000000000990000-0x0000000000EC8000-memory.dmp

Filesize
5.2MB

Download
memory/4420-516-0x0000000000990000-0x0000000000EC8000-memory.dmp

Filesize
5.2MB

Download
memory/4824-589-0x0000000000990000-0x0000000000EC8000-memory.dmp

Filesize
5.2MB

Download
memory/5444-2075-0x0000000001780000-0x0000000001781000-memory.dmp

Filesize
4KB

Download
memory/5444-2088-0x0000000001780000-0x0000000001781000-memory.dmp

Filesize
4KB

Download
memory/5444-2116-0x0000000001780000-0x0000000001781000-memory.dmp

Filesize
4KB

Download
memory/5444-2127-0x0000000001780000-0x0000000001781000-memory.dmp

Filesize
4KB

Download
memory/5444-2070-0x0000000001780000-0x0000000001781000-memory.dmp

Filesize
4KB

Download
memory/5444-2161-0x0000000001780000-0x0000000001781000-memory.dmp

Filesize
4KB

Download