bazarbackdoor | 42a309cea201b01a1a135fd651fcbec0d079368ed34d5567d3cf3a3811b47266

Analysis

max time kernel
97s
max time network
100s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
02-04-2023 23:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TLauncher-2.879-Installer-1.0.9.exe
Size

22.6MB
MD5

51b145f86301e75e5108ca22403784f0
SHA1

e6990f2cf3f9d38b7458688509ce0e3f3ff5bf7d
SHA256

42a309cea201b01a1a135fd651fcbec0d079368ed34d5567d3cf3a3811b47266
SHA512

7848323b4761c8fdcd6456e6e98c67a1f41b5d40d0e9403a4d065b07c3eafaff50da936bd890ffcb092e51b39d8f71c66fa475542b4f95528cacf694e4a65e10
SSDEEP

393216:HXjnTdbGPfs/dQETVlOBbpFEjdGphRqV56Hpkf+V4scTKAjENqm:HznTdsHExi73qqHpg+Vvc+AmX

Score

10^/10

bazarbackdoor backdoor discovery spyware stealer upx

Malware Config

Signatures

BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
backdoor bazarbackdoor

Bazar/Team9 Backdoor payload 5 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\jre-windows.exe	BazarBackdoorVar3
C:\Users\Admin\AppData\Local\Temp\jre-windows.exe	BazarBackdoorVar3
\Users\Admin\AppData\Local\Temp\jre-windows.exe	BazarBackdoorVar3
\Users\Admin\AppData\Local\Temp\jre-windows.exe	BazarBackdoorVar3
C:\Users\Admin\AppData\Local\Temp\jre-windows.exe	BazarBackdoorVar3

Downloads MZ/PE file

Executes dropped EXE 12 IoCs

Processes:

irsetup.exeBrowserInstaller.exeirsetup.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exejre-windows.exeAssistant_96.0.4693.50_Setup.exe_sfx.exeassistant_installer.exeassistant_installer.exe

pid	process
1544	irsetup.exe
1240	BrowserInstaller.exe
1168	irsetup.exe
928	opera-installer-bro.exe
268	opera-installer-bro.exe
780	opera-installer-bro.exe
1512	opera-installer-bro.exe
1528	opera-installer-bro.exe
3008	jre-windows.exe
2632	Assistant_96.0.4693.50_Setup.exe_sfx.exe
2744	assistant_installer.exe
2732	assistant_installer.exe

Loads dropped DLL 41 IoCs

Processes:

TLauncher-2.879-Installer-1.0.9.exeirsetup.exeBrowserInstaller.exeirsetup.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exetaskmgr.exeassistant_installer.exe

pid	process
1556	TLauncher-2.879-Installer-1.0.9.exe
1556	TLauncher-2.879-Installer-1.0.9.exe
1556	TLauncher-2.879-Installer-1.0.9.exe
1556	TLauncher-2.879-Installer-1.0.9.exe
1544	irsetup.exe
1544	irsetup.exe
1544	irsetup.exe
1544	irsetup.exe
1544	irsetup.exe
1544	irsetup.exe
1544	irsetup.exe
1544	irsetup.exe
1240	BrowserInstaller.exe
1240	BrowserInstaller.exe
1240	BrowserInstaller.exe
1240	BrowserInstaller.exe
1168	irsetup.exe
1168	irsetup.exe
1168	irsetup.exe
1168	irsetup.exe
1168	irsetup.exe
1168	irsetup.exe
1168	irsetup.exe
1168	irsetup.exe
928	opera-installer-bro.exe
928	opera-installer-bro.exe
268	opera-installer-bro.exe
928	opera-installer-bro.exe
780	opera-installer-bro.exe
928	opera-installer-bro.exe
1512	opera-installer-bro.exe
1512	opera-installer-bro.exe
1528	opera-installer-bro.exe
1544	irsetup.exe
2088	taskmgr.exe
2088	taskmgr.exe
928	opera-installer-bro.exe
928	opera-installer-bro.exe
928	opera-installer-bro.exe
928	opera-installer-bro.exe
2744	assistant_installer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

UPX packed file 38 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
behavioral1/memory/1556-69-0x0000000002DB0000-0x0000000003198000-memory.dmp	upx
behavioral1/memory/1544-73-0x0000000000380000-0x0000000000768000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
behavioral1/memory/1544-367-0x0000000000380000-0x0000000000768000-memory.dmp	upx
behavioral1/memory/1544-390-0x0000000000380000-0x0000000000768000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
behavioral1/memory/1168-465-0x0000000001280000-0x0000000001668000-memory.dmp	upx
behavioral1/memory/1544-478-0x0000000000380000-0x0000000000768000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe	upx
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe	upx
behavioral1/memory/780-516-0x0000000001040000-0x0000000001578000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

opera-installer-bro.exeopera-installer-bro.exe

description ioc process

File opened (read-only) \??\D: opera-installer-bro.exe
File opened (read-only) \??\D: opera-installer-bro.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

irsetup.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main irsetup.exe

description	ioc	process
File opened (read-only)	\??\D:	opera-installer-bro.exe
File opened (read-only)	\??\D:	opera-installer-bro.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main	irsetup.exe

Modifies system certificate store 2 TTPs 7 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

irsetup.exeopera-installer-bro.exeirsetup.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	irsetup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	opera-installer-bro.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	opera-installer-bro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	irsetup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	irsetup.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

taskmgr.exe

pid	process
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

taskmgr.exe

pid process

2088 taskmgr.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskmgr.exe

description pid process

Token: SeDebugPrivilege 2088 taskmgr.exe

description	pid	process
Token: SeDebugPrivilege	2088	taskmgr.exe

Suspicious use of FindShellTrayWindow 45 IoCs

Processes:

taskmgr.exe

pid	process
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe

Suspicious use of SendNotifyMessage 44 IoCs

Processes:

taskmgr.exe

pid	process
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

irsetup.exeirsetup.exe

pid process

1544 irsetup.exe
1544 irsetup.exe
1544 irsetup.exe
1544 irsetup.exe
1544 irsetup.exe
1544 irsetup.exe
1168 irsetup.exe
1168 irsetup.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

TLauncher-2.879-Installer-1.0.9.exeirsetup.exeBrowserInstaller.exeirsetup.exeopera-installer-bro.exeopera-installer-bro.exe

description	pid	process	target process
PID 1556 wrote to memory of 1544	1556	TLauncher-2.879-Installer-1.0.9.exe	irsetup.exe
PID 1556 wrote to memory of 1544	1556	TLauncher-2.879-Installer-1.0.9.exe	irsetup.exe
PID 1556 wrote to memory of 1544	1556	TLauncher-2.879-Installer-1.0.9.exe	irsetup.exe
PID 1556 wrote to memory of 1544	1556	TLauncher-2.879-Installer-1.0.9.exe	irsetup.exe
PID 1556 wrote to memory of 1544	1556	TLauncher-2.879-Installer-1.0.9.exe	irsetup.exe
PID 1556 wrote to memory of 1544	1556	TLauncher-2.879-Installer-1.0.9.exe	irsetup.exe
PID 1556 wrote to memory of 1544	1556	TLauncher-2.879-Installer-1.0.9.exe	irsetup.exe
PID 1544 wrote to memory of 1240	1544	irsetup.exe	BrowserInstaller.exe
PID 1544 wrote to memory of 1240	1544	irsetup.exe	BrowserInstaller.exe
PID 1544 wrote to memory of 1240	1544	irsetup.exe	BrowserInstaller.exe
PID 1544 wrote to memory of 1240	1544	irsetup.exe	BrowserInstaller.exe
PID 1544 wrote to memory of 1240	1544	irsetup.exe	BrowserInstaller.exe
PID 1544 wrote to memory of 1240	1544	irsetup.exe	BrowserInstaller.exe
PID 1544 wrote to memory of 1240	1544	irsetup.exe	BrowserInstaller.exe
PID 1240 wrote to memory of 1168	1240	BrowserInstaller.exe	irsetup.exe
PID 1240 wrote to memory of 1168	1240	BrowserInstaller.exe	irsetup.exe
PID 1240 wrote to memory of 1168	1240	BrowserInstaller.exe	irsetup.exe
PID 1240 wrote to memory of 1168	1240	BrowserInstaller.exe	irsetup.exe
PID 1240 wrote to memory of 1168	1240	BrowserInstaller.exe	irsetup.exe
PID 1240 wrote to memory of 1168	1240	BrowserInstaller.exe	irsetup.exe
PID 1240 wrote to memory of 1168	1240	BrowserInstaller.exe	irsetup.exe
PID 1168 wrote to memory of 928	1168	irsetup.exe	opera-installer-bro.exe
PID 1168 wrote to memory of 928	1168	irsetup.exe	opera-installer-bro.exe
PID 1168 wrote to memory of 928	1168	irsetup.exe	opera-installer-bro.exe
PID 1168 wrote to memory of 928	1168	irsetup.exe	opera-installer-bro.exe
PID 1168 wrote to memory of 928	1168	irsetup.exe	opera-installer-bro.exe
PID 1168 wrote to memory of 928	1168	irsetup.exe	opera-installer-bro.exe
PID 1168 wrote to memory of 928	1168	irsetup.exe	opera-installer-bro.exe
PID 928 wrote to memory of 268	928	opera-installer-bro.exe	opera-installer-bro.exe
PID 928 wrote to memory of 268	928	opera-installer-bro.exe	opera-installer-bro.exe
PID 928 wrote to memory of 268	928	opera-installer-bro.exe	opera-installer-bro.exe
PID 928 wrote to memory of 268	928	opera-installer-bro.exe	opera-installer-bro.exe
PID 928 wrote to memory of 268	928	opera-installer-bro.exe	opera-installer-bro.exe
PID 928 wrote to memory of 268	928	opera-installer-bro.exe	opera-installer-bro.exe
PID 928 wrote to memory of 268	928	opera-installer-bro.exe	opera-installer-bro.exe
PID 928 wrote to memory of 780	928	opera-installer-bro.exe	opera-installer-bro.exe
PID 928 wrote to memory of 780	928	opera-installer-bro.exe	opera-installer-bro.exe
PID 928 wrote to memory of 780	928	opera-installer-bro.exe	opera-installer-bro.exe
PID 928 wrote to memory of 780	928	opera-installer-bro.exe	opera-installer-bro.exe
PID 928 wrote to memory of 780	928	opera-installer-bro.exe	opera-installer-bro.exe
PID 928 wrote to memory of 780	928	opera-installer-bro.exe	opera-installer-bro.exe
PID 928 wrote to memory of 780	928	opera-installer-bro.exe	opera-installer-bro.exe
PID 928 wrote to memory of 1512	928	opera-installer-bro.exe	opera-installer-bro.exe
PID 928 wrote to memory of 1512	928	opera-installer-bro.exe	opera-installer-bro.exe
PID 928 wrote to memory of 1512	928	opera-installer-bro.exe	opera-installer-bro.exe
PID 928 wrote to memory of 1512	928	opera-installer-bro.exe	opera-installer-bro.exe
PID 928 wrote to memory of 1512	928	opera-installer-bro.exe	opera-installer-bro.exe
PID 928 wrote to memory of 1512	928	opera-installer-bro.exe	opera-installer-bro.exe
PID 928 wrote to memory of 1512	928	opera-installer-bro.exe	opera-installer-bro.exe
PID 1512 wrote to memory of 1528	1512	opera-installer-bro.exe	opera-installer-bro.exe
PID 1512 wrote to memory of 1528	1512	opera-installer-bro.exe	opera-installer-bro.exe
PID 1512 wrote to memory of 1528	1512	opera-installer-bro.exe	opera-installer-bro.exe
PID 1512 wrote to memory of 1528	1512	opera-installer-bro.exe	opera-installer-bro.exe
PID 1512 wrote to memory of 1528	1512	opera-installer-bro.exe	opera-installer-bro.exe
PID 1512 wrote to memory of 1528	1512	opera-installer-bro.exe	opera-installer-bro.exe
PID 1512 wrote to memory of 1528	1512	opera-installer-bro.exe	opera-installer-bro.exe
PID 1544 wrote to memory of 3008	1544	irsetup.exe	jre-windows.exe
PID 1544 wrote to memory of 3008	1544	irsetup.exe	jre-windows.exe
PID 1544 wrote to memory of 3008	1544	irsetup.exe	jre-windows.exe
PID 1544 wrote to memory of 3008	1544	irsetup.exe	jre-windows.exe
PID 928 wrote to memory of 2632	928	opera-installer-bro.exe	Assistant_96.0.4693.50_Setup.exe_sfx.exe
PID 928 wrote to memory of 2632	928	opera-installer-bro.exe	Assistant_96.0.4693.50_Setup.exe_sfx.exe
PID 928 wrote to memory of 2632	928	opera-installer-bro.exe	Assistant_96.0.4693.50_Setup.exe_sfx.exe
PID 928 wrote to memory of 2632	928	opera-installer-bro.exe	Assistant_96.0.4693.50_Setup.exe_sfx.exe

C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe
"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe" "__IRCT:3" "__IRTSS:23652905" "__IRSID:S-1-5-21-3430344531-3702557399-3004411149-1000"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Modifies system certificate store
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1240
  - - C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816850 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:1841947" "__IRSID:S-1-5-21-3430344531-3702557399-3004411149-1000"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies system certificate store
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1168
    - - C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
        
        "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        Modifies system certificate store
        Suspicious use of WriteProcessMemory
        
        PID:928
      - C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
        
        C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=97.0.4719.43 --initial-client-data=0x1a4,0x1a8,0x1ac,0x178,0x1b0,0x70ed33e0,0x70ed33f0,0x70ed33fc
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:268
      - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe" --version
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:780
      - C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
        
        "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=928 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20230403013957" --session-guid=8403dd37-9f26-4c1e-ac85-1e9f0920ffdb --server-tracking-blob=YWYxMTdlZjRmNWJmOTQ2ZGRjZDI0MDMwNDMwZDhkNWEwNGZlYzc0OWUwN2ZiMjAzODUzOTJmZjYxZWJlOWNiMjp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjciLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNjgwNDc4Nzk0LjAwNDMiLCJ1c2VyYWdlbnQiOiJTZXR1cCBGYWN0b3J5IDkuMCIsInV0bSI6eyJjYW1wYWlnbiI6Ik9wZXJhRGVza3RvcCIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Ik1TVEwifSwidXVpZCI6IjI1NjIyMmRkLTI5ZWItNDNjMi05NDFlLTdhNDQxNDM1ZjU2YiJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=0403000000000000
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        Suspicious use of WriteProcessMemory
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
        
        C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=97.0.4719.43 --initial-client-data=0x1b0,0x1b4,0x1b8,0x178,0x1bc,0x704533e0,0x704533f0,0x704533fc
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1528
      - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304030139571\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304030139571\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe"
        6⤵
        Executes dropped EXE
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304030139571\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304030139571\assistant\assistant_installer.exe" --version
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304030139571\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304030139571\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=96.0.4693.50 --initial-client-data=0x148,0x14c,0x150,0x11c,0x154,0x326c28,0x326c38,0x326c44
        7⤵
        Executes dropped EXE
        
        PID:2732
- - C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
    "C:\Users\Admin\AppData\Local\Temp\jre-windows.exe" STATIC=1
    3⤵
    - Executes dropped EXE
    PID:3008

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2088

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

Filesize
471B

MD5
5e1bdc1b52a7cb2808d186d90dffca07

SHA1
6e4e26f86558c08376dd916971246f3241b68af2

SHA256
7a5f46a4867ea1bd02e7ddf0c9ebeeee22c1cc908535656b4cd6a5eafd1fafc5

SHA512
a397cf2b87a8ac9aaa832ffe142320fbe314ba71cb7aefae678a525d6dc384db3ea1169383cb3eb4f21f8009be442f1a0e938c21ce80cc1602b6186541c50214

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8d2c0e3f392d68988596a21c567cd74

SHA1
a6ef7448e1ff2a8337c814cad784dd89255f268b

SHA256
8777e02be9afd0833b0319250f62368fc910cf8074cb06f4f2d08405b2a38f48

SHA512
4f0a827027c2a7a25871c9e898b6779074af77c1c5d8c9296d9e96b5c156d5149e8b1e53135d7a4402192c7d6328d72662981c602ec0035c0e7714fc6b9cd6c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

Filesize
434B

MD5
fbc6136def650bf6cd3ad5510fc079ba

SHA1
8bd6d3c4e447cfcd566d3bdc26c83db2aa6750ed

SHA256
da87b2495993477e3aba304b12371efe7d25b2c58741e44c710d0d2339225977

SHA512
d57a61a8e4a5e52ddaac3aa70c35679593c9019dbcfc28b4157637bec1bea4ec3e2b6937c512a4078f96fdc39988b7a16269b3cb3f4296fdae28edae61fbbd8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
4fe39970d6e3d3f9f83625d975e3d408

SHA1
31b94ddb7009732e1166d55c2600dc1f2475c547

SHA256
03a41c8ef4bcbceba52478a26bccc6ca2d86b9d91624cedc981b843d79c5699b

SHA512
8491e80de299dc992ab6deb8e5beaf2a8abea062cfc7948b7cc58ed4bb764160ff0775cab636b470cf8c4498a2fcc4bc422c6479da71f48742b31551378f0735

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
d29ecf94fe59908428c21bb507f6fd64

SHA1
2eb15a663a96c6f9b5a3da8ea61495199e585753

SHA256
49c5e9a0b605b6cd078a546ba66347ad4f500fe620427345bbcc803ca3d12630

SHA512
68f3c465cadbe00d38efad883a90a18291704d82fc39fd5ced1dff7fd88f58e1930ec8ba0fa9e50cc0532d5b89405ddf3ed73646fd3daf0ee5c577e3f10eae91

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304030139571\additional_file0.tmp

Filesize
1.7MB

MD5
b386cdcb413405daa8219af8e4cbd318

SHA1
ce275ff8514fef0629c915a6ee7b5ac481b9043d

SHA256
408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e

SHA512
91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304030139571\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe

Filesize
1.7MB

MD5
b386cdcb413405daa8219af8e4cbd318

SHA1
ce275ff8514fef0629c915a6ee7b5ac481b9043d

SHA256
408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e

SHA512
91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304030139571\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe

Filesize
1.7MB

MD5
b386cdcb413405daa8219af8e4cbd318

SHA1
ce275ff8514fef0629c915a6ee7b5ac481b9043d

SHA256
408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e

SHA512
91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304030139571\assistant\assistant_installer.exe

Filesize
2.1MB

MD5
2f3d9e21e232b9bfea064d3b2264db06

SHA1
bafddc657d8d1bb531683b29b0342cc065ee51d2

SHA256
25528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d

SHA512
94e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304030139571\opera_package

Filesize
86.9MB

MD5
6b7771354e081eb94cdbf7627799da4f

SHA1
199341a750443cc6e9b2b2fa1e657d0dd327711f

SHA256
494d1247e61eebf703a6eb19c14bde88edd2f85515fefa4f0465f43873e69aab

SHA512
33e781a102ba3f5c3b1895540bc9c43b78bf4f19af4b91ae0c765594f39d6569d1bad207b33f808426d8ebdcb00c419b7bb76bb050bae0bb843f96dd84355800

Download Submit
C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAB7E.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_230403013955178780.dll

Filesize
4.6MB

MD5
bac04c920c1505e39636c6d473721292

SHA1
f45d06f54dc4f1dd2256bbe23843be4952aca2ab

SHA256
98c6a36fc123eabe83b724f3b41735a55784ddec0173739c50124e4d7e9d22f0

SHA512
8d2a6f0354aa1557e5ccec3adb9eab59237606c29b92883cfdf106a2f924ebfba06bed6cd65b64462465ad2f11c329ed06fe36b640905bd86427c023f50c4771

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1789.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAB10.tmp

Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico

Filesize
116KB

MD5
e043a9cb014d641a56f50f9d9ac9a1b9

SHA1
61dc6aed3d0d1f3b8afe3d161410848c565247ed

SHA256
9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946

SHA512
4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe

Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.PNG

Filesize
339B

MD5
bfd3f5e88b85b08269a1209c7efff5ef

SHA1
831bb68b2118d3037b34316e8290f3aaaa986a9b

SHA256
a1c5e2e49e3cc71793e79d5be2e8d6f7aa5490c9262675d6db0e3fd537fc42eb

SHA512
95b76358b3bfbd31914d6b1db578aa0e5a19b1e352833df9537a02dc6c2084676eaaeb36ac7fbf397a5ba43b16068df7109b3e84bfaa398b8b7175993bd2edd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG104.PNG

Filesize
644B

MD5
74cbb6a9510a5af4e84765729f03aef0

SHA1
44e70d3263b85bcbbf3f40c0b7710284eaed32f8

SHA256
224e1afab80a44dc6bf440bf4a3f3a9535485c271dd38eeefac83cad3a82536e

SHA512
305a8b0f3fd989af6460018bd88edeaf02ff50815d2d8f7553fa511f33eaee9427095f5d0412e7f53e769bf26ef3222cb6df95c4a68ae473fef85d285819641d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG106.PNG

Filesize
1KB

MD5
b7cfb0f1ee970200738032c7fdfafb8a

SHA1
782983a0e45c87dab5cce32ff637a13080974ea0

SHA256
37c452dd1271e745104e4aebd7e7b8785b6af6951d10f875a627d4fb4b2a36dc

SHA512
2d7079311e5c034cb40da1dfefb42a84d722c84e8dcb532961f5848cb5f693c6876d29538ec120381ae1c838f4c5fdc988609f76c663ca34d41fd88c6edd772f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG109.PNG

Filesize
2KB

MD5
0e0557b9f62fce2322fa993c91b2e2e7

SHA1
3c31d21dcb323a3faf47dc04663275e2581013b1

SHA256
7cdc6702979255bdc4b0ee0099593e88c94e563f00bfcca3c7d680f2bb2df3dc

SHA512
48bcf980c20e5b9f587d3c9277855171120cf4ef2d3e7f9aed1bfc8e3f894e28043760c5febad7f3806752b1d388ea1a80092351fac107461023fb7bce9cdd6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG124.PNG

Filesize
40KB

MD5
6bcf4aff24c28919bf7c8c76c1c13bfd

SHA1
87776afed17d9f9b3a21fabdb530b4083eca3635

SHA256
03a9cdf6e58e6fbf4158af65ba7465a6463a7d2cfefae2b2bcf705f33771149e

SHA512
12fabd4f1818f31d5ca42c7299b576a6b31232b1c2abb468b256df3d57727dce9395affc4ba6334d7362ba1e57022b5341ffc908e08d019bc1ddc4f94a400e68

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.PNG

Filesize
280B

MD5
c26a8c3c8a1b4cfa66a04954682cbd00

SHA1
a0fe409f7c63212fa96af3d27e985d1b636d7f5e

SHA256
b215bf4f48b4f943c61a43675ca768f8ff8fa4da813fa3c969a26be550e37b15

SHA512
4088e0d60d5e88ca877af034ee3134a3dec626efcea9a498dfa93c532b77e17f90aca02e03262cf179562136f3b2928d330d3e18dcc9180d22f63c926699baad

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG22.PNG

Filesize
1KB

MD5
1d20e2d3d0534910b3ceb2659e36b202

SHA1
b36edff00ddd65e57196ca8b650e73fd3d5ee16d

SHA256
0e2c443067936fbcf70f7bcd3f957dcd691124a6684056c1e8407609f6d64226

SHA512
17e9dcb016a4609ea756fe8bf781aa0620f694c67b3135ee24ec03208033aea03ac8f70e445e4fe4a8d707aa7166e13bc284c58cf768a7b9ae1ddbe3ca5f1526

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.PNG

Filesize
281B

MD5
ad413a1fa3406283529429463b3c3582

SHA1
541632da39b89d6370444569130a8780e4917886

SHA256
8fb2c6302a6f56fb23e6a2fd1e5e52136941ac1037c40c26ed5d63c9f71c1a27

SHA512
9dd27101508bc457257a58c4df2473c4050be11f55c6b8b9d670c63d52410e216ac99328aceb25035e88202cab177e9303834441fce3c84677173b2ae3f9ffa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG85.PNG

Filesize
43KB

MD5
a99cea0ae59b6200452ce912f755ebbf

SHA1
84d44cb1e98d59c64b85dd1d447a01e11e18c9d8

SHA256
ae007f0ee65aa1ea5f0a11f116a7613aa61c67259817f3ac2d7fde299a63e174

SHA512
fc9e5f4aa8551a01e7567df4d1ea764966bb4ec7c177c662f4a82c2095fa12f30d67a64c30d03d08ce72267b924eb78c9bd1e0d9ac4da3797cef36f46d5eaa51

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG86.PNG

Filesize
1KB

MD5
9df48291509b109da6fa8565dc46ebd0

SHA1
15e0c52b88cd73f4e294c5b469461e1666fc280a

SHA256
19210a58182587ee81486ca8357177df48bcd667cc4fbdb434965988b02cbb4e

SHA512
4e0136b2170c52762a64d1232cfe2638f059d3cc5337336501f40c369672241cba955433d707d6f3e8bae6f326eff1083be0cecbba0c6da535947641626197b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

Filesize
1.7MB

MD5
1bbf5dd0b6ca80e4c7c77495c3f33083

SHA1
e0520037e60eb641ec04d1e814394c9da0a6a862

SHA256
bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

SHA512
97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

Filesize
97KB

MD5
da1d0cd400e0b6ad6415fd4d90f69666

SHA1
de9083d2902906cacf57259cf581b1466400b799

SHA256
7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

SHA512
f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
9597a91c491d87dfb8209de6b878fe8b

SHA1
da77262030402d701d697c65c7d60d70ff8af4be

SHA256
81fdafeef0c0e4c41a687b3072a86efc96a7d5df4c015d66ba2016e065544208

SHA512
b76480193c755e6d83ec7c257d3efe6800fb8f84169ca61096941aa5fa660218e0239e083fdbb9a1e49a0e0d317236c34de1232d827ec8e740d860bf46e9fcb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
9597a91c491d87dfb8209de6b878fe8b

SHA1
da77262030402d701d697c65c7d60d70ff8af4be

SHA256
81fdafeef0c0e4c41a687b3072a86efc96a7d5df4c015d66ba2016e065544208

SHA512
b76480193c755e6d83ec7c257d3efe6800fb8f84169ca61096941aa5fa660218e0239e083fdbb9a1e49a0e0d317236c34de1232d827ec8e740d860bf46e9fcb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
9597a91c491d87dfb8209de6b878fe8b

SHA1
da77262030402d701d697c65c7d60d70ff8af4be

SHA256
81fdafeef0c0e4c41a687b3072a86efc96a7d5df4c015d66ba2016e065544208

SHA512
b76480193c755e6d83ec7c257d3efe6800fb8f84169ca61096941aa5fa660218e0239e083fdbb9a1e49a0e0d317236c34de1232d827ec8e740d860bf46e9fcb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat

Filesize
114KB

MD5
bd5626a0237933e0f1dccf10e7c9fbd6

SHA1
10c47d382d4f44d8d44efaa203501749e42c6d50

SHA256
7dfc1176d8a507135140b23a0c014093b7e2673f0f3e5727c3d85df4e7323762

SHA512
1fd864a5386580cf8bbafbacb12a043ef51948b729b9aedfe6dc81e6c2948a100526c7c600069f22454d550f7f736ad3045a930cc2ef97458dc1d6c782928087

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
018c68cdf5ba005b4a380c20b13fee4c

SHA1
bf6043fbd31288e8667fcfc37cd74414bee1805f

SHA256
3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

SHA512
506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
018c68cdf5ba005b4a380c20b13fee4c

SHA1
bf6043fbd31288e8667fcfc37cd74414bee1805f

SHA256
3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

SHA512
506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
018c68cdf5ba005b4a380c20b13fee4c

SHA1
bf6043fbd31288e8667fcfc37cd74414bee1805f

SHA256
3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

SHA512
506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jre-windows.exe

Filesize
63.6MB

MD5
9b50d63d8327b22293e749ceb0a51473

SHA1
bc25a0b366a1b8dcbe982dd4aa9d5dd6c660536c

SHA256
61ba207f6d7d44f1404b036a2745558d708e052d76b88f80be44c5e544aff32f

SHA512
09cdf1203b112f121da9d74490932308381ad496af5d9880d5746ee46d65c4cdcf7fdb15c90d8de781f160edbcc3316d77e8fa169464efb6811156251d49cc37

Download Submit
C:\Users\Admin\AppData\Local\Temp\jre-windows.exe

Filesize
73.1MB

MD5
03bdca6cb84617538f61fc04ad318aca

SHA1
2e7c71012697d5485a3195a854d1b954edc9a875

SHA256
94d66e7ea36741bddc7b794d936fe2e9d61a35ccd3ec7eeec2f69346ef3d09d2

SHA512
a17919b68d33cc40e7d56ffcf20314cf7ac5b2db4b9a2de59b9df7d7accf0e386962c220d29227b5081836e31a663c2926131eb8c65b9921433cf121dd94665b

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
d29ecf94fe59908428c21bb507f6fd64

SHA1
2eb15a663a96c6f9b5a3da8ea61495199e585753

SHA256
49c5e9a0b605b6cd078a546ba66347ad4f500fe620427345bbcc803ca3d12630

SHA512
68f3c465cadbe00d38efad883a90a18291704d82fc39fd5ced1dff7fd88f58e1930ec8ba0fa9e50cc0532d5b89405ddf3ed73646fd3daf0ee5c577e3f10eae91

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
d29ecf94fe59908428c21bb507f6fd64

SHA1
2eb15a663a96c6f9b5a3da8ea61495199e585753

SHA256
49c5e9a0b605b6cd078a546ba66347ad4f500fe620427345bbcc803ca3d12630

SHA512
68f3c465cadbe00d38efad883a90a18291704d82fc39fd5ced1dff7fd88f58e1930ec8ba0fa9e50cc0532d5b89405ddf3ed73646fd3daf0ee5c577e3f10eae91

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
d29ecf94fe59908428c21bb507f6fd64

SHA1
2eb15a663a96c6f9b5a3da8ea61495199e585753

SHA256
49c5e9a0b605b6cd078a546ba66347ad4f500fe620427345bbcc803ca3d12630

SHA512
68f3c465cadbe00d38efad883a90a18291704d82fc39fd5ced1dff7fd88f58e1930ec8ba0fa9e50cc0532d5b89405ddf3ed73646fd3daf0ee5c577e3f10eae91

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
d29ecf94fe59908428c21bb507f6fd64

SHA1
2eb15a663a96c6f9b5a3da8ea61495199e585753

SHA256
49c5e9a0b605b6cd078a546ba66347ad4f500fe620427345bbcc803ca3d12630

SHA512
68f3c465cadbe00d38efad883a90a18291704d82fc39fd5ced1dff7fd88f58e1930ec8ba0fa9e50cc0532d5b89405ddf3ed73646fd3daf0ee5c577e3f10eae91

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
d29ecf94fe59908428c21bb507f6fd64

SHA1
2eb15a663a96c6f9b5a3da8ea61495199e585753

SHA256
49c5e9a0b605b6cd078a546ba66347ad4f500fe620427345bbcc803ca3d12630

SHA512
68f3c465cadbe00d38efad883a90a18291704d82fc39fd5ced1dff7fd88f58e1930ec8ba0fa9e50cc0532d5b89405ddf3ed73646fd3daf0ee5c577e3f10eae91

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
d29ecf94fe59908428c21bb507f6fd64

SHA1
2eb15a663a96c6f9b5a3da8ea61495199e585753

SHA256
49c5e9a0b605b6cd078a546ba66347ad4f500fe620427345bbcc803ca3d12630

SHA512
68f3c465cadbe00d38efad883a90a18291704d82fc39fd5ced1dff7fd88f58e1930ec8ba0fa9e50cc0532d5b89405ddf3ed73646fd3daf0ee5c577e3f10eae91

Download Submit
C:\Users\Admin\AppData\Local\Temp\setuparguments.ini

Filesize
590B

MD5
4c8e46eb92b5e22b83a499fc0f397e46

SHA1
ebd983826d22dbb8a07c96c8a10689854d5bd25a

SHA256
5e9c11f6097b2b540d545f185a8db39533a2936485c220a20d4c26999ff9ed5d

SHA512
49f87b3bc9e5ad4ecfd27560e30aec925ff529b6e93cac74a5c67707641ce214f506bf81bcaa2a8d050de934fc9905a4ad32f5ef966d9b0e2690475132ffa197

Download Submit
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

Filesize
6.3MB

MD5
545c62b3d98ee4cc02af837a72dd09c4

SHA1
54446a007fd9b7363d9415673b0ac0232d5d70d5

SHA256
738029a4f974128180fa2cd239e873b01e456e8bf53bfdbf34b8ba8b57897be4

SHA512
8bf9c754861ed267efd2055ac09b4ad44df61b989859fccd14190592dca1dab0fa8f57360209eaceabb5137f742c9cea73a1a985ab1955f87a6875d0be95fdcf

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.BMP

Filesize
451KB

MD5
0b445ace8798426e7185f52b7b7b6d1e

SHA1
7a77b46e0848cc9b32283ccb3f91a18c0934c079

SHA256
2bbf97ccba3f87d469eac909c4ce8a3f13ed29c8f31b611e7d5cf89a0619eda6

SHA512
51523d5b711481293305465a3a3c6a3a50dca984cdc8cca1f4c44f3c21bfa430cd9aac1a8782d9605e6954cbafb307beb6b1a52e9785de1bc3f71067d80c6b6e

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG23.PNG

Filesize
1KB

MD5
8402b903804427eb60533887407e9e3f

SHA1
9ff615c4441fd6e8c2a998e9728f2df91b79926d

SHA256
3c3728982174ca5451f0fd830e1c33f9c92faa46e2e0492186d980b969db6e2c

SHA512
9a193bdc7f17ea6ba20f8bc3fcde1aaf5925508e4d4cf5f3483f96226b79a2bbda27b888d30475c5967f67809454cee6a41108ab9a18a6e62206fb9ea28fc5de

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNG

Filesize
45KB

MD5
233878a1dfdf615c0e1dc81530aa5302

SHA1
2cd4b1b5d072e3aec82eedf6a87b6c38bb59ef9a

SHA256
765cd11265661ef8aba10bafa1330b2311a309c6f8209cbef6ea1f4e7a6c922e

SHA512
c2fd7427dfe2fc564389ae1f86155901e11068ecf502d2e43c9e5f018b91a05e2952b08ea984b52e20ba8c83569b193bcf5ffb9b19b6e2e521d92c8086db6ed2

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG42.PNG

Filesize
352B

MD5
3ebb90db69ab4f89a809ae955ce084db

SHA1
99cc932c29c7195393a374891e86f2212caed004

SHA256
d20387a537000d2e53048ddf7554c02a3fe095a22d6d6232cf882a4eb4808d39

SHA512
4dab7ff56e46d08afe5649e7da7dd205d2a48ed4e600be03827828d5aa48abf4912f61f19dca0aa63f4243d848af67107caa4212a63c02a0cc6a804f9221361d

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG45.PNG

Filesize
438B

MD5
93ab8d6d5e320bb55107ed481364e990

SHA1
151a55018eaf7e439791912786701068fbf3a401

SHA256
696bd78a46953d9314b3193983df419f4dcd016b5d31369bd3f3e3b364efc641

SHA512
7b19c69f69cff9f5505f4637eb71364a347fcfb4771f0c91a881f297a527fc347a73c26a259a69e5cbba164ec416d942d5c1188cd24f9dbb425b494db2d48823

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG46.PNG

Filesize
206B

MD5
c2a26bbdeacb81dd7f8f6bb2bea4a932

SHA1
ed9add65433be66e6a62133632eacf505d23264d

SHA256
9c2e4c1cc89258d95ef6702b7a62d722fdd82ae18f7aab62278aff88ae55a6a9

SHA512
8303b6a274e1d663e9255429dedbbb1eb2b232303d2cce9a6942257c14cc358126684e4bf11f7c111a5cf0063067aa487854daefedf7a4917f6b75b0b6452dcd

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG48.PNG

Filesize
1KB

MD5
eb70c64eb9637567556946524aaba3c8

SHA1
5e5574aef69a542c92a366c82d1e5cbd54d9778f

SHA256
c1a8a2116ffea80a1ce556fc51174e46be705310e7cafd9a150035056de9c588

SHA512
8c547e03982e75b00801a4a56cf55705e13f26d17e578d0c7ceab0effd1576863416ee2cbf5f205c306b206bd0ff39ab950276dc4a554d8440d85ef4c7112d87

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG5.PNG

Filesize
1KB

MD5
8aa76bec130c6e445b9afc13e069c705

SHA1
f33b780d401e898ce376dfcc17022efb282613f9

SHA256
f1a88c950c4342a6d2f972ed57d4b2d2bea8d17c76cfaa852aaf8247cb392918

SHA512
76a1a4ff5aad4a839d50e3ecb84130e0335dcbf7ddeaf4f5b36327fdacad92ee13cc3018ab706b3bf0553eca428fa0d2f9c4080007cbeba5042841387c505809

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG66.PNG

Filesize
41KB

MD5
0339f5d817fd1dd5abee2deb93183118

SHA1
e49bbc34cca35193272b7ce66760dc32e5c19334

SHA256
f110d8f101c31fb2c09f6d41a35b8c561c706f88467923052750781bd5fce37f

SHA512
08e0f45b68cd9e83d018e988de0b0b76dd8b9433f5def67f2137336dbef28bce69f6754b64bd26b04931811351a74d4c58cba4dce547a86d937e4980f1416147

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG67.PNG

Filesize
1KB

MD5
0d49244ce1c34d0ac58389f7403f60e8

SHA1
1c0a3b4b89a0b937231c86cb80e0d4f2214a29c5

SHA256
e5cb63d87eebf491c4fcef41e9a0a2a6f7ceb3f5685932f5f4e9ec158b7dfb65

SHA512
a4362b18c67d4881b952727005902ad9852a2dda45426d1077961199c0d22130a20a0447e05e588e20b0bdcc4224f8a271929864ce476477091d4349f4ce21f5

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

Filesize
33KB

MD5
eeab35992fd564631ab198250a14824a

SHA1
924f51846a33fb51bdb7680f7e32ef499cf5d9eb

SHA256
a95984d08a3687e8bc981c3714642481c2057b7c351dd05914913190671f5576

SHA512
cd15d1b05921e56563f50cb1b87440cc0d107fc6b52727f68037806d686039b5b42aa42dab2410d6f89598c78c0411ee18d5ed7b98128f4c42c4db7368daba9e

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

Filesize
11KB

MD5
cc01fe5f8bfae914741b8651691705cf

SHA1
7564a173efbf4473ff66f6556281fb8dd5d264eb

SHA256
8ef0fb1367b6af28da6350a152f75e79889a9534e52c24f82e49fe9a0665af92

SHA512
b3856370d0f47ee86aae3b1211d2875b83e4294e744d82ecbb616fce37dad0c755b6f6b7ed57e1fa8781b169687a90964a5e8935844052baf5412221cbe75196

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

Filesize
40B

MD5
bed3afdac72bc9a3186f744f4630023b

SHA1
bdb8a7d7b93a3724937143a73ca23be578a60079

SHA256
0264fa51a1052e12c3d72055356470fc632b9ce399b915091c0cde6b8e2c540a

SHA512
02992a1f7bc7a66232c2b7324cfd5fd2ee1a39f8baaadfcc67c736df9a04cc5fdf8de8828143269babf7c9ff8270e035ddd6da66e367ea8b8cb658b5ff2a1b5e

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

Filesize
40B

MD5
bed3afdac72bc9a3186f744f4630023b

SHA1
bdb8a7d7b93a3724937143a73ca23be578a60079

SHA256
0264fa51a1052e12c3d72055356470fc632b9ce399b915091c0cde6b8e2c540a

SHA512
02992a1f7bc7a66232c2b7324cfd5fd2ee1a39f8baaadfcc67c736df9a04cc5fdf8de8828143269babf7c9ff8270e035ddd6da66e367ea8b8cb658b5ff2a1b5e

Download Submit
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
d29ecf94fe59908428c21bb507f6fd64

SHA1
2eb15a663a96c6f9b5a3da8ea61495199e585753

SHA256
49c5e9a0b605b6cd078a546ba66347ad4f500fe620427345bbcc803ca3d12630

SHA512
68f3c465cadbe00d38efad883a90a18291704d82fc39fd5ced1dff7fd88f58e1930ec8ba0fa9e50cc0532d5b89405ddf3ed73646fd3daf0ee5c577e3f10eae91

Download Submit
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304030139571\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe

Filesize
1.7MB

MD5
b386cdcb413405daa8219af8e4cbd318

SHA1
ce275ff8514fef0629c915a6ee7b5ac481b9043d

SHA256
408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e

SHA512
91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

Download Submit
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304030139571\assistant\assistant_installer.exe

Filesize
2.1MB

MD5
2f3d9e21e232b9bfea064d3b2264db06

SHA1
bafddc657d8d1bb531683b29b0342cc065ee51d2

SHA256
25528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d

SHA512
94e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5

Download Submit
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304030139571\opera_package

Filesize
32.9MB

MD5
373a876e99d8d08eba1cbccf5cf8246e

SHA1
f3e8a5bcb141ce8bbf17d727485fc177cb4e893d

SHA256
2b5ed7f51dd1c45de374c2e37bc8fd141a255ce9a3901f9e2ef4301ade0217a5

SHA512
0c6c870dc0ec612186267a789d0b5f21112141bddf6e43cd071a0dcaa8a78475d485c0aa941dd904a2b63d9b13ef64b56bc55095e50e43a7af93a1a3355d4f9e

Download Submit
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304030139571\opera_package

Filesize
34.8MB

MD5
b5bca09659355e28c26ae27f192f11b8

SHA1
caf027480631444c4e9a5be5f70546846d6514c6

SHA256
7487c01e54e5beb5a3543a26afe19ca66da6ed783a8e045820ea7808c66ce3bb

SHA512
704dc999fa9373dc57940829c5aae8b67cd29b4cb39d0b5d5db26bcbf428733948f9acf124ea6d0b5e98986e0f4b06ff99dc6a3747b8608e63e10a13b58f3d92

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_230403013953711928.dll

Filesize
4.6MB

MD5
bac04c920c1505e39636c6d473721292

SHA1
f45d06f54dc4f1dd2256bbe23843be4952aca2ab

SHA256
98c6a36fc123eabe83b724f3b41735a55784ddec0173739c50124e4d7e9d22f0

SHA512
8d2a6f0354aa1557e5ccec3adb9eab59237606c29b92883cfdf106a2f924ebfba06bed6cd65b64462465ad2f11c329ed06fe36b640905bd86427c023f50c4771

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_230403013954101268.dll

Filesize
4.6MB

MD5
bac04c920c1505e39636c6d473721292

SHA1
f45d06f54dc4f1dd2256bbe23843be4952aca2ab

SHA256
98c6a36fc123eabe83b724f3b41735a55784ddec0173739c50124e4d7e9d22f0

SHA512
8d2a6f0354aa1557e5ccec3adb9eab59237606c29b92883cfdf106a2f924ebfba06bed6cd65b64462465ad2f11c329ed06fe36b640905bd86427c023f50c4771

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_230403013955178780.dll

Filesize
4.6MB

MD5
bac04c920c1505e39636c6d473721292

SHA1
f45d06f54dc4f1dd2256bbe23843be4952aca2ab

SHA256
98c6a36fc123eabe83b724f3b41735a55784ddec0173739c50124e4d7e9d22f0

SHA512
8d2a6f0354aa1557e5ccec3adb9eab59237606c29b92883cfdf106a2f924ebfba06bed6cd65b64462465ad2f11c329ed06fe36b640905bd86427c023f50c4771

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_2304030139571281512.dll

Filesize
4.6MB

MD5
bac04c920c1505e39636c6d473721292

SHA1
f45d06f54dc4f1dd2256bbe23843be4952aca2ab

SHA256
98c6a36fc123eabe83b724f3b41735a55784ddec0173739c50124e4d7e9d22f0

SHA512
8d2a6f0354aa1557e5ccec3adb9eab59237606c29b92883cfdf106a2f924ebfba06bed6cd65b64462465ad2f11c329ed06fe36b640905bd86427c023f50c4771

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_2304030139580011528.dll

Filesize
4.6MB

MD5
bac04c920c1505e39636c6d473721292

SHA1
f45d06f54dc4f1dd2256bbe23843be4952aca2ab

SHA256
98c6a36fc123eabe83b724f3b41735a55784ddec0173739c50124e4d7e9d22f0

SHA512
8d2a6f0354aa1557e5ccec3adb9eab59237606c29b92883cfdf106a2f924ebfba06bed6cd65b64462465ad2f11c329ed06fe36b640905bd86427c023f50c4771

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

Filesize
1.7MB

MD5
1bbf5dd0b6ca80e4c7c77495c3f33083

SHA1
e0520037e60eb641ec04d1e814394c9da0a6a862

SHA256
bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

SHA512
97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

Filesize
97KB

MD5
da1d0cd400e0b6ad6415fd4d90f69666

SHA1
de9083d2902906cacf57259cf581b1466400b799

SHA256
7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

SHA512
f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
9597a91c491d87dfb8209de6b878fe8b

SHA1
da77262030402d701d697c65c7d60d70ff8af4be

SHA256
81fdafeef0c0e4c41a687b3072a86efc96a7d5df4c015d66ba2016e065544208

SHA512
b76480193c755e6d83ec7c257d3efe6800fb8f84169ca61096941aa5fa660218e0239e083fdbb9a1e49a0e0d317236c34de1232d827ec8e740d860bf46e9fcb6

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
9597a91c491d87dfb8209de6b878fe8b

SHA1
da77262030402d701d697c65c7d60d70ff8af4be

SHA256
81fdafeef0c0e4c41a687b3072a86efc96a7d5df4c015d66ba2016e065544208

SHA512
b76480193c755e6d83ec7c257d3efe6800fb8f84169ca61096941aa5fa660218e0239e083fdbb9a1e49a0e0d317236c34de1232d827ec8e740d860bf46e9fcb6

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
9597a91c491d87dfb8209de6b878fe8b

SHA1
da77262030402d701d697c65c7d60d70ff8af4be

SHA256
81fdafeef0c0e4c41a687b3072a86efc96a7d5df4c015d66ba2016e065544208

SHA512
b76480193c755e6d83ec7c257d3efe6800fb8f84169ca61096941aa5fa660218e0239e083fdbb9a1e49a0e0d317236c34de1232d827ec8e740d860bf46e9fcb6

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
9597a91c491d87dfb8209de6b878fe8b

SHA1
da77262030402d701d697c65c7d60d70ff8af4be

SHA256
81fdafeef0c0e4c41a687b3072a86efc96a7d5df4c015d66ba2016e065544208

SHA512
b76480193c755e6d83ec7c257d3efe6800fb8f84169ca61096941aa5fa660218e0239e083fdbb9a1e49a0e0d317236c34de1232d827ec8e740d860bf46e9fcb6

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
9597a91c491d87dfb8209de6b878fe8b

SHA1
da77262030402d701d697c65c7d60d70ff8af4be

SHA256
81fdafeef0c0e4c41a687b3072a86efc96a7d5df4c015d66ba2016e065544208

SHA512
b76480193c755e6d83ec7c257d3efe6800fb8f84169ca61096941aa5fa660218e0239e083fdbb9a1e49a0e0d317236c34de1232d827ec8e740d860bf46e9fcb6

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
018c68cdf5ba005b4a380c20b13fee4c

SHA1
bf6043fbd31288e8667fcfc37cd74414bee1805f

SHA256
3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

SHA512
506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
018c68cdf5ba005b4a380c20b13fee4c

SHA1
bf6043fbd31288e8667fcfc37cd74414bee1805f

SHA256
3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

SHA512
506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
018c68cdf5ba005b4a380c20b13fee4c

SHA1
bf6043fbd31288e8667fcfc37cd74414bee1805f

SHA256
3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

SHA512
506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
018c68cdf5ba005b4a380c20b13fee4c

SHA1
bf6043fbd31288e8667fcfc37cd74414bee1805f

SHA256
3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

SHA512
506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
018c68cdf5ba005b4a380c20b13fee4c

SHA1
bf6043fbd31288e8667fcfc37cd74414bee1805f

SHA256
3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

SHA512
506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
\Users\Admin\AppData\Local\Temp\jre-windows.exe

Filesize
67.4MB

MD5
49e0e8a2a629d807c9c76b6786142799

SHA1
b8a0463dc126fde45f7dadf61f1769891510ef79

SHA256
a1c271c3c8a4afdceeb4024fda89a42dfbba8d074ff3a76c5e8e2671b22afaeb

SHA512
dd55a2e989ad6e74afd5bf4cc3b6cf178971f10ef7e90a62a7a19cf5fa32d050bb4d46e02d615394f696868bb018842d1e9dd56bcad8dec3de5772696e1a75a5

Download Submit
\Users\Admin\AppData\Local\Temp\jre-windows.exe

Filesize
78.2MB

MD5
db68abfb53477705e584036ff01dd68d

SHA1
65fefdd50b0d29e94a1872fe54d0ca7f0065b7a6

SHA256
3c82d96e8cdb202468760b204ce5878c542abde57b3d739d3bd950d9ba68bef3

SHA512
5498d87b784939a796c6462b4e9e4a2538a1af1d9c7daf4a8fcfe8cf8bcbb249563128ecd908a17a08d0da03f608745e969d955f7ab7f72c201b4b45e985588f

Download Submit
\Users\Admin\AppData\Local\Temp\jre-windows.exe

Filesize
67.8MB

MD5
1d8b1ea7bf104e0b6817b7af1629b23d

SHA1
8b30b3df12b00c098bfc7d1e3dbbd8f13c8e740e

SHA256
6cf9c9947c52cf5ddc2f87875f1cde51d5fbe30d3362c786074abffa4b84d1a5

SHA512
3e43f9ddb43e3fd61812b2815032749ce30282b891b3891e8b54d1407df18b54e1b0825c48183aa55f680911b28554ae99875de8b8a53d357e8be7a7aaca7e6b

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
d29ecf94fe59908428c21bb507f6fd64

SHA1
2eb15a663a96c6f9b5a3da8ea61495199e585753

SHA256
49c5e9a0b605b6cd078a546ba66347ad4f500fe620427345bbcc803ca3d12630

SHA512
68f3c465cadbe00d38efad883a90a18291704d82fc39fd5ced1dff7fd88f58e1930ec8ba0fa9e50cc0532d5b89405ddf3ed73646fd3daf0ee5c577e3f10eae91

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
d29ecf94fe59908428c21bb507f6fd64

SHA1
2eb15a663a96c6f9b5a3da8ea61495199e585753

SHA256
49c5e9a0b605b6cd078a546ba66347ad4f500fe620427345bbcc803ca3d12630

SHA512
68f3c465cadbe00d38efad883a90a18291704d82fc39fd5ced1dff7fd88f58e1930ec8ba0fa9e50cc0532d5b89405ddf3ed73646fd3daf0ee5c577e3f10eae91

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
d29ecf94fe59908428c21bb507f6fd64

SHA1
2eb15a663a96c6f9b5a3da8ea61495199e585753

SHA256
49c5e9a0b605b6cd078a546ba66347ad4f500fe620427345bbcc803ca3d12630

SHA512
68f3c465cadbe00d38efad883a90a18291704d82fc39fd5ced1dff7fd88f58e1930ec8ba0fa9e50cc0532d5b89405ddf3ed73646fd3daf0ee5c577e3f10eae91

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
d29ecf94fe59908428c21bb507f6fd64

SHA1
2eb15a663a96c6f9b5a3da8ea61495199e585753

SHA256
49c5e9a0b605b6cd078a546ba66347ad4f500fe620427345bbcc803ca3d12630

SHA512
68f3c465cadbe00d38efad883a90a18291704d82fc39fd5ced1dff7fd88f58e1930ec8ba0fa9e50cc0532d5b89405ddf3ed73646fd3daf0ee5c577e3f10eae91

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
d29ecf94fe59908428c21bb507f6fd64

SHA1
2eb15a663a96c6f9b5a3da8ea61495199e585753

SHA256
49c5e9a0b605b6cd078a546ba66347ad4f500fe620427345bbcc803ca3d12630

SHA512
68f3c465cadbe00d38efad883a90a18291704d82fc39fd5ced1dff7fd88f58e1930ec8ba0fa9e50cc0532d5b89405ddf3ed73646fd3daf0ee5c577e3f10eae91

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
d29ecf94fe59908428c21bb507f6fd64

SHA1
2eb15a663a96c6f9b5a3da8ea61495199e585753

SHA256
49c5e9a0b605b6cd078a546ba66347ad4f500fe620427345bbcc803ca3d12630

SHA512
68f3c465cadbe00d38efad883a90a18291704d82fc39fd5ced1dff7fd88f58e1930ec8ba0fa9e50cc0532d5b89405ddf3ed73646fd3daf0ee5c577e3f10eae91

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
d29ecf94fe59908428c21bb507f6fd64

SHA1
2eb15a663a96c6f9b5a3da8ea61495199e585753

SHA256
49c5e9a0b605b6cd078a546ba66347ad4f500fe620427345bbcc803ca3d12630

SHA512
68f3c465cadbe00d38efad883a90a18291704d82fc39fd5ced1dff7fd88f58e1930ec8ba0fa9e50cc0532d5b89405ddf3ed73646fd3daf0ee5c577e3f10eae91

Download Submit
memory/780-516-0x0000000001040000-0x0000000001578000-memory.dmp

Filesize
5.2MB

Download
memory/1168-495-0x0000000001050000-0x0000000001060000-memory.dmp

Filesize
64KB

Download
memory/1168-465-0x0000000001280000-0x0000000001668000-memory.dmp

Filesize
3.9MB

Download
memory/1240-463-0x0000000002D60000-0x0000000003148000-memory.dmp

Filesize
3.9MB

Download
memory/1240-454-0x0000000002D60000-0x0000000003148000-memory.dmp

Filesize
3.9MB

Download
memory/1240-464-0x0000000002D60000-0x0000000003148000-memory.dmp

Filesize
3.9MB

Download
memory/1544-73-0x0000000000380000-0x0000000000768000-memory.dmp

Filesize
3.9MB

Download
memory/1544-368-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/1544-365-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/1544-390-0x0000000000380000-0x0000000000768000-memory.dmp

Filesize
3.9MB

Download
memory/1544-479-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/1544-391-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/1544-367-0x0000000000380000-0x0000000000768000-memory.dmp

Filesize
3.9MB

Download
memory/1544-478-0x0000000000380000-0x0000000000768000-memory.dmp

Filesize
3.9MB

Download
memory/1544-410-0x0000000002DD0000-0x0000000002DE0000-memory.dmp

Filesize
64KB

Download
memory/1544-366-0x0000000002260000-0x0000000002263000-memory.dmp

Filesize
12KB

Download
memory/1556-389-0x0000000002DB0000-0x0000000003198000-memory.dmp

Filesize
3.9MB

Download
memory/1556-69-0x0000000002DB0000-0x0000000003198000-memory.dmp

Filesize
3.9MB

Download
memory/1556-72-0x0000000002DB0000-0x0000000003198000-memory.dmp

Filesize
3.9MB

Download