Analysis
-
max time kernel
133s -
max time network
202s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
12-04-2023 18:21
Static task
static1
Behavioral task
behavioral1
Sample
$RB7OQ81.exe
Resource
win7-20230220-en
General
-
Target
$RB7OQ81.exe
-
Size
22.6MB
-
MD5
601b94e3b018e39e0da90881fe89156d
-
SHA1
dc5340d6e1cb98c6ae2fa6882a4c7284e990705b
-
SHA256
845b0953c143daf9382b38c8ac7faeef62d5298bb0191f1be60865f78a942bac
-
SHA512
493c283aa3e201501843e59d593d82b3c98d2628639c95c977c9f22c268d89f7b072907d7b5d244fb7f122348277a97f7d68ce0ebdb36d7fc479c5f3c5bd33db
-
SSDEEP
393216:+Xj4yibrRbGPfs/dQETVlOBbpFEjdGphRqV56Hpkf+V4scTKAjENq+:+zCrRsHExi73qqHpg+Vvc+AmX
Malware Config
Signatures
-
BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
-
Bazar/Team9 Backdoor payload 3 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\jre-windows.exe BazarBackdoorVar3 C:\Users\Admin\AppData\Local\Temp\jre-windows.exe BazarBackdoorVar3 C:\Windows\Installer\6d8077.msi BazarBackdoorVar3 -
Blocklisted process makes network request 1 IoCs
Processes:
msiexec.exeflow pid process 49 1696 msiexec.exe -
Downloads MZ/PE file
-
Executes dropped EXE 23 IoCs
Processes:
irsetup.exeBrowserInstaller.exeirsetup.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exeAssistant_96.0.4693.50_Setup.exe_sfx.exejre-windows.exeassistant_installer.exejre-windows.exeassistant_installer.exeinstaller.exebspatch.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exejavaw.exepid process 1468 irsetup.exe 1972 BrowserInstaller.exe 1096 irsetup.exe 1380 opera-installer-bro.exe 1152 opera-installer-bro.exe 1816 opera-installer-bro.exe 1316 opera-installer-bro.exe 1888 opera-installer-bro.exe 1956 Assistant_96.0.4693.50_Setup.exe_sfx.exe 2504 jre-windows.exe 2228 assistant_installer.exe 2248 jre-windows.exe 2268 assistant_installer.exe 2852 installer.exe 2952 bspatch.exe 2728 unpack200.exe 2364 unpack200.exe 2784 unpack200.exe 2536 unpack200.exe 528 unpack200.exe 2880 unpack200.exe 2960 unpack200.exe 2992 javaw.exe -
Loads dropped DLL 64 IoCs
Processes:
$RB7OQ81.exeirsetup.exeBrowserInstaller.exeirsetup.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exeopera-installer-bro.exejre-windows.exeassistant_installer.exeMsiExec.exemsiexec.exebspatch.exeinstaller.exeunpack200.exepid process 1360 $RB7OQ81.exe 1360 $RB7OQ81.exe 1360 $RB7OQ81.exe 1360 $RB7OQ81.exe 1468 irsetup.exe 1468 irsetup.exe 1468 irsetup.exe 1468 irsetup.exe 1468 irsetup.exe 1468 irsetup.exe 1468 irsetup.exe 1468 irsetup.exe 1972 BrowserInstaller.exe 1972 BrowserInstaller.exe 1972 BrowserInstaller.exe 1972 BrowserInstaller.exe 1096 irsetup.exe 1096 irsetup.exe 1096 irsetup.exe 1096 irsetup.exe 1096 irsetup.exe 1096 irsetup.exe 1096 irsetup.exe 1096 irsetup.exe 1380 opera-installer-bro.exe 1380 opera-installer-bro.exe 1152 opera-installer-bro.exe 1380 opera-installer-bro.exe 1816 opera-installer-bro.exe 1380 opera-installer-bro.exe 1316 opera-installer-bro.exe 1316 opera-installer-bro.exe 1888 opera-installer-bro.exe 1380 opera-installer-bro.exe 1380 opera-installer-bro.exe 1380 opera-installer-bro.exe 1468 irsetup.exe 1380 opera-installer-bro.exe 2504 jre-windows.exe 2228 assistant_installer.exe 1320 2500 MsiExec.exe 2500 MsiExec.exe 2500 MsiExec.exe 1696 msiexec.exe 2952 bspatch.exe 2952 bspatch.exe 2952 bspatch.exe 2852 installer.exe 2728 unpack200.exe 2728 unpack200.exe 2728 unpack200.exe 2728 unpack200.exe 2728 unpack200.exe 2728 unpack200.exe 2728 unpack200.exe 2728 unpack200.exe 2728 unpack200.exe 2728 unpack200.exe 2728 unpack200.exe 2728 unpack200.exe 2728 unpack200.exe 2728 unpack200.exe 2728 unpack200.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Registers COM server for autorun 1 TTPs 64 IoCs
Processes:
installer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0078-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0067-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0071-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0083-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0045-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0157-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBA}\INPROCSERVER32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0061-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0086-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0037-ABCDEFFEDCBC}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0059-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0078-ABCDEFFEDCBB}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0214-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0034-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0205-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0029-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0042-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0168-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0091-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0082-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0076-ABCDEFFEDCBC}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0080-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0142-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0008-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0027-ABCDEFFEDCBB}\INPROCSERVER32 installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0038-ABCDEFFEDCBA}\INPROCSERVER32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0242-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0057-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0185-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0329-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0103-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0041-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0137-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0050-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0064-ABCDEFFEDCBC}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0084-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0040-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0059-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0081-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0156-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0182-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0250-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0304-ABCDEFFEDCBB}\InprocServer32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0319-ABCDEFFEDCBA}\InprocServer32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0033-ABCDEFFEDCBC}\InprocServer32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0093-ABCDEFFEDCBC}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0200-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0195-ABCDEFFEDCBB}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0057-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0108-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0013-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0194-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0018-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0355-ABCDEFFEDCBB}\InprocServer32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0026-ABCDEFFEDCBC}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0085-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0063-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0102-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0314-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0056-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx behavioral1/memory/1468-73-0x0000000000BE0000-0x0000000000FC8000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx behavioral1/memory/1468-367-0x0000000000BE0000-0x0000000000FC8000-memory.dmp upx behavioral1/memory/1468-393-0x0000000000BE0000-0x0000000000FC8000-memory.dmp upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe upx C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe upx C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe upx behavioral1/memory/1468-487-0x0000000000BE0000-0x0000000000FC8000-memory.dmp upx behavioral1/memory/1096-495-0x0000000000A10000-0x0000000000DF8000-memory.dmp upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe upx C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe upx \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe upx behavioral1/memory/1816-531-0x0000000000350000-0x0000000000888000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx behavioral1/memory/1380-605-0x0000000001040000-0x0000000001578000-memory.dmp upx behavioral1/memory/1152-607-0x0000000001040000-0x0000000001578000-memory.dmp upx behavioral1/memory/1316-609-0x0000000001040000-0x0000000001578000-memory.dmp upx behavioral1/memory/1888-610-0x0000000001040000-0x0000000001578000-memory.dmp upx \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe upx behavioral1/memory/1096-1405-0x0000000000A10000-0x0000000000DF8000-memory.dmp upx behavioral1/memory/1468-1406-0x0000000000BE0000-0x0000000000FC8000-memory.dmp upx behavioral1/memory/1468-1420-0x0000000000BE0000-0x0000000000FC8000-memory.dmp upx behavioral1/memory/1468-1548-0x0000000000BE0000-0x0000000000FC8000-memory.dmp upx behavioral1/memory/1096-1630-0x0000000000A10000-0x0000000000DF8000-memory.dmp upx behavioral1/memory/1468-1640-0x0000000000BE0000-0x0000000000FC8000-memory.dmp upx behavioral1/memory/2952-1990-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral1/memory/2952-2001-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral1/memory/2952-2005-0x0000000000400000-0x0000000000417000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 26 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exeopera-installer-bro.exeopera-installer-bro.exedescription ioc process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\D: opera-installer-bro.exe File opened (read-only) \??\D: opera-installer-bro.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe -
Installs/modifies Browser Helper Object 2 TTPs 6 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
installer.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\NoExplorer = "1" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9} installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\NoExplorer = "1" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} installer.exe -
Drops file in System32 directory 1 IoCs
Processes:
installer.exedescription ioc process File created C:\Windows\system32\WindowsAccessBridge-64.dll installer.exe -
Drops file in Program Files directory 64 IoCs
Processes:
installer.exeunpack200.exeunpack200.exeunpack200.exedescription ioc process File created C:\Program Files\Java\jre1.8.0_351\bin\server\jvm.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\vcruntime140_1.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\zip.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\legal\javafx\glib.md installer.exe File created C:\Program Files\Java\jre1.8.0_351\legal\jdk\pkcs11wrapper.md installer.exe File created C:\Program Files\Java\jre1.8.0_351\release installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\rt.jar unpack200.exe File created C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-core-namedpipe-l1-1-0.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-core-profile-l1-1-0.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\legal\javafx\libxslt.md installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\ext\dnsns.jar installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-core-processthreads-l1-1-0.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\mlib_image.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\msvcp140_1.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\pack200.exe installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\resource.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\javaws.exe installer.exe File created C:\Program Files\Java\jre1.8.0_351\legal\jdk\mesa3d.md installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\jvm.hprof.txt installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\management\jmxremote.access installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\j2pcsc.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\jfxwebkit.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\plugin2\msvcp140.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\sunec.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\deploy\messages_pt_BR.properties installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\ext\zipfs.jar installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\management\jmxremote.password.template installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-crt-utility-l1-1-0.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\legal\jdk\giflib.md installer.exe File created C:\Program Files\Java\jre1.8.0_351\legal\jdk\unicode.md installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\meta-index installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-core-synch-l1-2-0.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\instrument.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\javaw.exe installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\deploy\messages.properties installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\deploy\splash.gif installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\deploy\[email protected] installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\images\cursors\win32_LinkNoDrop32x32.gif installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-core-string-l1-1-0.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-crt-environment-l1-1-0.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\decora_sse.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\JavaAccessBridge-64.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\legal\jdk\jopt-simple.md installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\cmm\PYCC.pf installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\currency.data installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\deploy\messages_zh_TW.properties installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\ext\access-bridge-64.jar installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\ext\meta-index installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\images\cursors\win32_MoveDrop32x32.gif installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\plugin.jar unpack200.exe File created C:\Program Files\Java\jre1.8.0_351\lib\deploy.jar unpack200.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_7202628\javaws.exe installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\eula.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\images\cursors\win32_LinkDrop32x32.gif installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-core-timezone-l1-1-0.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\j2pkcs11.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\jfxmedia.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\legal\javafx\gstreamer.md installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\fonts\LucidaBrightRegular.ttf installer.exe File created C:\Program Files\Java\jre1.8.0_351\lib\security\blacklisted.certs installer.exe File created C:\Program Files\Java\jre1.8.0_351\README.txt installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-core-console-l1-2-0.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\awt.dll installer.exe File created C:\Program Files\Java\jre1.8.0_351\bin\bci.dll installer.exe -
Drops file in Windows directory 9 IoCs
Processes:
msiexec.exedescription ioc process File created C:\Windows\Installer\6d8077.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI97C3.tmp msiexec.exe File created C:\Windows\Installer\6d807b.msi msiexec.exe File opened for modification C:\Windows\Installer\6d8077.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI9408.tmp msiexec.exe File created C:\Windows\Installer\6d8079.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI9754.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9774.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
msiexec.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msiexec.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msiexec.exe -
Processes:
installer.exeirsetup.exejre-windows.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Policy = "0" installer.exe Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main irsetup.exe Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main jre-windows.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppName = "javaws.exe" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppPath = "C:\\Program Files\\Java\\jre1.8.0_351\\bin" installer.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
installer.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0034-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0096-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0135-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_135" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0261-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0137-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0217-ABCDEFFEDCBB} installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0206-ABCDEFFEDCBC}\InprocServer32 installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0035-ABCDEFFEDCBC} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0071-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0079-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_79" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0195-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0226-ABCDEFFEDCBB} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0099-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0093-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_93" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0231-ABCDEFFEDCBA} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0250-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0256-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0068-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0270-ABCDEFFEDCBC}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0068-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.2_68" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0058-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_58" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0083-ABCDEFFEDCBB}\InprocServer32 installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0175-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0266-ABCDEFFEDCBC}\ = "Java Plug-in 1.7.0_266" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0360-ABCDEFFEDCBB}\InprocServer32 installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0149-ABCDEFFEDCBC}\InprocServer32 installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0181-ABCDEFFEDCBC}\InprocServer32 installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0300-ABCDEFFEDCBC} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0026-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0057-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0063-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_63" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0146-ABCDEFFEDCBB} installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0302-ABCDEFFEDCBB}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0037-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0084-ABCDEFFEDCBC}\InprocServer32 installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0032-ABCDEFFEDCBA} installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0293-ABCDEFFEDCBC}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0136-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0090-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_90" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0051-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_51" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0172-ABCDEFFEDCBB}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0008-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0028-ABCDEFFEDCBA} installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0072-ABCDEFFEDCBB}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0222-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0052-ABCDEFFEDCBA} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_05" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0122-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_122" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0202-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0216-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0096-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBB} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0057-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0201-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0290-ABCDEFFEDCBB}\InprocServer32 installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0088-ABCDEFFEDCBB}\InprocServer32 installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0158-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0213-ABCDEFFEDCBA}\InprocServer32 installer.exe -
Modifies registry class 64 IoCs
Processes:
installer.exemsiexec.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0320-ABCDEFFEDCBB}\InprocServer32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}\InprocServer32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0092-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0064-ABCDEFFEDCBA} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0113-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0078-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0119-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4EA42A62D9304AC4784BF2468130150F\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\LocalLow\\Oracle\\Java\\jre1.8.0_351_x64\\" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0042-ABCDEFFEDCBC}\INPROCSERVER32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0163-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0183-ABCDEFFEDCBA} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0019-ABCDEFFEDCBA} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0023-ABCDEFFEDCBA}\InprocServer32 installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0079-ABCDEFFEDCBA} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0096-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0154-ABCDEFFEDCBB}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0032-ABCDEFFEDCBB} installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0066-ABCDEFFEDCBA} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0134-ABCDEFFEDCBA} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0174-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0179-ABCDEFFEDCBC} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0078-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0079-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0126-ABCDEFFEDCBC} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0078-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0235-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0040-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0089-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_89" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0247-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_247" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0335-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_335" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0019-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0044-ABCDEFFEDCBA} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0187-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_187" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0263-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_263" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0276-ABCDEFFEDCBB} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0052-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBA} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0201-ABCDEFFEDCBC}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0181-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0353-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0013-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0155-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0160-ABCDEFFEDCBC} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0152-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0241-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_241" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0009-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0058-ABCDEFFEDCBB}\INPROCSERVER32 installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0074-ABCDEFFEDCBC} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0063-ABCDEFFEDCBA} installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0092-ABCDEFFEDCBB} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0054-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBB} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0224-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0268-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0034-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0307-ABCDEFFEDCBC}\ = "Java Plug-in 1.7.0_307" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0021-ABCDEFFEDCBC}\ = "Java Plug-in 1.8.0_21" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0104-ABCDEFFEDCBB}\InprocServer32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBB} installer.exe -
Processes:
opera-installer-bro.exeirsetup.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 opera-installer-bro.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 opera-installer-bro.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 irsetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde irsetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 opera-installer-bro.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 opera-installer-bro.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
jre-windows.exemsiexec.exedescription pid process Token: SeShutdownPrivilege 2248 jre-windows.exe Token: SeIncreaseQuotaPrivilege 2248 jre-windows.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeTakeOwnershipPrivilege 1696 msiexec.exe Token: SeSecurityPrivilege 1696 msiexec.exe Token: SeCreateTokenPrivilege 2248 jre-windows.exe Token: SeAssignPrimaryTokenPrivilege 2248 jre-windows.exe Token: SeLockMemoryPrivilege 2248 jre-windows.exe Token: SeIncreaseQuotaPrivilege 2248 jre-windows.exe Token: SeMachineAccountPrivilege 2248 jre-windows.exe Token: SeTcbPrivilege 2248 jre-windows.exe Token: SeSecurityPrivilege 2248 jre-windows.exe Token: SeTakeOwnershipPrivilege 2248 jre-windows.exe Token: SeLoadDriverPrivilege 2248 jre-windows.exe Token: SeSystemProfilePrivilege 2248 jre-windows.exe Token: SeSystemtimePrivilege 2248 jre-windows.exe Token: SeProfSingleProcessPrivilege 2248 jre-windows.exe Token: SeIncBasePriorityPrivilege 2248 jre-windows.exe Token: SeCreatePagefilePrivilege 2248 jre-windows.exe Token: SeCreatePermanentPrivilege 2248 jre-windows.exe Token: SeBackupPrivilege 2248 jre-windows.exe Token: SeRestorePrivilege 2248 jre-windows.exe Token: SeShutdownPrivilege 2248 jre-windows.exe Token: SeDebugPrivilege 2248 jre-windows.exe Token: SeAuditPrivilege 2248 jre-windows.exe Token: SeSystemEnvironmentPrivilege 2248 jre-windows.exe Token: SeChangeNotifyPrivilege 2248 jre-windows.exe Token: SeRemoteShutdownPrivilege 2248 jre-windows.exe Token: SeUndockPrivilege 2248 jre-windows.exe Token: SeSyncAgentPrivilege 2248 jre-windows.exe Token: SeEnableDelegationPrivilege 2248 jre-windows.exe Token: SeManageVolumePrivilege 2248 jre-windows.exe Token: SeImpersonatePrivilege 2248 jre-windows.exe Token: SeCreateGlobalPrivilege 2248 jre-windows.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeTakeOwnershipPrivilege 1696 msiexec.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeTakeOwnershipPrivilege 1696 msiexec.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeTakeOwnershipPrivilege 1696 msiexec.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeTakeOwnershipPrivilege 1696 msiexec.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeTakeOwnershipPrivilege 1696 msiexec.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeTakeOwnershipPrivilege 1696 msiexec.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeTakeOwnershipPrivilege 1696 msiexec.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeTakeOwnershipPrivilege 1696 msiexec.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeTakeOwnershipPrivilege 1696 msiexec.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeTakeOwnershipPrivilege 1696 msiexec.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeTakeOwnershipPrivilege 1696 msiexec.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeTakeOwnershipPrivilege 1696 msiexec.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeTakeOwnershipPrivilege 1696 msiexec.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeTakeOwnershipPrivilege 1696 msiexec.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeTakeOwnershipPrivilege 1696 msiexec.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
irsetup.exeirsetup.exejre-windows.exepid process 1468 irsetup.exe 1468 irsetup.exe 1468 irsetup.exe 1468 irsetup.exe 1468 irsetup.exe 1468 irsetup.exe 1096 irsetup.exe 1096 irsetup.exe 2248 jre-windows.exe 2248 jre-windows.exe 2248 jre-windows.exe 2248 jre-windows.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
$RB7OQ81.exeirsetup.exeBrowserInstaller.exeirsetup.exeopera-installer-bro.exeopera-installer-bro.exedescription pid process target process PID 1360 wrote to memory of 1468 1360 $RB7OQ81.exe irsetup.exe PID 1360 wrote to memory of 1468 1360 $RB7OQ81.exe irsetup.exe PID 1360 wrote to memory of 1468 1360 $RB7OQ81.exe irsetup.exe PID 1360 wrote to memory of 1468 1360 $RB7OQ81.exe irsetup.exe PID 1360 wrote to memory of 1468 1360 $RB7OQ81.exe irsetup.exe PID 1360 wrote to memory of 1468 1360 $RB7OQ81.exe irsetup.exe PID 1360 wrote to memory of 1468 1360 $RB7OQ81.exe irsetup.exe PID 1468 wrote to memory of 1972 1468 irsetup.exe BrowserInstaller.exe PID 1468 wrote to memory of 1972 1468 irsetup.exe BrowserInstaller.exe PID 1468 wrote to memory of 1972 1468 irsetup.exe BrowserInstaller.exe PID 1468 wrote to memory of 1972 1468 irsetup.exe BrowserInstaller.exe PID 1468 wrote to memory of 1972 1468 irsetup.exe BrowserInstaller.exe PID 1468 wrote to memory of 1972 1468 irsetup.exe BrowserInstaller.exe PID 1468 wrote to memory of 1972 1468 irsetup.exe BrowserInstaller.exe PID 1972 wrote to memory of 1096 1972 BrowserInstaller.exe irsetup.exe PID 1972 wrote to memory of 1096 1972 BrowserInstaller.exe irsetup.exe PID 1972 wrote to memory of 1096 1972 BrowserInstaller.exe irsetup.exe PID 1972 wrote to memory of 1096 1972 BrowserInstaller.exe irsetup.exe PID 1972 wrote to memory of 1096 1972 BrowserInstaller.exe irsetup.exe PID 1972 wrote to memory of 1096 1972 BrowserInstaller.exe irsetup.exe PID 1972 wrote to memory of 1096 1972 BrowserInstaller.exe irsetup.exe PID 1096 wrote to memory of 1380 1096 irsetup.exe opera-installer-bro.exe PID 1096 wrote to memory of 1380 1096 irsetup.exe opera-installer-bro.exe PID 1096 wrote to memory of 1380 1096 irsetup.exe opera-installer-bro.exe PID 1096 wrote to memory of 1380 1096 irsetup.exe opera-installer-bro.exe PID 1096 wrote to memory of 1380 1096 irsetup.exe opera-installer-bro.exe PID 1096 wrote to memory of 1380 1096 irsetup.exe opera-installer-bro.exe PID 1096 wrote to memory of 1380 1096 irsetup.exe opera-installer-bro.exe PID 1380 wrote to memory of 1152 1380 opera-installer-bro.exe opera-installer-bro.exe PID 1380 wrote to memory of 1152 1380 opera-installer-bro.exe opera-installer-bro.exe PID 1380 wrote to memory of 1152 1380 opera-installer-bro.exe opera-installer-bro.exe PID 1380 wrote to memory of 1152 1380 opera-installer-bro.exe opera-installer-bro.exe PID 1380 wrote to memory of 1152 1380 opera-installer-bro.exe opera-installer-bro.exe PID 1380 wrote to memory of 1152 1380 opera-installer-bro.exe opera-installer-bro.exe PID 1380 wrote to memory of 1152 1380 opera-installer-bro.exe opera-installer-bro.exe PID 1380 wrote to memory of 1816 1380 opera-installer-bro.exe opera-installer-bro.exe PID 1380 wrote to memory of 1816 1380 opera-installer-bro.exe opera-installer-bro.exe PID 1380 wrote to memory of 1816 1380 opera-installer-bro.exe opera-installer-bro.exe PID 1380 wrote to memory of 1816 1380 opera-installer-bro.exe opera-installer-bro.exe PID 1380 wrote to memory of 1816 1380 opera-installer-bro.exe opera-installer-bro.exe PID 1380 wrote to memory of 1816 1380 opera-installer-bro.exe opera-installer-bro.exe PID 1380 wrote to memory of 1816 1380 opera-installer-bro.exe opera-installer-bro.exe PID 1380 wrote to memory of 1316 1380 opera-installer-bro.exe opera-installer-bro.exe PID 1380 wrote to memory of 1316 1380 opera-installer-bro.exe opera-installer-bro.exe PID 1380 wrote to memory of 1316 1380 opera-installer-bro.exe opera-installer-bro.exe PID 1380 wrote to memory of 1316 1380 opera-installer-bro.exe opera-installer-bro.exe PID 1380 wrote to memory of 1316 1380 opera-installer-bro.exe opera-installer-bro.exe PID 1380 wrote to memory of 1316 1380 opera-installer-bro.exe opera-installer-bro.exe PID 1380 wrote to memory of 1316 1380 opera-installer-bro.exe opera-installer-bro.exe PID 1316 wrote to memory of 1888 1316 opera-installer-bro.exe opera-installer-bro.exe PID 1316 wrote to memory of 1888 1316 opera-installer-bro.exe opera-installer-bro.exe PID 1316 wrote to memory of 1888 1316 opera-installer-bro.exe opera-installer-bro.exe PID 1316 wrote to memory of 1888 1316 opera-installer-bro.exe opera-installer-bro.exe PID 1316 wrote to memory of 1888 1316 opera-installer-bro.exe opera-installer-bro.exe PID 1316 wrote to memory of 1888 1316 opera-installer-bro.exe opera-installer-bro.exe PID 1316 wrote to memory of 1888 1316 opera-installer-bro.exe opera-installer-bro.exe PID 1380 wrote to memory of 1956 1380 opera-installer-bro.exe Assistant_96.0.4693.50_Setup.exe_sfx.exe PID 1380 wrote to memory of 1956 1380 opera-installer-bro.exe Assistant_96.0.4693.50_Setup.exe_sfx.exe PID 1380 wrote to memory of 1956 1380 opera-installer-bro.exe Assistant_96.0.4693.50_Setup.exe_sfx.exe PID 1380 wrote to memory of 1956 1380 opera-installer-bro.exe Assistant_96.0.4693.50_Setup.exe_sfx.exe PID 1380 wrote to memory of 1956 1380 opera-installer-bro.exe Assistant_96.0.4693.50_Setup.exe_sfx.exe PID 1380 wrote to memory of 1956 1380 opera-installer-bro.exe Assistant_96.0.4693.50_Setup.exe_sfx.exe PID 1380 wrote to memory of 1956 1380 opera-installer-bro.exe Assistant_96.0.4693.50_Setup.exe_sfx.exe PID 1468 wrote to memory of 2504 1468 irsetup.exe jre-windows.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\$RB7OQ81.exe"C:\Users\Admin\AppData\Local\Temp\$RB7OQ81.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\$RB7OQ81.exe" "__IRCT:3" "__IRTSS:23652861" "__IRSID:S-1-5-21-3430344531-3702557399-3004411149-1000"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe"C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816850 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:1841947" "__IRSID:S-1-5-21-3430344531-3702557399-3004411149-1000"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe"C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=05⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exeC:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=97.0.4719.63 --initial-client-data=0x188,0x18c,0x190,0x15c,0x194,0x711933e0,0x711933f0,0x711933fc6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1152
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe" --version6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1816
-
-
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe"C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=1380 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20230412202337" --session-guid=83555e84-202b-437f-817d-4813a315f929 --server-tracking-blob=OWQwM2Y3MTEyNzBiMzQxNjY0ZjcxYjE5NjcxNDc1MWNkYzgxOGMxMmQzYTBhNDk4ZTRiZTk5NWVhZjY4MzUwYzp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjciLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNjgxMzIzODE2LjI1MjciLCJ1c2VyYWdlbnQiOiJTZXR1cCBGYWN0b3J5IDkuMCIsInV0bSI6eyJjYW1wYWlnbiI6Ik9wZXJhRGVza3RvcCIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Ik1TVEwifSwidXVpZCI6IjVhYjNjMzY0LWNjN2ItNDdjOS1hNGQ5LWM1YzM4OWQzMmRiZCJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=0C030000000000006⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exeC:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=97.0.4719.63 --initial-client-data=0x194,0x198,0x19c,0x15c,0x1a0,0x707133e0,0x707133f0,0x707133fc7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888
-
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304122023371\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304122023371\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe"6⤵
- Executes dropped EXE
PID:1956
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304122023371\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304122023371\assistant\assistant_installer.exe" --version6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\jre-windows.exe"C:\Users\Admin\AppData\Local\Temp\jre-windows.exe" STATIC=13⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\jds7150071.tmp\jre-windows.exe"C:\Users\Admin\AppData\Local\Temp\jds7150071.tmp\jre-windows.exe" "STATIC=1"4⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2248
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304122023371\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304122023371\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=96.0.4693.50 --initial-client-data=0x12c,0x130,0x134,0x100,0x138,0xf56c28,0xf56c38,0xf56c441⤵
- Executes dropped EXE
PID:2268
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1696 -
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding 5F3324AAC427FC8EB65949C91C9FD9862⤵
- Loads dropped DLL
PID:2500
-
-
C:\Program Files\Java\jre1.8.0_351\installer.exe"C:\Program Files\Java\jre1.8.0_351\installer.exe" /s INSTALLDIR="C:\Program Files\Java\jre1.8.0_351\\" STATIC=1 INSTALL_SILENT=1 REPAIRMODE=0 ProductCode={26A24AE4-039D-4CA4-87B4-2F64180351F0}2⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
PID:2852 -
C:\ProgramData\Oracle\Java\installcache_x64\7184891.tmp\bspatch.exe"bspatch.exe" baseimagefam8 newimage diff3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952
-
-
C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/plugin.pack" "C:\Program Files\Java\jre1.8.0_351\lib/plugin.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:2728
-
-
C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/javaws.pack" "C:\Program Files\Java\jre1.8.0_351\lib/javaws.jar"3⤵
- Executes dropped EXE
PID:2364
-
-
C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/deploy.pack" "C:\Program Files\Java\jre1.8.0_351\lib/deploy.jar"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2784
-
-
C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/rt.pack" "C:\Program Files\Java\jre1.8.0_351\lib/rt.jar"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2536
-
-
C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/jsse.pack" "C:\Program Files\Java\jre1.8.0_351\lib/jsse.jar"3⤵
- Executes dropped EXE
PID:528
-
-
C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/charsets.pack" "C:\Program Files\Java\jre1.8.0_351\lib/charsets.jar"3⤵
- Executes dropped EXE
PID:2880
-
-
C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/ext/localedata.pack" "C:\Program Files\Java\jre1.8.0_351\lib/ext/localedata.jar"3⤵
- Executes dropped EXE
PID:2960
-
-
C:\Program Files\Java\jre1.8.0_351\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_351\bin\javaw.exe" -Xshare:dump -Djdk.disableLastUsageTracking3⤵
- Executes dropped EXE
PID:2992
-
-
C:\Program Files\Java\jre1.8.0_351\bin\ssvagent.exe"C:\Program Files\Java\jre1.8.0_351\bin\ssvagent.exe" -doHKCUSSVSetup3⤵PID:1092
-
-
C:\Program Files\Java\jre1.8.0_351\bin\javaws.exe"C:\Program Files\Java\jre1.8.0_351\bin\javaws.exe" -wait -fix -permissions -silent3⤵PID:3060
-
C:\Program Files\Java\jre1.8.0_351\bin\jp2launcher.exe"C:\Program Files\Java\jre1.8.0_351\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre1.8.0_351" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzM1MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF8zNTFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzM1MVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==4⤵PID:2152
-
-
-
C:\Program Files\Java\jre1.8.0_351\bin\javaws.exe"C:\Program Files\Java\jre1.8.0_351\bin\javaws.exe" -wait -fix -shortcut -silent3⤵PID:2184
-
C:\Program Files\Java\jre1.8.0_351\bin\jp2launcher.exe"C:\Program Files\Java\jre1.8.0_351\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre1.8.0_351" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzM1MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF8zNTFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzM1MVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtc2hvcnRjdXQALXNpbGVudAAtbm90V2ViSmF2YQ==4⤵PID:2392
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5ff91ac355dc6b1df63795886125bccf8
SHA190979fc6ea3a89031598d2146bf5cdbbb6db6b77
SHA25614b30467cfea0071dffc658dd31b8a25b7b4e79608933f171911c2cba6aa9a0a
SHA51277aa8c7930730004bdb8d49a82712e1042db978102f6eca0d38317b6fd98ef03e52279130eadc7a0da1148e759db6589f7f8334d4c2eccfb2613e8f19542e197
-
Filesize
103KB
MD57a9d69862a2021508931a197cd6501ec
SHA1a0f7d313a874552f4972784d15042b564e4067fc
SHA25651ff63cbac78bd133333e98d91b02b652c88cd57cedd0052519051a17be77856
SHA5125c331e6deefc8256ea203d63770484f6b485d4c3832a60ecf4a540dff3cb75a76dbde37980fe1763ca487401b68126f58f8d1a4c72ee610f5144c624c4736850
-
Filesize
446KB
MD524ccb37646e1f52ce4f47164cccf2b91
SHA1bc265e26417026286d6ed951904305086c4f693c
SHA256adf2d659c2b2a4afff1ca58f3a742d27d767d27eabeca6a8b6ee243e9c913a39
SHA512cb174e7a219f6ffae3715e37beb428979bc1462202729c05a25fa7b8da90e2dd6faa92c03cd9ca21567d354dce7acc1852669f4071298e953d6a286243794e32
-
Filesize
216KB
MD5691f68efcd902bfdfb60b556a3e11c2c
SHA1c279fa09293185bddfd73d1170b6a73bd266cf07
SHA256471d70ebf91bdc762dcacbea9f6ca883f97921938e83269fef911dbf83598a70
SHA512a4816ae0654f41bd130d56e44839d9f29ab48bd2f99c3d6db38ce3358ac46c1cef09da09184c6291dd378018a49f9e56173c35d780d3eaefcce459592c75de3f
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit\Reference Documentation.lnk
Filesize197B
MD5b5e1de7d05841796c6d96dfe5b8b338c
SHA1c7c64e5b35d0cca1a5c98a1c68e1e5d4c8b72547
SHA256062cb9dec2b2ce02c633fc442d1a23e910e602548a54a54c8310b0dde9ae074d
SHA512963a89b04f34bc00fea5b8e0f9648596c428beac2db30d8b0932974b15c0eb90b7c801ba6fa1082ea9d133258f393ae27e61f27fd3b3951f5c2e4b8c6a212c2d
-
Filesize
182B
MD57fadb9e200dbbd992058cefa41212796
SHA1e2525d7ba66bb07bc1cd5ba93f88c54e7e2042b4
SHA256b05abacd15117b1ffcd2a288308f50c0542214d264b852eddfa9025307ac401b
SHA51294b7bf1f1f5cea2a74f8c326113dd25652cb14e5fa356ac83d16b6ac5a5cac26c9d2b20259f5c2cf8ebc1e022490511e2996335a5d8dd7f5b64dce429fb6dfb1
-
Filesize
178B
MD53b1c6b5701ef2829986a6bdc3f6fbf94
SHA11a2fe685aba9430625cba281d1a8f7ba9d392af0
SHA2566a2cdce88637830202e1031bc8c11f083103a6bbb8c1ce16fb805671a46633c8
SHA512f3391d790bb6acb1c25b82253b19c334e7cd73648e9821b7050fefbd5b0bc4b48a0cedd97e425a83c788f9b798337d33dee2e989771604c4f886da46d2debea0
-
Filesize
61KB
MD5e71c8443ae0bc2e282c73faead0a6dd3
SHA10c110c1b01e68edfacaeae64781a37b1995fa94b
SHA25695b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72
SHA512b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
Filesize471B
MD58c5d705e2d9a1e86a490898badca6fa7
SHA12af5bd9b1646f43368b7f5add528685e1ac9cc7e
SHA256898d0b99f67a56c4f3764cbc1e8788f5bfdc460d089e28799761a5525668160c
SHA512b237cbe40020a227643b337d39fbc19d8feb214a113dd4a4e169e7120116f027e29fbf7fc54a29fb80145e1f97e467c176304395aaa4887cab31050bdb268302
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c28b4bd4e09e0950f15afbc0c39cbb0e
SHA173dd76f12586976ea9e9cf35e095a981f8d83c83
SHA256faf24b4bf3b2da7e146ab5a334facc693b7b101ab72e1fef065f629a7290a549
SHA51287040f6d26c96dbadd8db70d463860a635d04e3a96bce7b74c20a1cdd538f3ba0fe1bad245824af7e86138269539034d5ef0ce84e06b38eee5de4b7c179b318e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d6d7a4fe95cfe0d40610c1e4474a0ea8
SHA121b84224b25fb338712cf3072da7a8819db93257
SHA256789997482ab8851077d4037784de9aa87f9e4e356feee3a2a7ef713eb185437c
SHA512675db3dc8566717decf79a6201e553f6014bdb21a2f40fd20b131322357fe79f1d7cac560b907f88f8f7a87f378d1b203d272b420a8084642e378c64bb9b9ca1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD566b2c14c96f0bfb3771e8a80d54d4e6c
SHA177935cc7246919e1609ae4af19f5607527177824
SHA25620868a6b611763753b2e842c29cb7f5dd1869614646951621c791cc963149748
SHA512d356a30ddbfa8dba7478c79098936b4f40a0e323253445764c9ffbcb9d9147c2a2fcf75a659989de09df6598fbeb3084c7a88fc805351115561a23dcacdf7fda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
Filesize434B
MD54db56fa930b074f4659f7a1a61ca809a
SHA16a72cd497bd6e7fceb571ad4946aab2e80b950a5
SHA256db6d6cf032b0406eaa61ca9d37850913a8fd15194130db562689e254d4b5526e
SHA512dd1bad83f26903a092793b50bd6a6d14de8e5cd8ee6352127e748b97c6ca9af9f68f462d38571c81e4b708ed8f216aed53d496c23075c6cc654755ff6b0654e0
-
Filesize
1KB
MD5b72e4bee00abed6216d00e46aaaa1771
SHA10149d6ca1f56e3a75aba99c9307650066b5fe5e7
SHA256ccb9caf74cb2f981e83589f07c9c7d0a8a72c06146ea49b1a825b6a5593829b7
SHA51277e1101a1cadabb8f7f535ded745abfe97717967a883f84574b170005d0b92bc9a03f379a732b20630a09c38b6da42b2f4f6f88dd66d3fb5757ec09b1343dd1a
-
Filesize
2.7MB
MD554b5d4131eb3a7c30872072ba9ca2b04
SHA1f71fad30cd7ecc1e008d0da11c16d6a42957022b
SHA256022976faa22031e77d0d95f24205692f623d846aa0fd7152047055df0f32b268
SHA512d60bfd5aaf3664d8d410216480865a99ed878a5d09bfb87c04d2ed16e6966262cd253a49db52c4e5251a207729a7077420c778c25568f676ae7b91589f430586
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304122023371\additional_file0.tmp
Filesize1.7MB
MD5b386cdcb413405daa8219af8e4cbd318
SHA1ce275ff8514fef0629c915a6ee7b5ac481b9043d
SHA256408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e
SHA51291f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304122023371\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe
Filesize1.7MB
MD5b386cdcb413405daa8219af8e4cbd318
SHA1ce275ff8514fef0629c915a6ee7b5ac481b9043d
SHA256408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e
SHA51291f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304122023371\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe
Filesize1.7MB
MD5b386cdcb413405daa8219af8e4cbd318
SHA1ce275ff8514fef0629c915a6ee7b5ac481b9043d
SHA256408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e
SHA51291f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304122023371\assistant\assistant_installer.exe
Filesize2.1MB
MD52f3d9e21e232b9bfea064d3b2264db06
SHA1bafddc657d8d1bb531683b29b0342cc065ee51d2
SHA25625528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d
SHA51294e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304122023371\opera_package
Filesize86.9MB
MD56b7771354e081eb94cdbf7627799da4f
SHA1199341a750443cc6e9b2b2fa1e657d0dd327711f
SHA256494d1247e61eebf703a6eb19c14bde88edd2f85515fefa4f0465f43873e69aab
SHA51233e781a102ba3f5c3b1895540bc9c43b78bf4f19af4b91ae0c765594f39d6569d1bad207b33f808426d8ebdcb00c419b7bb76bb050bae0bb843f96dd84355800
-
Filesize
1.8MB
MD58d26aecef0a7bdac2b104454d3ba1a87
SHA150c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA5120daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475
-
Filesize
1.8MB
MD58d26aecef0a7bdac2b104454d3ba1a87
SHA150c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA5120daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475
-
Filesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
Filesize
61KB
MD5e71c8443ae0bc2e282c73faead0a6dd3
SHA10c110c1b01e68edfacaeae64781a37b1995fa94b
SHA25695b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72
SHA512b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6
-
Filesize
4.6MB
MD54fa000d2daf4a9a8b30a36de57343e8b
SHA14865161c5ec70cce04079a6cbf08795e05bacbf1
SHA25650df18de18d3cdd5cc21f8fc0dbabbe5a60690027b82af25806f679f492065de
SHA512a52620ab7ae4e8a6c7379790fc70c5cc611a06432b83ded0a7ea476a647098fcb18797b42ed98293c3e9dd955d784819638597e3b1b419f54eeb9a0084b625ca
-
Filesize
161KB
MD573b4b714b42fc9a6aaefd0ae59adb009
SHA1efdaffd5b0ad21913d22001d91bf6c19ecb4ac41
SHA256c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd
SHA51273af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd
-
Filesize
161KB
MD5be2bec6e8c5653136d3e72fe53c98aa3
SHA1a8182d6db17c14671c3d5766c72e58d87c0810de
SHA2561919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd
SHA5120d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff
-
Filesize
116KB
MD5e043a9cb014d641a56f50f9d9ac9a1b9
SHA161dc6aed3d0d1f3b8afe3d161410848c565247ed
SHA2569dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946
SHA5124ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f
-
Filesize
1.8MB
MD58d26aecef0a7bdac2b104454d3ba1a87
SHA150c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA5120daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475
-
Filesize
339B
MD5a45137507477ea159a4c0481fadbdde8
SHA1772e535525cd41abb781167334f923f1127f6d24
SHA256fcc6693f94f87dbb9f03bd664f029db87257c79ac9a974d2caadc790f20ea67a
SHA512393a8d9387b388524fbf7bc8387d521c830e7d384aabe278251cb4fa1291d32e2875c464a01f93670259bc2009d69507b632a692d43244f3eb7551414c9d635a
-
Filesize
644B
MD5f54bbaadafacf2ed607c2b44e76bd5f2
SHA1e6e313e86b0adb771643dc9aa465652646d83329
SHA2562dcd3efb7e14a1439973b066c810eb3187cb851a7d01b2a03376d978b6b0d927
SHA5121d7f940d290c3c7eca12739f7e4753901a1d070ca9f43171b4fe25530ba48b3b376c16b125a32d6e701d63d576ef829824472bcac99e568784543bfc4c50b732
-
Filesize
2KB
MD5c70b569d43f5e00ee3dd81530899f191
SHA138b7f73c29d9d355625bf7dcc611d657c263dbc4
SHA256778c8b5a8e7422ce84f4113fc1cbd90204f3b3c0b3bb8545b3fe68003525e9e8
SHA512f0aafa93ffd1edb8764f7e435fa982b0eb596b1962472dcefac26731382c58d44306e876f04675146595a1e7ee6ae8170e2fa01ed0fca075e36a9749709f4df7
-
Filesize
280B
MD501e097a324673878a3cb5e8e0f3cf152
SHA135ef5c438eca9672c7ee19bcde3952f83dc77928
SHA256d8d0719a20d267a73d298d2ec1fbc050fe2ce25447c7441058ea3966acfbbb22
SHA512e873763e96b3a52fe73f3fc9b3bcfd764c807c0206b5984d5f7dddd7debec4e6f0b6705ca6a7c6379b83c2fea792d7a16880ea109469ac1af41cc7bdb5f96e27
-
Filesize
1KB
MD5362d3183b2acc152c99ec123611f3297
SHA13db69a12917cb11a14fb9294d73c5409fe11a398
SHA2568ae66727c5c92ca76a131aa104cc126858e8e3ed490ae08482109dfedd9a8cda
SHA5122c7f40564479d1fe90cb59b4b413e8bf9a5bb7cd2f94193f8759e376549c0269afce030df7d306b4cd814f604ad460d744fb00d961f6d2608a4ecb6b186a4f1f
-
Filesize
281B
MD5d88e18e2a020a756a8de999b76e7b1fd
SHA1150f801600b9427039197847aaac784f8ba15258
SHA25638b8f2202a5e48a8f528708922f504379896ef52b3882ce82efc3481c51804bb
SHA512d048a569d155aa4636f25ed2963fd5e2234643735ad461df3ad3201cbe152b646c2893557a236fa9683aa3cb07351fa79b9e5788f631442e5142cab0bc98654a
-
Filesize
43KB
MD516c0e37cb0c5540fd9f93a8d82d94e52
SHA152d5aabf804381b47d13a358d80256c4088eec21
SHA2562b772e66ebc70c93deb0b9a9e054373ee33d9245809e16174b1f132f786a063f
SHA512dd54308739f9621f5fe707c69f24657431fd58b46e357a79d25c3d8e96d3b2914ce19d94beeee0bbd32311737670f06b01c364f0c7d70625a4246da64c29b0af
-
Filesize
1KB
MD5a7a8625948d61d814dbb29225e04f908
SHA116bc91a8bb3c22cf78447644a32010ad869eaf99
SHA25661979f700f77d187c8647cba3bee95ca4a70e187bbb76323f4055385dd8879d5
SHA51204b0bb58095a6e8f1d29203f21eee99fd837494b74736e91e5e304eb3dc3ccb32796b6959361ede965731b76607a53b0f9d211cb4b3d94b25ea34898e760d295
-
Filesize
1.7MB
MD51bbf5dd0b6ca80e4c7c77495c3f33083
SHA1e0520037e60eb641ec04d1e814394c9da0a6a862
SHA256bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b
SHA51297bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab
-
Filesize
97KB
MD5da1d0cd400e0b6ad6415fd4d90f69666
SHA1de9083d2902906cacf57259cf581b1466400b799
SHA2567a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575
SHA512f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a
-
Filesize
1.3MB
MD5f8da4bc14cb40b7ff8cd2c798ca0f7b9
SHA11264c77f79f7a328d60dfd752e721a463fc3e247
SHA2563050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1
SHA5120a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96
-
Filesize
1.3MB
MD5f8da4bc14cb40b7ff8cd2c798ca0f7b9
SHA11264c77f79f7a328d60dfd752e721a463fc3e247
SHA2563050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1
SHA5120a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96
-
Filesize
1.3MB
MD5f8da4bc14cb40b7ff8cd2c798ca0f7b9
SHA11264c77f79f7a328d60dfd752e721a463fc3e247
SHA2563050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1
SHA5120a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96
-
Filesize
326KB
MD580d93d38badecdd2b134fe4699721223
SHA1e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA5129f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4
-
Filesize
114KB
MD5bd5626a0237933e0f1dccf10e7c9fbd6
SHA110c47d382d4f44d8d44efaa203501749e42c6d50
SHA2567dfc1176d8a507135140b23a0c014093b7e2673f0f3e5727c3d85df4e7323762
SHA5121fd864a5386580cf8bbafbacb12a043ef51948b729b9aedfe6dc81e6c2948a100526c7c600069f22454d550f7f736ad3045a930cc2ef97458dc1d6c782928087
-
Filesize
1.3MB
MD5018c68cdf5ba005b4a380c20b13fee4c
SHA1bf6043fbd31288e8667fcfc37cd74414bee1805f
SHA2563c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923
SHA512506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6
-
Filesize
1.3MB
MD5018c68cdf5ba005b4a380c20b13fee4c
SHA1bf6043fbd31288e8667fcfc37cd74414bee1805f
SHA2563c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923
SHA512506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6
-
Filesize
1.3MB
MD5018c68cdf5ba005b4a380c20b13fee4c
SHA1bf6043fbd31288e8667fcfc37cd74414bee1805f
SHA2563c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923
SHA512506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6
-
Filesize
326KB
MD580d93d38badecdd2b134fe4699721223
SHA1e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA5129f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4
-
Filesize
84.5MB
MD57542ec421a2f6e90751e8b64c22e0542
SHA1d207d221a28ede5c2c8415f82c555989aa7068ba
SHA256188ca8ecc44de1b7f602e883c3054dc392792c3631bf362b1bc4f3e1dba323e6
SHA5128987bf8aa1b401815fa9850e56954db6015bdd06ce78b65ba435724582ffa615dee4e1452fa237c53257dca8ee97b469d01c27757a5f070ce6f807a4f81094bc
-
Filesize
4KB
MD53e50d144d67bac94a24664f9cc6feceb
SHA1ee5a89434931505414f9073c222cc746c74f0ca2
SHA256a5bb81588c61da9e10ae63c91b8e9ef649100d05180031b6e7622981026db954
SHA512d2731950cad39a381876196fd5364b769b25f67ceb959c83244af0a7d0627616d2392e8c4752882eb9f3a9d1bf5ace72944038dc3b841fee2e7dd5de1276b419
-
Filesize
14KB
MD51d0030ce46d9cbce79ba2e9afd06b8eb
SHA1a8c682873d56fa38baa9e2b21ede12e121c5f5c4
SHA25636eee5b1d8c0db2ba1a9e10f7c56da1712a358c6624e70f9d59abd25610f9357
SHA5127269c014aa032b502d7e3a6df6f61c4a8a85c3238ba8ac4b65165094ef6675baa2067516f443dfeb3822ee90ff943f64415c559c64e9ebaed8f066bd20d2f561
-
Filesize
2.7MB
MD554b5d4131eb3a7c30872072ba9ca2b04
SHA1f71fad30cd7ecc1e008d0da11c16d6a42957022b
SHA256022976faa22031e77d0d95f24205692f623d846aa0fd7152047055df0f32b268
SHA512d60bfd5aaf3664d8d410216480865a99ed878a5d09bfb87c04d2ed16e6966262cd253a49db52c4e5251a207729a7077420c778c25568f676ae7b91589f430586
-
Filesize
2.7MB
MD554b5d4131eb3a7c30872072ba9ca2b04
SHA1f71fad30cd7ecc1e008d0da11c16d6a42957022b
SHA256022976faa22031e77d0d95f24205692f623d846aa0fd7152047055df0f32b268
SHA512d60bfd5aaf3664d8d410216480865a99ed878a5d09bfb87c04d2ed16e6966262cd253a49db52c4e5251a207729a7077420c778c25568f676ae7b91589f430586
-
Filesize
2.7MB
MD554b5d4131eb3a7c30872072ba9ca2b04
SHA1f71fad30cd7ecc1e008d0da11c16d6a42957022b
SHA256022976faa22031e77d0d95f24205692f623d846aa0fd7152047055df0f32b268
SHA512d60bfd5aaf3664d8d410216480865a99ed878a5d09bfb87c04d2ed16e6966262cd253a49db52c4e5251a207729a7077420c778c25568f676ae7b91589f430586
-
Filesize
2.7MB
MD554b5d4131eb3a7c30872072ba9ca2b04
SHA1f71fad30cd7ecc1e008d0da11c16d6a42957022b
SHA256022976faa22031e77d0d95f24205692f623d846aa0fd7152047055df0f32b268
SHA512d60bfd5aaf3664d8d410216480865a99ed878a5d09bfb87c04d2ed16e6966262cd253a49db52c4e5251a207729a7077420c778c25568f676ae7b91589f430586
-
Filesize
2.7MB
MD554b5d4131eb3a7c30872072ba9ca2b04
SHA1f71fad30cd7ecc1e008d0da11c16d6a42957022b
SHA256022976faa22031e77d0d95f24205692f623d846aa0fd7152047055df0f32b268
SHA512d60bfd5aaf3664d8d410216480865a99ed878a5d09bfb87c04d2ed16e6966262cd253a49db52c4e5251a207729a7077420c778c25568f676ae7b91589f430586
-
Filesize
2.7MB
MD554b5d4131eb3a7c30872072ba9ca2b04
SHA1f71fad30cd7ecc1e008d0da11c16d6a42957022b
SHA256022976faa22031e77d0d95f24205692f623d846aa0fd7152047055df0f32b268
SHA512d60bfd5aaf3664d8d410216480865a99ed878a5d09bfb87c04d2ed16e6966262cd253a49db52c4e5251a207729a7077420c778c25568f676ae7b91589f430586
-
Filesize
590B
MD52b79e7bdbba1c6f22e63c6092a096df4
SHA19988d39e13c762d66b12331f5d04f4b35e484f02
SHA2560b231a74e9bd68cac5191b1ec2a25d6324301487be7ff34401d1e10181c63fc5
SHA512cf32e990563ae8da6e2abd3bb714a6d101d26961a8a6d91e5af04e73b860f6f79808d8d608cc81ff1efe9772664795ebf1bcf9794e50eeefc3656209fdecb5bd
-
Filesize
6.3MB
MD5545c62b3d98ee4cc02af837a72dd09c4
SHA154446a007fd9b7363d9415673b0ac0232d5d70d5
SHA256738029a4f974128180fa2cd239e873b01e456e8bf53bfdbf34b8ba8b57897be4
SHA5128bf9c754861ed267efd2055ac09b4ad44df61b989859fccd14190592dca1dab0fa8f57360209eaceabb5137f742c9cea73a1a985ab1955f87a6875d0be95fdcf
-
Filesize
451KB
MD50b445ace8798426e7185f52b7b7b6d1e
SHA17a77b46e0848cc9b32283ccb3f91a18c0934c079
SHA2562bbf97ccba3f87d469eac909c4ce8a3f13ed29c8f31b611e7d5cf89a0619eda6
SHA51251523d5b711481293305465a3a3c6a3a50dca984cdc8cca1f4c44f3c21bfa430cd9aac1a8782d9605e6954cbafb307beb6b1a52e9785de1bc3f71067d80c6b6e
-
Filesize
1KB
MD558c10711ee61290c5e53d6c235d14c7f
SHA16cd433f1d5224b7441efecfef8e0982bbda4415b
SHA2562d8d51d2405fd3534f5fce5ffea5b9a100ce4aacf35caa7d165c7c6672949b35
SHA512b895b6f07fefc06695cb521fa923534c8ef99312ab6c27295c86de29fc1bdb09e3ba17cd4aea75f8dd9cf7e1a3c4494a6ef960eadcb209eecb1b623d70c367f0
-
Filesize
45KB
MD532b9a83f00af4123b811eb6a85ee7971
SHA1a1e6bdfe76e6103aca76bd21ce60c0b48e4de570
SHA256a39a8cb1d54a2036257211b6364f84caf033fccf3394e9f890434563770e594d
SHA512eb272c6dbaa3e59887cfdfd21dba5e2abc56a12beeda55ba091aa9b02da71af5ce11c0f7af4fb34f58da9836f91d787e26ab9f898b8669c861e9bacee973ca9f
-
Filesize
457B
MD519678bec078614865a71ade211a305f2
SHA19da7f2ff66044138863ed5d1dcf2fc7e90ffedf4
SHA256d80c15c79946fbe8b3a6a5280f2509eed654338e53096fa6f22d280ad2f6263d
SHA512b2894b6bbdb5ab639fcc615ff0d2b414fb517d9e1ea8062c61d23182056a0de02e118b9e43824b4765a8617dc4fd330c7f4187e3b395ee92c6ac5e893f242602
-
Filesize
352B
MD5034eab9a50571cbab86294322e639886
SHA1cae94b8cfe3ecce8e750d6fd34d54e766ea607aa
SHA256449d678cc9a235d42a5a2f4e685536d9af87c6b5fc022f28dba32b08b4e88ee1
SHA512b364c0cbb38bfb35e3c2d29705df72a8ce7dc111f04ebc05eceec4294987f18200581a31b78a79b05da890b5358e5463d1640d2230a8af930804efa3d4da42b0
-
Filesize
438B
MD587221bf8c9222a1489e949e4266a2980
SHA160c9d850f696e56b53dc3f940f52463d228febf2
SHA2568d6e1d814dd38525115ee5d77e2d2ae6df8be31562a3c6805012097d6625efc4
SHA512fa7ba5edb212a0ad70de123b1eabebd8d4cf5e2e3f59841330923c91d6ce6d8a0bbbf0176a8215a183ea860ae5286a4205b73f70df4d032cfd6c03109d1e433c
-
Filesize
206B
MD5bc193c9f3fd0730341d2ba951f734652
SHA1ebe3f410cf0bf5f30fe36b1c1df96fa27e73b01f
SHA256e9137bc2fefbd9a3c4506708f283fe52c40b00b35c2677fc31e196b305b00e67
SHA512355cb9a7ba6e2a77a51339bfa732537bc77d36da372fe926f1e4bf25de865b09c98122d9559f5ec234b41a83cb97de4fd49427a9476169653ac6058912261c1e
-
Filesize
1KB
MD59eb36caea38bf80ed9fa40a3f67597b7
SHA13c23e2e30119f6dd321d34a82a339d52723bfacc
SHA2566be2e43a38969226e1cbb00605cdac634d0de3e82ce605b08dcf1cf596f64370
SHA51222b57fc57d45ec73865e5429210d6016d2bab0cd990877c8272b4fc6ded8effe3bfa0c9b0890d7b0de8296e6bc3c262f29637b8ce7840efba2f963e70a978e53
-
Filesize
1KB
MD523e26969753c07af68f232cdd684c003
SHA1f14666db750cc2f89ccdd8852b4259fcfa663271
SHA25617f138eea95423738d2c9b75834b607c671cb2ac4d71c9aecf100a8b847003d2
SHA5127c57a6309da9ae381073e005d374b9c8a82c7b4e92322b91433009d41f8f34655ed9d45958ab1743023faa9e7aa0c82a05d9292b078efccb64c19992b7e4d4d2
-
Filesize
41KB
MD57aae2de61d5e6296c00fde67046dfaeb
SHA187a65e99d520045c39997b53c6a0aa08cec35e57
SHA25607b11e82a30598438ac4221d6c8796739c42c2a596365464f257481a37fa00c6
SHA512c5ebaf43ffc19a1a3b2f49e070ea1d5532ae433c3bcd02493e31bd3389b6c3edfb1e04373902fbd252eb7370612dd96c3d36eb3fac8240111f57020ab99fa882
-
Filesize
1KB
MD50bde2ca44cd4e4e31c5c0364c66eb57b
SHA18496e4a8dcea6e42af33b503dc200d4a1ef07101
SHA25638031284395ba7a773a335a861536b487bbf60b81496424b8a9a8a6697a919de
SHA5124e60f45022b0c6739db94097401f6046e5f95b26dca71e685db834338451b7ea0b3ed3afc128d564c3f79074905b7986714f75925c41f763eda6b901875af555
-
Filesize
33KB
MD54615ebc40f92a0c5e18d128cf6dcbd83
SHA11f1f884e849beb0417faef6e07e8307f5c314698
SHA25671be23381d45dc1f0e7f30736c35fa5254e3188514ec529b2a980420bb7d4a33
SHA5126eb3dea316128c30a632e524f9ca5f98c4c80e3ed39ed166251aa6f2e393fa1fc5fbe3f527d69d0d91a369fb590208090473b08438fa214129ce4204bdeab7d3
-
Filesize
11KB
MD5688cddb8d51f45e7a7565f642f03c516
SHA1d03c80604ffc886e50078fa96cf0fe346fbe4922
SHA25687c526fd348aba3b2d5b504703c87025332c561cca17ba43203ca0145010aba3
SHA512cc214f5eedff9fae08680f887696eed45dadf7e417df42196d7bf693c3412f9ae919295780ee3876bde255e849e5e94fbb9e6748e649482aaef4c2ef0d18098d
-
Filesize
40B
MD52cf8a269c72745ba5234c657443dba88
SHA1ca3b07095275a8c2345b89c3c476e2dcb53fba53
SHA256a18e870ba711dd191fa50851e04905aca3ed74fbe88665abbd0d59c5102af169
SHA512dd37bec8940c503cb7f8ee4df2acc10d73ddf945bd665586b9e7da825bad53bcfb43028b572504ff131e0075ab4165285ce85f848ce446994c7db11121b222de
-
Filesize
40B
MD52cf8a269c72745ba5234c657443dba88
SHA1ca3b07095275a8c2345b89c3c476e2dcb53fba53
SHA256a18e870ba711dd191fa50851e04905aca3ed74fbe88665abbd0d59c5102af169
SHA512dd37bec8940c503cb7f8ee4df2acc10d73ddf945bd665586b9e7da825bad53bcfb43028b572504ff131e0075ab4165285ce85f848ce446994c7db11121b222de
-
Filesize
81.0MB
MD51794aaa17d114a315a95473c9780fc8b
SHA17f250c022b916b88e22254985e7552bc3ac8db04
SHA2567682233d155e6d19f30cf61b185a02055be0dbcacd2c9accf90a99de21547eb4
SHA512fb9defdf73786528e82ffc7e1ccfa03cfb687365ec740e9620993da785414306f03a7e1fa523192a9d690a882b012d1e426afd1757639f3ef5f1e612c01e6516
-
Filesize
757KB
MD562cfeb86f117ad91b8bb52f1dda6f473
SHA1c753b488938b3e08f7f47df209359c7b78764448
SHA256f06cba20bd40e9d841add1877cf8d3b406f0acfa4800b80ae041ed3cc374eb7e
SHA512c1b0e76cee4e2c3ca604dcc8f5665e72e70008acc824e20d89404f139d7e7e789e99dff131dafd76409f6ea0a813aa136f96089fbdadcf90d6485b1807762e4e
-
Filesize
2.7MB
MD554b5d4131eb3a7c30872072ba9ca2b04
SHA1f71fad30cd7ecc1e008d0da11c16d6a42957022b
SHA256022976faa22031e77d0d95f24205692f623d846aa0fd7152047055df0f32b268
SHA512d60bfd5aaf3664d8d410216480865a99ed878a5d09bfb87c04d2ed16e6966262cd253a49db52c4e5251a207729a7077420c778c25568f676ae7b91589f430586
-
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304122023371\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe
Filesize1.7MB
MD5b386cdcb413405daa8219af8e4cbd318
SHA1ce275ff8514fef0629c915a6ee7b5ac481b9043d
SHA256408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e
SHA51291f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626
-
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304122023371\assistant\assistant_installer.exe
Filesize2.1MB
MD52f3d9e21e232b9bfea064d3b2264db06
SHA1bafddc657d8d1bb531683b29b0342cc065ee51d2
SHA25625528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d
SHA51294e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5
-
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304122023371\opera_package
Filesize86.9MB
MD56b7771354e081eb94cdbf7627799da4f
SHA1199341a750443cc6e9b2b2fa1e657d0dd327711f
SHA256494d1247e61eebf703a6eb19c14bde88edd2f85515fefa4f0465f43873e69aab
SHA51233e781a102ba3f5c3b1895540bc9c43b78bf4f19af4b91ae0c765594f39d6569d1bad207b33f808426d8ebdcb00c419b7bb76bb050bae0bb843f96dd84355800
-
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304122023371\opera_package
Filesize86.9MB
MD56b7771354e081eb94cdbf7627799da4f
SHA1199341a750443cc6e9b2b2fa1e657d0dd327711f
SHA256494d1247e61eebf703a6eb19c14bde88edd2f85515fefa4f0465f43873e69aab
SHA51233e781a102ba3f5c3b1895540bc9c43b78bf4f19af4b91ae0c765594f39d6569d1bad207b33f808426d8ebdcb00c419b7bb76bb050bae0bb843f96dd84355800
-
Filesize
1.8MB
MD58d26aecef0a7bdac2b104454d3ba1a87
SHA150c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA5120daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475
-
Filesize
1.8MB
MD58d26aecef0a7bdac2b104454d3ba1a87
SHA150c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA5120daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475
-
Filesize
1.8MB
MD58d26aecef0a7bdac2b104454d3ba1a87
SHA150c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA5120daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475
-
Filesize
1.8MB
MD58d26aecef0a7bdac2b104454d3ba1a87
SHA150c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA5120daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475
-
Filesize
1.8MB
MD58d26aecef0a7bdac2b104454d3ba1a87
SHA150c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA5120daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475
-
Filesize
1.8MB
MD58d26aecef0a7bdac2b104454d3ba1a87
SHA150c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA5120daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475
-
Filesize
4.6MB
MD54fa000d2daf4a9a8b30a36de57343e8b
SHA14865161c5ec70cce04079a6cbf08795e05bacbf1
SHA25650df18de18d3cdd5cc21f8fc0dbabbe5a60690027b82af25806f679f492065de
SHA512a52620ab7ae4e8a6c7379790fc70c5cc611a06432b83ded0a7ea476a647098fcb18797b42ed98293c3e9dd955d784819638597e3b1b419f54eeb9a0084b625ca
-
Filesize
4.6MB
MD54fa000d2daf4a9a8b30a36de57343e8b
SHA14865161c5ec70cce04079a6cbf08795e05bacbf1
SHA25650df18de18d3cdd5cc21f8fc0dbabbe5a60690027b82af25806f679f492065de
SHA512a52620ab7ae4e8a6c7379790fc70c5cc611a06432b83ded0a7ea476a647098fcb18797b42ed98293c3e9dd955d784819638597e3b1b419f54eeb9a0084b625ca
-
Filesize
4.6MB
MD54fa000d2daf4a9a8b30a36de57343e8b
SHA14865161c5ec70cce04079a6cbf08795e05bacbf1
SHA25650df18de18d3cdd5cc21f8fc0dbabbe5a60690027b82af25806f679f492065de
SHA512a52620ab7ae4e8a6c7379790fc70c5cc611a06432b83ded0a7ea476a647098fcb18797b42ed98293c3e9dd955d784819638597e3b1b419f54eeb9a0084b625ca
-
Filesize
4.6MB
MD54fa000d2daf4a9a8b30a36de57343e8b
SHA14865161c5ec70cce04079a6cbf08795e05bacbf1
SHA25650df18de18d3cdd5cc21f8fc0dbabbe5a60690027b82af25806f679f492065de
SHA512a52620ab7ae4e8a6c7379790fc70c5cc611a06432b83ded0a7ea476a647098fcb18797b42ed98293c3e9dd955d784819638597e3b1b419f54eeb9a0084b625ca
-
Filesize
4.6MB
MD54fa000d2daf4a9a8b30a36de57343e8b
SHA14865161c5ec70cce04079a6cbf08795e05bacbf1
SHA25650df18de18d3cdd5cc21f8fc0dbabbe5a60690027b82af25806f679f492065de
SHA512a52620ab7ae4e8a6c7379790fc70c5cc611a06432b83ded0a7ea476a647098fcb18797b42ed98293c3e9dd955d784819638597e3b1b419f54eeb9a0084b625ca
-
Filesize
1.7MB
MD51bbf5dd0b6ca80e4c7c77495c3f33083
SHA1e0520037e60eb641ec04d1e814394c9da0a6a862
SHA256bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b
SHA51297bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab
-
Filesize
97KB
MD5da1d0cd400e0b6ad6415fd4d90f69666
SHA1de9083d2902906cacf57259cf581b1466400b799
SHA2567a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575
SHA512f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a
-
Filesize
1.3MB
MD5f8da4bc14cb40b7ff8cd2c798ca0f7b9
SHA11264c77f79f7a328d60dfd752e721a463fc3e247
SHA2563050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1
SHA5120a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96
-
Filesize
1.3MB
MD5f8da4bc14cb40b7ff8cd2c798ca0f7b9
SHA11264c77f79f7a328d60dfd752e721a463fc3e247
SHA2563050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1
SHA5120a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96
-
Filesize
1.3MB
MD5f8da4bc14cb40b7ff8cd2c798ca0f7b9
SHA11264c77f79f7a328d60dfd752e721a463fc3e247
SHA2563050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1
SHA5120a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96
-
Filesize
1.3MB
MD5f8da4bc14cb40b7ff8cd2c798ca0f7b9
SHA11264c77f79f7a328d60dfd752e721a463fc3e247
SHA2563050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1
SHA5120a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96
-
Filesize
1.3MB
MD5f8da4bc14cb40b7ff8cd2c798ca0f7b9
SHA11264c77f79f7a328d60dfd752e721a463fc3e247
SHA2563050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1
SHA5120a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96
-
Filesize
326KB
MD580d93d38badecdd2b134fe4699721223
SHA1e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA5129f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4
-
Filesize
1.3MB
MD5018c68cdf5ba005b4a380c20b13fee4c
SHA1bf6043fbd31288e8667fcfc37cd74414bee1805f
SHA2563c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923
SHA512506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6
-
Filesize
1.3MB
MD5018c68cdf5ba005b4a380c20b13fee4c
SHA1bf6043fbd31288e8667fcfc37cd74414bee1805f
SHA2563c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923
SHA512506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6
-
Filesize
1.3MB
MD5018c68cdf5ba005b4a380c20b13fee4c
SHA1bf6043fbd31288e8667fcfc37cd74414bee1805f
SHA2563c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923
SHA512506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6
-
Filesize
1.3MB
MD5018c68cdf5ba005b4a380c20b13fee4c
SHA1bf6043fbd31288e8667fcfc37cd74414bee1805f
SHA2563c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923
SHA512506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6
-
Filesize
1.3MB
MD5018c68cdf5ba005b4a380c20b13fee4c
SHA1bf6043fbd31288e8667fcfc37cd74414bee1805f
SHA2563c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923
SHA512506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6
-
Filesize
326KB
MD580d93d38badecdd2b134fe4699721223
SHA1e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA5129f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4
-
Filesize
84.5MB
MD57542ec421a2f6e90751e8b64c22e0542
SHA1d207d221a28ede5c2c8415f82c555989aa7068ba
SHA256188ca8ecc44de1b7f602e883c3054dc392792c3631bf362b1bc4f3e1dba323e6
SHA5128987bf8aa1b401815fa9850e56954db6015bdd06ce78b65ba435724582ffa615dee4e1452fa237c53257dca8ee97b469d01c27757a5f070ce6f807a4f81094bc
-
Filesize
2.7MB
MD554b5d4131eb3a7c30872072ba9ca2b04
SHA1f71fad30cd7ecc1e008d0da11c16d6a42957022b
SHA256022976faa22031e77d0d95f24205692f623d846aa0fd7152047055df0f32b268
SHA512d60bfd5aaf3664d8d410216480865a99ed878a5d09bfb87c04d2ed16e6966262cd253a49db52c4e5251a207729a7077420c778c25568f676ae7b91589f430586
-
Filesize
2.7MB
MD554b5d4131eb3a7c30872072ba9ca2b04
SHA1f71fad30cd7ecc1e008d0da11c16d6a42957022b
SHA256022976faa22031e77d0d95f24205692f623d846aa0fd7152047055df0f32b268
SHA512d60bfd5aaf3664d8d410216480865a99ed878a5d09bfb87c04d2ed16e6966262cd253a49db52c4e5251a207729a7077420c778c25568f676ae7b91589f430586
-
Filesize
2.7MB
MD554b5d4131eb3a7c30872072ba9ca2b04
SHA1f71fad30cd7ecc1e008d0da11c16d6a42957022b
SHA256022976faa22031e77d0d95f24205692f623d846aa0fd7152047055df0f32b268
SHA512d60bfd5aaf3664d8d410216480865a99ed878a5d09bfb87c04d2ed16e6966262cd253a49db52c4e5251a207729a7077420c778c25568f676ae7b91589f430586
-
Filesize
2.7MB
MD554b5d4131eb3a7c30872072ba9ca2b04
SHA1f71fad30cd7ecc1e008d0da11c16d6a42957022b
SHA256022976faa22031e77d0d95f24205692f623d846aa0fd7152047055df0f32b268
SHA512d60bfd5aaf3664d8d410216480865a99ed878a5d09bfb87c04d2ed16e6966262cd253a49db52c4e5251a207729a7077420c778c25568f676ae7b91589f430586
-
Filesize
2.7MB
MD554b5d4131eb3a7c30872072ba9ca2b04
SHA1f71fad30cd7ecc1e008d0da11c16d6a42957022b
SHA256022976faa22031e77d0d95f24205692f623d846aa0fd7152047055df0f32b268
SHA512d60bfd5aaf3664d8d410216480865a99ed878a5d09bfb87c04d2ed16e6966262cd253a49db52c4e5251a207729a7077420c778c25568f676ae7b91589f430586
-
Filesize
2.7MB
MD554b5d4131eb3a7c30872072ba9ca2b04
SHA1f71fad30cd7ecc1e008d0da11c16d6a42957022b
SHA256022976faa22031e77d0d95f24205692f623d846aa0fd7152047055df0f32b268
SHA512d60bfd5aaf3664d8d410216480865a99ed878a5d09bfb87c04d2ed16e6966262cd253a49db52c4e5251a207729a7077420c778c25568f676ae7b91589f430586
-
Filesize
2.7MB
MD554b5d4131eb3a7c30872072ba9ca2b04
SHA1f71fad30cd7ecc1e008d0da11c16d6a42957022b
SHA256022976faa22031e77d0d95f24205692f623d846aa0fd7152047055df0f32b268
SHA512d60bfd5aaf3664d8d410216480865a99ed878a5d09bfb87c04d2ed16e6966262cd253a49db52c4e5251a207729a7077420c778c25568f676ae7b91589f430586