Overview

overview

8

Static

static

TLauncher-....6.exe

windows10-2004-x64

8

Resubmissions

03/02/2023, 00:48

230203-a55pnshd53 8

03/02/2023, 00:39

230203-az46yscf2t 8

31/01/2023, 20:06

230131-yvhzxsca3x 8

Analysis

  • max time kernel
    156s
  • max time network
    199s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/01/2023, 20:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    TLauncher-2.871-Installer-1.0.6.exe

  • Size

    23.7MB

  • MD5

    49fb0f13cdb8d7cad1487889b6becced

  • SHA1

    b71d98ec45e6f7314f0e33106485beef99b2ee7c

  • SHA256

    7e49e00be1992fbc4ac14f2e5e3c05dccadf8fba3c3936357d8df7f146f5f0a3

  • SHA512

    639fa23294556bf77080d420e7e1b5b7c07a8b1e93897c36a4f8e398c1c58de9b91636420102e68f6957c768793797728664e32dc38aa68315746882b4ebe1d9

  • SSDEEP

    393216:XX921sp/n85Pfs/dQETVlOBbpFEj9GZ1GphRqV56Hpk7IXOzDnKI17fyV5:XN8s18hHExiTI3qqHp6zvKcfyV5

Score
8/10
discoveryspywarestealerupx

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 19 IoCs
  • UPX packed file 22 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 11 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 36 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
    evasionspywaretrojan
  • Suspicious use of SetWindowsHookEx 29 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4816
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6.exe" "__IRCT:3" "__IRTSS:24870711" "__IRSID:S-1-5-21-4246620582-653642754-1174164128-1000"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4580
      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
        "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1012
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816850 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" "__IRCT:3" "__IRTSS:1840872" "__IRSID:S-1-5-21-4246620582-653642754-1174164128-1000"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2532
          • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
            "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Enumerates connected drives
            • Modifies system certificate store
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1764
            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.76 --initial-client-data=0x350,0x354,0x358,0x328,0x304,0x6ec18658,0x6ec18668,0x6ec18674
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:2556
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe" --version
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:4620
            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --pin-additional-shortcuts=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=1764 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20230131210725" --session-guid=7f73b7f0-c789-4c62-9f77-c6933a28e155 --server-tracking-blob=ZjQwZGE4MzU0ZjJhZjFiZGE0Zjg3NjE2ZDg0NjI5YjlhYjkzNjE5MzI3NWE1NzM0NTA2ODA4NDc5MTg1MjdmMjp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInRpbWVzdGFtcCI6IjE2NzUxOTU2NDMuOTIxNCIsInVzZXJhZ2VudCI6IlNldHVwIEZhY3RvcnkgOS4wIiwidXRtIjp7ImNhbXBhaWduIjoiT3BlcmFEZXNrdG9wIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiTVNUTCJ9LCJ1dWlkIjoiZDJmNTY5MWUtMzkxZS00NzViLWJiNjEtNmY1MDIxMzMyYTVhIn0= --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=B005000000000000
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Enumerates connected drives
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1388
              • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.76 --initial-client-data=0x340,0x344,0x348,0x31c,0x34c,0x6e158658,0x6e158668,0x6e158674
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:3972
              • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\installer.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\installer.exe" --backend --initial-pid=1764 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --pin-additional-shortcuts=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301312107251" --session-guid=7f73b7f0-c789-4c62-9f77-c6933a28e155 --server-tracking-blob=ZjQwZGE4MzU0ZjJhZjFiZGE0Zjg3NjE2ZDg0NjI5YjlhYjkzNjE5MzI3NWE1NzM0NTA2ODA4NDc5MTg1MjdmMjp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInRpbWVzdGFtcCI6IjE2NzUxOTU2NDMuOTIxNCIsInVzZXJhZ2VudCI6IlNldHVwIEZhY3RvcnkgOS4wIiwidXRtIjp7ImNhbXBhaWduIjoiT3BlcmFEZXNrdG9wIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiTVNUTCJ9LCJ1dWlkIjoiZDJmNTY5MWUtMzkxZS00NzViLWJiNjEtNmY1MDIxMzMyYTVhIn0= --silent --desktopshortcut=1 --install-subfolder=94.0.4606.76
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates connected drives
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:2392
                • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\installer.exe
                  C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\installer.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.76 --initial-client-data=0x2b8,0x2bc,0x2c0,0x294,0x2c4,0x7ffb80632c98,0x7ffb80632ca8,0x7ffb80632cb8
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetWindowsHookEx
                  PID:2908
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301312107251\assistant\_sfx.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301312107251\assistant\_sfx.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:4388
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301312107251\assistant\assistant_installer.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301312107251\assistant\assistant_installer.exe" --version
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4732
              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301312107251\assistant\assistant_installer.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301312107251\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x2fc,0x332dc0,0x332dd0,0x332ddc
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:2604
      • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
        "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4864
        • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
          "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
          4⤵
          • Suspicious use of SetWindowsHookEx
          PID:4324
  • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
    "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:2552
    • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
      "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
      2⤵
      • Drops file in Program Files directory
      • Suspicious use of SetWindowsHookEx
      PID:1948
  • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
    "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3084
    • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
      "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:4980
  • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
    "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:2600
    • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
      "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
      2⤵
        PID:3120
        • C:\Windows\SYSTEM32\cmd.exe
          cmd.exe /C chcp 437 & wmic qfe get HotFixID
          3⤵
            PID:4028
      • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
        "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4700
        • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
          "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
          2⤵
            PID:4900
            • C:\Windows\SYSTEM32\cmd.exe
              cmd.exe /C chcp 437 & wmic qfe get HotFixID
              3⤵
                PID:3652
          • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
            "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
            1⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:388
            • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
              "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
              2⤵
                PID:4936

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp
              Filesize

              50B

              MD5

              2499aa72e1cb79a9cd786f82676e82e4

              SHA1

              0a91ef6d87b506e541d74321efd0b1098083640f

              SHA256

              319da7f9be6edc810a7b6f1db10004013056bbb0d089f9d0973c66e31f8e72da

              SHA512

              b39cebd66e80ae0119e8624ba4c2306baf7a424517cb392ce545ac8edb53ac49ff74bbf35feb2fe13ec7f3b71b947da474edc05d8a6653e16364da77fccecbf5

              Download Submit

            • C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp
              Filesize

              50B

              MD5

              38b5d54ffc3d2d20393a06de8dcafdd1

              SHA1

              2c0ccf22447dfed3954e81aa5d5bc7538be6ec93

              SHA256

              d3f029bdae91c1a95402c4e8e1aa4a68a8d30abecbc4657f0d1baf00ec6005f2

              SHA512

              4299b2a1aa2f19aff36a11f33188503ae21c6ec9e9ee928884e09d6b0eb68416f50da6f34643ed7c84a9ba410194436c0c906c04b1a96f2955ef6100575b9a68

              Download Submit

            • C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp
              Filesize

              50B

              MD5

              14948375c38871f97a5492698775d214

              SHA1

              8ad5a6c2f86037661c404392069abfed93e1ec69

              SHA256

              feb3ad41c233268d7648233fb2d8cd0d48433293af7eb3ad7bee573bbfcb6c9c

              SHA512

              a2596d1e01f1ae841f50141b3fecac264865994bf95f4418960fd967598d38534f1f5b05286ff3e750949be1623f9ba33dc05685725b1e1a97c39aa6c0d4dfd1

              Download Submit

            • C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp
              Filesize

              50B

              MD5

              14948375c38871f97a5492698775d214

              SHA1

              8ad5a6c2f86037661c404392069abfed93e1ec69

              SHA256

              feb3ad41c233268d7648233fb2d8cd0d48433293af7eb3ad7bee573bbfcb6c9c

              SHA512

              a2596d1e01f1ae841f50141b3fecac264865994bf95f4418960fd967598d38534f1f5b05286ff3e750949be1623f9ba33dc05685725b1e1a97c39aa6c0d4dfd1

              Download Submit

            • C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp
              Filesize

              50B

              MD5

              5a02f8dd70f62d535db5db55c890d87f

              SHA1

              5cd6c48f9d2caeec031d178b038a5a441ec0ebc0

              SHA256

              74b8ee6fa1db8e2bdfa11fd9196a8570d73c72cc7e83aefa9703bd54b7f39471

              SHA512

              e27f0e981f73d400c05f042285131e188e2fd62042078226f5a33ba72e43679e06d22d7f8430cf2f86b57426ea615a906733e2c56e375d134869f8d9db8da406

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
              Filesize

              471B

              MD5

              9cbb254ca8da5a4099c66d7dce2d69de

              SHA1

              3f328e1410c5c4ea2fa2b387dbef7c6479ea258c

              SHA256

              f6cad04bfeb909acd5c89c6137fd33b267fa2e021553b3515c82e9d7cfb3fc58

              SHA512

              93fe3387c563d18ea2f9cb96f1d868d1d5a26c0490126242279a6f39a2df53311fc9806ee14b4b0301195a17dd75abc318695aa0a328330820e8fc20b6fed4a4

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
              Filesize

              434B

              MD5

              5d4ab265e260c6f4bb7ca1502ea46439

              SHA1

              b11cec6446dddc6a2747f6e4404df3bcde59f738

              SHA256

              3f6f96f8e9300f11a78f7262a69a1d376e1cd09a6bea8afdae79b67eec3f4154

              SHA512

              7804ff3289968f75b7f73d3f8b9e1906e9e745cc96738e9a0c1403b35ce50f3a1917543da26f8e038169906be37926d31b2b7c5e1d99e48ed5ba9686e3cf53d6

              Download Submit

            • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\installer.exe
              Filesize

              6.0MB

              MD5

              a8438e013ced50f10d2746e88b3ccd8b

              SHA1

              548d7ae808404384d7318f475ced137c48e75c84

              SHA256

              826fe9ef17bd606029fe8d725855d90b6f35c73ae2ef7aae0c7e38e7b7bb9e33

              SHA512

              b77eb14e4cf719ea4c247b59eced0601d3074c70889ec1cc70e68448f3e2e707cebf4dde3bb489b5666ab23601b8fc4b4dcc5dd0904a12c8bf47c8377099b9ce

              Download Submit

            • C:\Users\Admin\AppData\Local\Programs\Opera\94.0.4606.76\installer.exe
              Filesize

              6.0MB

              MD5

              a8438e013ced50f10d2746e88b3ccd8b

              SHA1

              548d7ae808404384d7318f475ced137c48e75c84

              SHA256

              826fe9ef17bd606029fe8d725855d90b6f35c73ae2ef7aae0c7e38e7b7bb9e33

              SHA512

              b77eb14e4cf719ea4c247b59eced0601d3074c70889ec1cc70e68448f3e2e707cebf4dde3bb489b5666ab23601b8fc4b4dcc5dd0904a12c8bf47c8377099b9ce

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
              Filesize

              2.7MB

              MD5

              5d18d85cc877cb39c9abf7fd3c0110eb

              SHA1

              849e1d046140db2a78c26764a9291d13bf60ca2f

              SHA256

              b2bbe3201bd57f28a50ad18ac00097e210d21aafd3f7a7cc32fb908ae3318166

              SHA512

              d9b453ee72ecbcfb7a394182c74dc6ce961eb000467625c9a95d105f54f1068dcbe7aa129e1bc8d973a078a0f72c6cc53d5541bb5014cd761df8e5a5326720fc

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
              Filesize

              2.7MB

              MD5

              5d18d85cc877cb39c9abf7fd3c0110eb

              SHA1

              849e1d046140db2a78c26764a9291d13bf60ca2f

              SHA256

              b2bbe3201bd57f28a50ad18ac00097e210d21aafd3f7a7cc32fb908ae3318166

              SHA512

              d9b453ee72ecbcfb7a394182c74dc6ce961eb000467625c9a95d105f54f1068dcbe7aa129e1bc8d973a078a0f72c6cc53d5541bb5014cd761df8e5a5326720fc

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301312107251\assistant\_sfx.exe
              Filesize

              1.7MB

              MD5

              0238df215bf6943892daf85de8ad433a

              SHA1

              3d905e4e2c0e9170df61b7a199321847691f945e

              SHA256

              a7818aca6acbe347df13d51d9750f6a852c5aa2a58580f7f2015113e0a3e06d7

              SHA512

              fc6c12e359b9a4ce84ef878f29648a4c97c38fd12ed80996c5e03829833220010fff9c751a99f399dad3529bda6438424194ed18236addfbe430343807aaad69

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301312107251\assistant\_sfx.exe
              Filesize

              1.7MB

              MD5

              0238df215bf6943892daf85de8ad433a

              SHA1

              3d905e4e2c0e9170df61b7a199321847691f945e

              SHA256

              a7818aca6acbe347df13d51d9750f6a852c5aa2a58580f7f2015113e0a3e06d7

              SHA512

              fc6c12e359b9a4ce84ef878f29648a4c97c38fd12ed80996c5e03829833220010fff9c751a99f399dad3529bda6438424194ed18236addfbe430343807aaad69

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301312107251\assistant\assistant_installer.exe
              Filesize

              2.1MB

              MD5

              9df6e2fbb7e38964f35016bf91ef7424

              SHA1

              d0c1266dc46814bc6165cf6a69e90581228989a7

              SHA256

              3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

              SHA512

              b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301312107251\assistant\assistant_installer.exe
              Filesize

              2.1MB

              MD5

              9df6e2fbb7e38964f35016bf91ef7424

              SHA1

              d0c1266dc46814bc6165cf6a69e90581228989a7

              SHA256

              3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

              SHA512

              b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301312107251\assistant\assistant_installer.exe
              Filesize

              2.1MB

              MD5

              9df6e2fbb7e38964f35016bf91ef7424

              SHA1

              d0c1266dc46814bc6165cf6a69e90581228989a7

              SHA256

              3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

              SHA512

              b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301312107251\opera_package
              Filesize

              86.7MB

              MD5

              038275aad393989e8c0b6634da083fc7

              SHA1

              65b4ebd22a289935b71d41077a06eeda11eed154

              SHA256

              ac96d0fca59c713690e2dd0d899c90d0c27ad4784f8425656ae14aefdaca3d05

              SHA512

              2dd5bdfa1e500232ac0ac06030db3b73b3a5af2a8d9fa1601913deeb853ec99249387bc96f5efa25919fa3ef2bf1c512e21dd07b2baecccacfa90548cd21a4d8

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202301312107251\pref_default_overrides
              Filesize

              57B

              MD5

              f488c9f9d9d5e631484d4bf155f45442

              SHA1

              0f0e624770e47bea5186748a9de85c677dd84fa7

              SHA256

              e6f214ff5ccbbe6e7abcf309138cdcb46d3fe3915e9bbbe8dd3c15afb439f708

              SHA512

              d72d1daa86e650a0589f6991f7a7bb3b7ca3484d49bc0d0d703b28b8f399f3123df2bf3c949a899fab55bde7d888736f655e462e2cd02ade59bbf9e67df54064

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2301312107230981764.dll
              Filesize

              4.3MB

              MD5

              832ae69091fba73338df9103db4f8be1

              SHA1

              d386710f4a8b5cfcf0ef2e0acc73f4dd883094b7

              SHA256

              191b3d16fa277b5dcbaa342ccafaea28c3ad25ddc1f9fa6ab2f3e23d46931e47

              SHA512

              b14835a3ac8e0a1089ded8620b2664ef2f1c86392f979ea4ac4e53eca97e1fbf3327ad40e8ea496bd9d4be36490cd781a12987e500d09d8d023847b90c76c387

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2301312107237232556.dll
              Filesize

              4.3MB

              MD5

              832ae69091fba73338df9103db4f8be1

              SHA1

              d386710f4a8b5cfcf0ef2e0acc73f4dd883094b7

              SHA256

              191b3d16fa277b5dcbaa342ccafaea28c3ad25ddc1f9fa6ab2f3e23d46931e47

              SHA512

              b14835a3ac8e0a1089ded8620b2664ef2f1c86392f979ea4ac4e53eca97e1fbf3327ad40e8ea496bd9d4be36490cd781a12987e500d09d8d023847b90c76c387

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2301312107257704620.dll
              Filesize

              4.3MB

              MD5

              832ae69091fba73338df9103db4f8be1

              SHA1

              d386710f4a8b5cfcf0ef2e0acc73f4dd883094b7

              SHA256

              191b3d16fa277b5dcbaa342ccafaea28c3ad25ddc1f9fa6ab2f3e23d46931e47

              SHA512

              b14835a3ac8e0a1089ded8620b2664ef2f1c86392f979ea4ac4e53eca97e1fbf3327ad40e8ea496bd9d4be36490cd781a12987e500d09d8d023847b90c76c387

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2301312107259571388.dll
              Filesize

              4.3MB

              MD5

              832ae69091fba73338df9103db4f8be1

              SHA1

              d386710f4a8b5cfcf0ef2e0acc73f4dd883094b7

              SHA256

              191b3d16fa277b5dcbaa342ccafaea28c3ad25ddc1f9fa6ab2f3e23d46931e47

              SHA512

              b14835a3ac8e0a1089ded8620b2664ef2f1c86392f979ea4ac4e53eca97e1fbf3327ad40e8ea496bd9d4be36490cd781a12987e500d09d8d023847b90c76c387

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2301312107261453972.dll
              Filesize

              4.3MB

              MD5

              832ae69091fba73338df9103db4f8be1

              SHA1

              d386710f4a8b5cfcf0ef2e0acc73f4dd883094b7

              SHA256

              191b3d16fa277b5dcbaa342ccafaea28c3ad25ddc1f9fa6ab2f3e23d46931e47

              SHA512

              b14835a3ac8e0a1089ded8620b2664ef2f1c86392f979ea4ac4e53eca97e1fbf3327ad40e8ea496bd9d4be36490cd781a12987e500d09d8d023847b90c76c387

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2301312108479462392.dll
              Filesize

              5.3MB

              MD5

              9b04d6bc0a44cb92ca307e730c0873ca

              SHA1

              85ac75c07b9798668b3273de693e4556eb198bcf

              SHA256

              fdb050d2fa5ca39d5e666adeedcb1aa28a4c6356706e6ed6d4fb18e4103af5e2

              SHA512

              5f496ad175cd49cf9cb095f3bd0fa4f0227e319e045f32ce8f77380f2a2a4b5b9425b5161a69172b74aeea0667b59fe7fa01d1eea0f39971d3c357ccb9870ead

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2301312109158372908.dll
              Filesize

              5.3MB

              MD5

              9b04d6bc0a44cb92ca307e730c0873ca

              SHA1

              85ac75c07b9798668b3273de693e4556eb198bcf

              SHA256

              fdb050d2fa5ca39d5e666adeedcb1aa28a4c6356706e6ed6d4fb18e4103af5e2

              SHA512

              5f496ad175cd49cf9cb095f3bd0fa4f0227e319e045f32ce8f77380f2a2a4b5b9425b5161a69172b74aeea0667b59fe7fa01d1eea0f39971d3c357ccb9870ead

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
              Filesize

              1.8MB

              MD5

              aa4de04ccc16b74a4c2301da8d621ec1

              SHA1

              d05c6d8200f6e6b1283df82d24d687adc47d9664

              SHA256

              e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

              SHA512

              28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
              Filesize

              1.8MB

              MD5

              aa4de04ccc16b74a4c2301da8d621ec1

              SHA1

              d05c6d8200f6e6b1283df82d24d687adc47d9664

              SHA256

              e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

              SHA512

              28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
              Filesize

              1.7MB

              MD5

              1bbf5dd0b6ca80e4c7c77495c3f33083

              SHA1

              e0520037e60eb641ec04d1e814394c9da0a6a862

              SHA256

              bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

              SHA512

              97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
              Filesize

              97KB

              MD5

              da1d0cd400e0b6ad6415fd4d90f69666

              SHA1

              de9083d2902906cacf57259cf581b1466400b799

              SHA256

              7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

              SHA512

              f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
              Filesize

              1.3MB

              MD5

              ec4efe0ebb80b619737bd26180cc76cc

              SHA1

              7fd72c0eb6bee289e4b2714cf1fb8c197754811b

              SHA256

              b1501df2280c557ad1535a504bd43c25611c168fd543008b7949c03b29e70547

              SHA512

              384ae150773cf07322c614459db9db98e1995f6b185579c7b56763ed0352e043f51d0e840f94ac3e832a1378452f090b68ee281c437b16da3762974723e64e1a

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
              Filesize

              1.3MB

              MD5

              ec4efe0ebb80b619737bd26180cc76cc

              SHA1

              7fd72c0eb6bee289e4b2714cf1fb8c197754811b

              SHA256

              b1501df2280c557ad1535a504bd43c25611c168fd543008b7949c03b29e70547

              SHA512

              384ae150773cf07322c614459db9db98e1995f6b185579c7b56763ed0352e043f51d0e840f94ac3e832a1378452f090b68ee281c437b16da3762974723e64e1a

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
              Filesize

              326KB

              MD5

              80d93d38badecdd2b134fe4699721223

              SHA1

              e829e58091bae93bc64e0c6f9f0bac999cfda23d

              SHA256

              c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

              SHA512

              9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
              Filesize

              326KB

              MD5

              80d93d38badecdd2b134fe4699721223

              SHA1

              e829e58091bae93bc64e0c6f9f0bac999cfda23d

              SHA256

              c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

              SHA512

              9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
              Filesize

              1.3MB

              MD5

              e801c5847f5f9d207db53aaaf5c6f3a2

              SHA1

              8e6818ce66555e2cca92e5c5f32551fb4a91645e

              SHA256

              196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

              SHA512

              303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
              Filesize

              1.3MB

              MD5

              e801c5847f5f9d207db53aaaf5c6f3a2

              SHA1

              8e6818ce66555e2cca92e5c5f32551fb4a91645e

              SHA256

              196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

              SHA512

              303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
              Filesize

              326KB

              MD5

              80d93d38badecdd2b134fe4699721223

              SHA1

              e829e58091bae93bc64e0c6f9f0bac999cfda23d

              SHA256

              c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

              SHA512

              9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
              Filesize

              326KB

              MD5

              80d93d38badecdd2b134fe4699721223

              SHA1

              e829e58091bae93bc64e0c6f9f0bac999cfda23d

              SHA256

              c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

              SHA512

              9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              Filesize

              2.7MB

              MD5

              5d18d85cc877cb39c9abf7fd3c0110eb

              SHA1

              849e1d046140db2a78c26764a9291d13bf60ca2f

              SHA256

              b2bbe3201bd57f28a50ad18ac00097e210d21aafd3f7a7cc32fb908ae3318166

              SHA512

              d9b453ee72ecbcfb7a394182c74dc6ce961eb000467625c9a95d105f54f1068dcbe7aa129e1bc8d973a078a0f72c6cc53d5541bb5014cd761df8e5a5326720fc

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              Filesize

              2.7MB

              MD5

              5d18d85cc877cb39c9abf7fd3c0110eb

              SHA1

              849e1d046140db2a78c26764a9291d13bf60ca2f

              SHA256

              b2bbe3201bd57f28a50ad18ac00097e210d21aafd3f7a7cc32fb908ae3318166

              SHA512

              d9b453ee72ecbcfb7a394182c74dc6ce961eb000467625c9a95d105f54f1068dcbe7aa129e1bc8d973a078a0f72c6cc53d5541bb5014cd761df8e5a5326720fc

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              Filesize

              2.7MB

              MD5

              5d18d85cc877cb39c9abf7fd3c0110eb

              SHA1

              849e1d046140db2a78c26764a9291d13bf60ca2f

              SHA256

              b2bbe3201bd57f28a50ad18ac00097e210d21aafd3f7a7cc32fb908ae3318166

              SHA512

              d9b453ee72ecbcfb7a394182c74dc6ce961eb000467625c9a95d105f54f1068dcbe7aa129e1bc8d973a078a0f72c6cc53d5541bb5014cd761df8e5a5326720fc

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              Filesize

              2.7MB

              MD5

              5d18d85cc877cb39c9abf7fd3c0110eb

              SHA1

              849e1d046140db2a78c26764a9291d13bf60ca2f

              SHA256

              b2bbe3201bd57f28a50ad18ac00097e210d21aafd3f7a7cc32fb908ae3318166

              SHA512

              d9b453ee72ecbcfb7a394182c74dc6ce961eb000467625c9a95d105f54f1068dcbe7aa129e1bc8d973a078a0f72c6cc53d5541bb5014cd761df8e5a5326720fc

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              Filesize

              2.7MB

              MD5

              5d18d85cc877cb39c9abf7fd3c0110eb

              SHA1

              849e1d046140db2a78c26764a9291d13bf60ca2f

              SHA256

              b2bbe3201bd57f28a50ad18ac00097e210d21aafd3f7a7cc32fb908ae3318166

              SHA512

              d9b453ee72ecbcfb7a394182c74dc6ce961eb000467625c9a95d105f54f1068dcbe7aa129e1bc8d973a078a0f72c6cc53d5541bb5014cd761df8e5a5326720fc

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
              Filesize

              647B

              MD5

              b94885355c09e58781884df4dc1ae5a0

              SHA1

              002e12bb2869ce3dc7a8227eb54b41d5a68f5f30

              SHA256

              e6926ccc2617d6a4a1f7d43ae96127c1b2967d9a8584746520a2954411c09aea

              SHA512

              4e5ac1e82ac0901db77fc75737d8749424f42b3076bd138e13406454347062d66254a39d095546db81eb20a8af105390106f1cd6074f5f20c1aefc7c3fc7b672

              Download Submit

            • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
              Filesize

              5.2MB

              MD5

              58e22c0ee91280156cdaadacac7acddb

              SHA1

              189c552c94a9b0ae0208763bca77f2801debc224

              SHA256

              765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714

              SHA512

              9f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6

              Download Submit

            • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
              Filesize

              5.2MB

              MD5

              58e22c0ee91280156cdaadacac7acddb

              SHA1

              189c552c94a9b0ae0208763bca77f2801debc224

              SHA256

              765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714

              SHA512

              9f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6

              Download Submit

            • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
              Filesize

              5.2MB

              MD5

              58e22c0ee91280156cdaadacac7acddb

              SHA1

              189c552c94a9b0ae0208763bca77f2801debc224

              SHA256

              765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714

              SHA512

              9f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6

              Download Submit

            • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
              Filesize

              5.2MB

              MD5

              58e22c0ee91280156cdaadacac7acddb

              SHA1

              189c552c94a9b0ae0208763bca77f2801debc224

              SHA256

              765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714

              SHA512

              9f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6

              Download Submit

            • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
              Filesize

              5.2MB

              MD5

              58e22c0ee91280156cdaadacac7acddb

              SHA1

              189c552c94a9b0ae0208763bca77f2801debc224

              SHA256

              765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714

              SHA512

              9f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6

              Download Submit

            • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
              Filesize

              5.2MB

              MD5

              58e22c0ee91280156cdaadacac7acddb

              SHA1

              189c552c94a9b0ae0208763bca77f2801debc224

              SHA256

              765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714

              SHA512

              9f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6

              Download Submit

            • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
              Filesize

              5.2MB

              MD5

              58e22c0ee91280156cdaadacac7acddb

              SHA1

              189c552c94a9b0ae0208763bca77f2801debc224

              SHA256

              765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714

              SHA512

              9f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6

              Download Submit

            • C:\Users\Admin\AppData\Roaming\.tlauncher\doubleRunningProtection.txt
              Filesize

              13B

              MD5

              47e1a929820053a73d376cd6caed7d46

              SHA1

              9874d45b5b56abaa2798c5c6f4096917368fe80d

              SHA256

              8970938c3075a3bd0a77b0844b88b223648d5af3aed2ce478e236d282745a71d

              SHA512

              41431819b2b772177e82f2d1f374791fb95677fc6e2fc07509019385ded724a70f9617c3be52555765e4771bca3b3d464fbaf8e96a5c06ff22349437013e111b

              Download Submit

            • C:\Users\Admin\AppData\Roaming\.tlauncher\doubleRunningProtection.txt
              Filesize

              13B

              MD5

              77c57bed3e8b3f6b807c1186fe20d38d

              SHA1

              1108cc948bf82375119aa902bc217548d3417a63

              SHA256

              6aec9f5efccddc0466e0c623cc05b95a8c564f0c1a4fe6995435a25318019109

              SHA512

              443557ddc26a4a1dcb878e09e94d058f2fb5ea2299e6d9463468d70636d3f22b95a48cbd14b2c2af88e7d2fc2f5796cb16c2c3a3052fb8e6f986b9963924265b

              Download Submit

            • C:\Users\Admin\AppData\Roaming\.tlauncher\doubleRunningProtection.txt
              Filesize

              13B

              MD5

              77c57bed3e8b3f6b807c1186fe20d38d

              SHA1

              1108cc948bf82375119aa902bc217548d3417a63

              SHA256

              6aec9f5efccddc0466e0c623cc05b95a8c564f0c1a4fe6995435a25318019109

              SHA512

              443557ddc26a4a1dcb878e09e94d058f2fb5ea2299e6d9463468d70636d3f22b95a48cbd14b2c2af88e7d2fc2f5796cb16c2c3a3052fb8e6f986b9963924265b

              Download Submit

            • C:\Users\Admin\AppData\Roaming\.tlauncher\tlauncher-2.0.properties
              Filesize

              51B

              MD5

              15aadbe464ab9a98f8e8a5d639ce83a7

              SHA1

              5b78f8f3676d9187aef13969d5e7433cb320b38c

              SHA256

              4fc0f7705d23405b6cced4b289b7da4875c69594ff099a3f5b535fba2936eafb

              SHA512

              d3f9136d6e959fcd7f882fc6695c761703e104ea25769ceebd10f147772e3d33a3d1f5e6561d79bd4396a0222095d1f5f3dbfa568a454eead96d30bb18a7fe37

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4246620582-653642754-1174164128-1000\83aa4cc77f591dfc2374580bbd95f6ba_26355f79-4f6c-4ae9-abeb-84bfcbb996ec
              Filesize

              45B

              MD5

              c8366ae350e7019aefc9d1e6e6a498c6

              SHA1

              5731d8a3e6568a5f2dfbbc87e3db9637df280b61

              SHA256

              11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

              SHA512

              33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
              Filesize

              40B

              MD5

              b780619509b9c7e3c639a0a2f31c3d87

              SHA1

              7dd0af81b023f6d317786f65d6a4ad09c66d3602

              SHA256

              171e9024171db6581449369c6d35448314cbbbd3bc8f5b71cc794d58f13fc1e8

              SHA512

              537d05b4401f31c1a0074a1da61e4eb6925a071a4db53bdca886f5df283c568e1f612455e97be232a5579a89e4f0a8303e5dc7d5638aa29c33c19b0b6ec27c3b

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
              Filesize

              40B

              MD5

              b780619509b9c7e3c639a0a2f31c3d87

              SHA1

              7dd0af81b023f6d317786f65d6a4ad09c66d3602

              SHA256

              171e9024171db6581449369c6d35448314cbbbd3bc8f5b71cc794d58f13fc1e8

              SHA512

              537d05b4401f31c1a0074a1da61e4eb6925a071a4db53bdca886f5df283c568e1f612455e97be232a5579a89e4f0a8303e5dc7d5638aa29c33c19b0b6ec27c3b

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
              Filesize

              40B

              MD5

              b780619509b9c7e3c639a0a2f31c3d87

              SHA1

              7dd0af81b023f6d317786f65d6a4ad09c66d3602

              SHA256

              171e9024171db6581449369c6d35448314cbbbd3bc8f5b71cc794d58f13fc1e8

              SHA512

              537d05b4401f31c1a0074a1da61e4eb6925a071a4db53bdca886f5df283c568e1f612455e97be232a5579a89e4f0a8303e5dc7d5638aa29c33c19b0b6ec27c3b

              Download Submit

            • memory/1388-177-0x0000000000400000-0x0000000000908000-memory.dmp

              Filesize

              5.0MB

              Download

            • memory/1764-179-0x0000000000400000-0x0000000000908000-memory.dmp

              Filesize

              5.0MB

              Download

            • memory/1764-156-0x0000000000400000-0x0000000000908000-memory.dmp

              Filesize

              5.0MB

              Download

            • memory/1948-222-0x00000000027A0000-0x00000000037A0000-memory.dmp

              Filesize

              16.0MB

              Download

            • memory/2532-151-0x00000000009E0000-0x0000000000DC8000-memory.dmp

              Filesize

              3.9MB

              Download

            • memory/2532-160-0x00000000009E0000-0x0000000000DC8000-memory.dmp

              Filesize

              3.9MB

              Download

            • memory/2556-162-0x0000000000400000-0x0000000000908000-memory.dmp

              Filesize

              5.0MB

              Download

            • memory/3120-274-0x00000000030B0000-0x00000000040B0000-memory.dmp

              Filesize

              16.0MB

              Download

            • memory/3972-178-0x0000000000400000-0x0000000000908000-memory.dmp

              Filesize

              5.0MB

              Download

            • memory/4324-237-0x0000000002930000-0x0000000003930000-memory.dmp

              Filesize

              16.0MB

              Download

            • memory/4324-205-0x0000000002930000-0x0000000003930000-memory.dmp

              Filesize

              16.0MB

              Download

            • memory/4324-249-0x0000000002930000-0x0000000003930000-memory.dmp

              Filesize

              16.0MB

              Download

            • memory/4324-250-0x0000000002930000-0x0000000003930000-memory.dmp

              Filesize

              16.0MB

              Download

            • memory/4324-233-0x0000000002930000-0x0000000003930000-memory.dmp

              Filesize

              16.0MB

              Download

            • memory/4324-241-0x0000000002930000-0x0000000003930000-memory.dmp

              Filesize

              16.0MB

              Download

            • memory/4324-245-0x0000000002930000-0x0000000003930000-memory.dmp

              Filesize

              16.0MB

              Download

            • memory/4324-247-0x0000000002930000-0x0000000003930000-memory.dmp

              Filesize

              16.0MB

              Download

            • memory/4324-235-0x0000000002930000-0x0000000003930000-memory.dmp

              Filesize

              16.0MB

              Download

            • memory/4324-239-0x0000000002930000-0x0000000003930000-memory.dmp

              Filesize

              16.0MB

              Download

            • memory/4324-238-0x0000000002930000-0x0000000003930000-memory.dmp

              Filesize

              16.0MB

              Download

            • memory/4324-248-0x0000000002930000-0x0000000003930000-memory.dmp

              Filesize

              16.0MB

              Download

            • memory/4324-246-0x0000000002930000-0x0000000003930000-memory.dmp

              Filesize

              16.0MB

              Download

            • memory/4324-244-0x0000000002930000-0x0000000003930000-memory.dmp

              Filesize

              16.0MB

              Download

            • memory/4324-229-0x0000000002930000-0x0000000003930000-memory.dmp

              Filesize

              16.0MB

              Download

            • memory/4324-231-0x0000000002930000-0x0000000003930000-memory.dmp

              Filesize

              16.0MB

              Download

            • memory/4580-140-0x0000000010000000-0x0000000010051000-memory.dmp

              Filesize

              324KB

              Download

            • memory/4580-199-0x0000000000300000-0x00000000006E8000-memory.dmp

              Filesize

              3.9MB

              Download

            • memory/4580-137-0x0000000000300000-0x00000000006E8000-memory.dmp

              Filesize

              3.9MB

              Download

            • memory/4580-142-0x0000000000300000-0x00000000006E8000-memory.dmp

              Filesize

              3.9MB

              Download

            • memory/4580-141-0x0000000006590000-0x0000000006593000-memory.dmp

              Filesize

              12KB

              Download

            • memory/4620-183-0x0000000000400000-0x0000000000908000-memory.dmp

              Filesize

              5.0MB

              Download

            • memory/4620-167-0x0000000000400000-0x0000000000908000-memory.dmp

              Filesize

              5.0MB

              Download

            • memory/4900-301-0x00000000028D0000-0x00000000038D0000-memory.dmp

              Filesize

              16.0MB

              Download

            • memory/4936-325-0x0000000002690000-0x0000000003690000-memory.dmp

              Filesize

              16.0MB

              Download

            • memory/4980-311-0x0000000003440000-0x0000000004440000-memory.dmp

              Filesize

              16.0MB

              Download