Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

01/02/2023, 00:47

230201-a5n2xsbb55 8

01/02/2023, 00:43

230201-a29jfsda7t 8

Analysis

  • max time kernel
    79s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/02/2023, 00:43

General

  • Target

    TLauncher-2.871-Installer-1.0.6-global.exe

  • Size

    23.6MB

  • MD5

    7a4472a78d0651e11d20aa08e43cc045

  • SHA1

    aab1d5f80d7399ae2c1982201733be7681d100b1

  • SHA256

    318df7404e6c4d5538a6d31997b95af52bbb8d40caf5553b3cbd9b1bc4f6db96

  • SHA512

    c152c9d21b0615548173dcc61accb1a1afd5b6f98e6ec21f6a7119536397f07a54ad4087669716c3344dd338ce4f24cecf9989d472f65eaa18c87d496f23c681

  • SSDEEP

    393216:gXQLpnUN/n8IPfs/dQETVlOBbpFEj9GZ1GphRqV56Hpk7IXOzDnKI17fyVS:ggLFUp8aHExiTI3qqHp6zvKcfyVS

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 13 IoCs
  • UPX packed file 21 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 9 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 24 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies system certificate store 2 TTPs 8 IoCs
  • Suspicious use of SetWindowsHookEx 24 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4880
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe" "__IRCT:3" "__IRTSS:24771453" "__IRSID:S-1-5-21-4246620582-653642754-1174164128-1000"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3868
      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
        "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1616
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816850 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" "__IRCT:3" "__IRTSS:1840872" "__IRSID:S-1-5-21-4246620582-653642754-1174164128-1000"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3656
          • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
            "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Enumerates connected drives
            • Modifies system certificate store
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4988
            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.76 --initial-client-data=0x340,0x344,0x348,0x31c,0x34c,0x6f048658,0x6f048668,0x6f048674
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:3980
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe" --version
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:4784
            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --pin-additional-shortcuts=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=4988 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20230201014411" --session-guid=1207a513-205b-4faf-bc3f-ecb463ad3c54 --server-tracking-blob=YzRmYTVmYWMxMmRjYzkxZmVlMmFmZTUxOTJlMWJiZDg5YmNkNDU5NTUxZmFmOGZkMDUzZmY0YzEyOTViOTBkNDp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInRpbWVzdGFtcCI6IjE2NzUyMTIyNTAuNzkwOSIsInVzZXJhZ2VudCI6IlNldHVwIEZhY3RvcnkgOS4wIiwidXRtIjp7ImNhbXBhaWduIjoiT3BlcmFEZXNrdG9wIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiTVNUTCJ9LCJ1dWlkIjoiNDBmZTk3MjAtZWNjMC00ZDAyLTgxYmUtNjQ0ZDZkZGNhYzEzIn0= --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=E005000000000000
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Enumerates connected drives
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4412
              • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.76 --initial-client-data=0x34c,0x350,0x354,0x31c,0x358,0x6e508658,0x6e508668,0x6e508674
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:4904
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010144111\assistant\_sfx.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010144111\assistant\_sfx.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:3472
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010144111\assistant\assistant_installer.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010144111\assistant\assistant_installer.exe" --version
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1620
              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010144111\assistant\assistant_installer.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010144111\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x2fc,0x322dc0,0x322dd0,0x322ddc
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:2032
      • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
        "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3708
        • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
          "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
          4⤵
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          PID:3688
  • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
    "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4960
    • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
      "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
      2⤵
      • Drops file in Program Files directory
      • Suspicious use of SetWindowsHookEx
      PID:4420

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

    Filesize

    50B

    MD5

    05943aea7193d4f03586368636f54765

    SHA1

    16869994763d64d363600e8a60040e6391f4600c

    SHA256

    ba9c55418ad22b9271ad9315be303e621095495cf2e16f6934e8a1a29ccb269a

    SHA512

    c4ce187d119ba3a5622bad4fb6fa8e7d2dfa063c9b0ec1451c6c0e47b6b8b94638a280575bb1e79ae4f2693092117c221cab0a1678926bf2b08d99c33a259a2e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

    Filesize

    471B

    MD5

    9cbb254ca8da5a4099c66d7dce2d69de

    SHA1

    3f328e1410c5c4ea2fa2b387dbef7c6479ea258c

    SHA256

    f6cad04bfeb909acd5c89c6137fd33b267fa2e021553b3515c82e9d7cfb3fc58

    SHA512

    93fe3387c563d18ea2f9cb96f1d868d1d5a26c0490126242279a6f39a2df53311fc9806ee14b4b0301195a17dd75abc318695aa0a328330820e8fc20b6fed4a4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

    Filesize

    434B

    MD5

    d079070c1411ebbdeabec4aeba07826a

    SHA1

    6070c6d6cc095fedb1d2c8005317267722327a2f

    SHA256

    5c93bc35cde7362ed142eadb975cbc86d5d8f9c33213c0cb90fbaf1980f51f25

    SHA512

    bc164a544ebc95c925ec3eb08a7fd030939fec973920c545cff2bb87ffd90d40ba78cd811f742e2cf2b029d784ea569ea9783fcd9c6d30479f8c080e716f88c6

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe

    Filesize

    2.7MB

    MD5

    cee2cd63ff0043fe458426d1d3bb9c5c

    SHA1

    6ca032c2cdd96efb828cde53763f84e17254debe

    SHA256

    092dcb9550146f0dd58dd601351d5a1ac20fad7e18c7868a00399a1d8d2b1eb7

    SHA512

    92ab563fb0a58355d86ed70fda5dadebfa0d00b67c6c78eb2428b57959e91d388003cd1d0e0192ca9844abc1c89a3b87e72b52ac0bc2f6badeffa884510685e8

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe

    Filesize

    2.7MB

    MD5

    cee2cd63ff0043fe458426d1d3bb9c5c

    SHA1

    6ca032c2cdd96efb828cde53763f84e17254debe

    SHA256

    092dcb9550146f0dd58dd601351d5a1ac20fad7e18c7868a00399a1d8d2b1eb7

    SHA512

    92ab563fb0a58355d86ed70fda5dadebfa0d00b67c6c78eb2428b57959e91d388003cd1d0e0192ca9844abc1c89a3b87e72b52ac0bc2f6badeffa884510685e8

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010144111\assistant\_sfx.exe

    Filesize

    1.7MB

    MD5

    0238df215bf6943892daf85de8ad433a

    SHA1

    3d905e4e2c0e9170df61b7a199321847691f945e

    SHA256

    a7818aca6acbe347df13d51d9750f6a852c5aa2a58580f7f2015113e0a3e06d7

    SHA512

    fc6c12e359b9a4ce84ef878f29648a4c97c38fd12ed80996c5e03829833220010fff9c751a99f399dad3529bda6438424194ed18236addfbe430343807aaad69

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010144111\assistant\_sfx.exe

    Filesize

    1.7MB

    MD5

    0238df215bf6943892daf85de8ad433a

    SHA1

    3d905e4e2c0e9170df61b7a199321847691f945e

    SHA256

    a7818aca6acbe347df13d51d9750f6a852c5aa2a58580f7f2015113e0a3e06d7

    SHA512

    fc6c12e359b9a4ce84ef878f29648a4c97c38fd12ed80996c5e03829833220010fff9c751a99f399dad3529bda6438424194ed18236addfbe430343807aaad69

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010144111\assistant\assistant_installer.exe

    Filesize

    2.1MB

    MD5

    9df6e2fbb7e38964f35016bf91ef7424

    SHA1

    d0c1266dc46814bc6165cf6a69e90581228989a7

    SHA256

    3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

    SHA512

    b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010144111\assistant\assistant_installer.exe

    Filesize

    2.1MB

    MD5

    9df6e2fbb7e38964f35016bf91ef7424

    SHA1

    d0c1266dc46814bc6165cf6a69e90581228989a7

    SHA256

    3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

    SHA512

    b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010144111\assistant\assistant_installer.exe

    Filesize

    2.1MB

    MD5

    9df6e2fbb7e38964f35016bf91ef7424

    SHA1

    d0c1266dc46814bc6165cf6a69e90581228989a7

    SHA256

    3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

    SHA512

    b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302010144111\opera_package

    Filesize

    16.5MB

    MD5

    fa3dd74c6e2be5070c4503ae0b6fca3f

    SHA1

    421ab4d56a9d9d36665133f2b3d02faa4d1482df

    SHA256

    67f7b42ed91fc4381d2c5bb5461206de63f29d41f9f92cbbb7571ee6aef8afea

    SHA512

    9cc28cc2797844cc3f973f46c9024adb2295ce632901ab4ea4f98d02d5fc6ec24a2273f157034ccbcf3766ce676398da579b7965f90fe3faa1a42203c1f23fec

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2302010144100884988.dll

    Filesize

    4.3MB

    MD5

    832ae69091fba73338df9103db4f8be1

    SHA1

    d386710f4a8b5cfcf0ef2e0acc73f4dd883094b7

    SHA256

    191b3d16fa277b5dcbaa342ccafaea28c3ad25ddc1f9fa6ab2f3e23d46931e47

    SHA512

    b14835a3ac8e0a1089ded8620b2664ef2f1c86392f979ea4ac4e53eca97e1fbf3327ad40e8ea496bd9d4be36490cd781a12987e500d09d8d023847b90c76c387

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2302010144102763980.dll

    Filesize

    4.3MB

    MD5

    832ae69091fba73338df9103db4f8be1

    SHA1

    d386710f4a8b5cfcf0ef2e0acc73f4dd883094b7

    SHA256

    191b3d16fa277b5dcbaa342ccafaea28c3ad25ddc1f9fa6ab2f3e23d46931e47

    SHA512

    b14835a3ac8e0a1089ded8620b2664ef2f1c86392f979ea4ac4e53eca97e1fbf3327ad40e8ea496bd9d4be36490cd781a12987e500d09d8d023847b90c76c387

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2302010144108114784.dll

    Filesize

    4.3MB

    MD5

    832ae69091fba73338df9103db4f8be1

    SHA1

    d386710f4a8b5cfcf0ef2e0acc73f4dd883094b7

    SHA256

    191b3d16fa277b5dcbaa342ccafaea28c3ad25ddc1f9fa6ab2f3e23d46931e47

    SHA512

    b14835a3ac8e0a1089ded8620b2664ef2f1c86392f979ea4ac4e53eca97e1fbf3327ad40e8ea496bd9d4be36490cd781a12987e500d09d8d023847b90c76c387

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2302010144140734412.dll

    Filesize

    4.3MB

    MD5

    832ae69091fba73338df9103db4f8be1

    SHA1

    d386710f4a8b5cfcf0ef2e0acc73f4dd883094b7

    SHA256

    191b3d16fa277b5dcbaa342ccafaea28c3ad25ddc1f9fa6ab2f3e23d46931e47

    SHA512

    b14835a3ac8e0a1089ded8620b2664ef2f1c86392f979ea4ac4e53eca97e1fbf3327ad40e8ea496bd9d4be36490cd781a12987e500d09d8d023847b90c76c387

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2302010144149014904.dll

    Filesize

    4.3MB

    MD5

    832ae69091fba73338df9103db4f8be1

    SHA1

    d386710f4a8b5cfcf0ef2e0acc73f4dd883094b7

    SHA256

    191b3d16fa277b5dcbaa342ccafaea28c3ad25ddc1f9fa6ab2f3e23d46931e47

    SHA512

    b14835a3ac8e0a1089ded8620b2664ef2f1c86392f979ea4ac4e53eca97e1fbf3327ad40e8ea496bd9d4be36490cd781a12987e500d09d8d023847b90c76c387

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe

    Filesize

    1.8MB

    MD5

    aa4de04ccc16b74a4c2301da8d621ec1

    SHA1

    d05c6d8200f6e6b1283df82d24d687adc47d9664

    SHA256

    e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

    SHA512

    28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe

    Filesize

    1.8MB

    MD5

    aa4de04ccc16b74a4c2301da8d621ec1

    SHA1

    d05c6d8200f6e6b1283df82d24d687adc47d9664

    SHA256

    e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

    SHA512

    28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

    Filesize

    1.7MB

    MD5

    1bbf5dd0b6ca80e4c7c77495c3f33083

    SHA1

    e0520037e60eb641ec04d1e814394c9da0a6a862

    SHA256

    bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

    SHA512

    97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

    Filesize

    97KB

    MD5

    da1d0cd400e0b6ad6415fd4d90f69666

    SHA1

    de9083d2902906cacf57259cf581b1466400b799

    SHA256

    7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

    SHA512

    f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

    Filesize

    1.3MB

    MD5

    7e08af319c9eb3297e09ca7bb8387de4

    SHA1

    4cf091f77a3eb9437ef33985e64bd10c1257284f

    SHA256

    6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

    SHA512

    bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

    Filesize

    1.3MB

    MD5

    7e08af319c9eb3297e09ca7bb8387de4

    SHA1

    4cf091f77a3eb9437ef33985e64bd10c1257284f

    SHA256

    6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

    SHA512

    bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

    Filesize

    326KB

    MD5

    80d93d38badecdd2b134fe4699721223

    SHA1

    e829e58091bae93bc64e0c6f9f0bac999cfda23d

    SHA256

    c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

    SHA512

    9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

    Filesize

    326KB

    MD5

    80d93d38badecdd2b134fe4699721223

    SHA1

    e829e58091bae93bc64e0c6f9f0bac999cfda23d

    SHA256

    c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

    SHA512

    9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

    Filesize

    1.3MB

    MD5

    e801c5847f5f9d207db53aaaf5c6f3a2

    SHA1

    8e6818ce66555e2cca92e5c5f32551fb4a91645e

    SHA256

    196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

    SHA512

    303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

    Filesize

    1.3MB

    MD5

    e801c5847f5f9d207db53aaaf5c6f3a2

    SHA1

    8e6818ce66555e2cca92e5c5f32551fb4a91645e

    SHA256

    196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

    SHA512

    303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

    Filesize

    326KB

    MD5

    80d93d38badecdd2b134fe4699721223

    SHA1

    e829e58091bae93bc64e0c6f9f0bac999cfda23d

    SHA256

    c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

    SHA512

    9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

    Filesize

    326KB

    MD5

    80d93d38badecdd2b134fe4699721223

    SHA1

    e829e58091bae93bc64e0c6f9f0bac999cfda23d

    SHA256

    c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

    SHA512

    9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

  • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

    Filesize

    2.7MB

    MD5

    cee2cd63ff0043fe458426d1d3bb9c5c

    SHA1

    6ca032c2cdd96efb828cde53763f84e17254debe

    SHA256

    092dcb9550146f0dd58dd601351d5a1ac20fad7e18c7868a00399a1d8d2b1eb7

    SHA512

    92ab563fb0a58355d86ed70fda5dadebfa0d00b67c6c78eb2428b57959e91d388003cd1d0e0192ca9844abc1c89a3b87e72b52ac0bc2f6badeffa884510685e8

  • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

    Filesize

    2.7MB

    MD5

    cee2cd63ff0043fe458426d1d3bb9c5c

    SHA1

    6ca032c2cdd96efb828cde53763f84e17254debe

    SHA256

    092dcb9550146f0dd58dd601351d5a1ac20fad7e18c7868a00399a1d8d2b1eb7

    SHA512

    92ab563fb0a58355d86ed70fda5dadebfa0d00b67c6c78eb2428b57959e91d388003cd1d0e0192ca9844abc1c89a3b87e72b52ac0bc2f6badeffa884510685e8

  • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

    Filesize

    2.7MB

    MD5

    cee2cd63ff0043fe458426d1d3bb9c5c

    SHA1

    6ca032c2cdd96efb828cde53763f84e17254debe

    SHA256

    092dcb9550146f0dd58dd601351d5a1ac20fad7e18c7868a00399a1d8d2b1eb7

    SHA512

    92ab563fb0a58355d86ed70fda5dadebfa0d00b67c6c78eb2428b57959e91d388003cd1d0e0192ca9844abc1c89a3b87e72b52ac0bc2f6badeffa884510685e8

  • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

    Filesize

    2.7MB

    MD5

    cee2cd63ff0043fe458426d1d3bb9c5c

    SHA1

    6ca032c2cdd96efb828cde53763f84e17254debe

    SHA256

    092dcb9550146f0dd58dd601351d5a1ac20fad7e18c7868a00399a1d8d2b1eb7

    SHA512

    92ab563fb0a58355d86ed70fda5dadebfa0d00b67c6c78eb2428b57959e91d388003cd1d0e0192ca9844abc1c89a3b87e72b52ac0bc2f6badeffa884510685e8

  • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

    Filesize

    2.7MB

    MD5

    cee2cd63ff0043fe458426d1d3bb9c5c

    SHA1

    6ca032c2cdd96efb828cde53763f84e17254debe

    SHA256

    092dcb9550146f0dd58dd601351d5a1ac20fad7e18c7868a00399a1d8d2b1eb7

    SHA512

    92ab563fb0a58355d86ed70fda5dadebfa0d00b67c6c78eb2428b57959e91d388003cd1d0e0192ca9844abc1c89a3b87e72b52ac0bc2f6badeffa884510685e8

  • C:\Users\Admin\AppData\Local\Temp\setuparguments.ini

    Filesize

    645B

    MD5

    3b4a4bb26d2cc84dd276ef92f64390f1

    SHA1

    e363ddfa31797c325a546be4ff45c0a0d864f530

    SHA256

    89c8e5fb1996d6f73fca4dad0493356f8cd419f0f65990f526729821629b47e3

    SHA512

    a9047bc835570272b668056449981e8cc01754173f27e8669bc5b9d67b834cada36a889b03ce8837f1384756ffca3a65d86ac10b46cf7b91aeb1d8f82bf56ac1

  • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

    Filesize

    5.2MB

    MD5

    58e22c0ee91280156cdaadacac7acddb

    SHA1

    189c552c94a9b0ae0208763bca77f2801debc224

    SHA256

    765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714

    SHA512

    9f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6

  • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

    Filesize

    5.2MB

    MD5

    58e22c0ee91280156cdaadacac7acddb

    SHA1

    189c552c94a9b0ae0208763bca77f2801debc224

    SHA256

    765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714

    SHA512

    9f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6

  • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

    Filesize

    5.2MB

    MD5

    58e22c0ee91280156cdaadacac7acddb

    SHA1

    189c552c94a9b0ae0208763bca77f2801debc224

    SHA256

    765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714

    SHA512

    9f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6

  • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\aopalliance\aopalliance\1.0\aopalliance-1.0.jar

    Filesize

    4KB

    MD5

    04177054e180d09e3998808efa0401c7

    SHA1

    0235ba8b489512805ac13a8f9ea77a1ca5ebe3e8

    SHA256

    0addec670fedcd3f113c5c8091d783280d23f75e3acb841b61a9cdb079376a08

    SHA512

    3f44a932d8c00cfeee2eb057bcd7c301a2d029063e0a916e1e20b3aec4877d19d67a2fd8aaf58fa2d5a00133d1602128a7f50912ffb6cabc7b0fdc7fbda3f8a1

  • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\com\github\junrar\junrar\0.7\junrar-0.7.jar

    Filesize

    151KB

    MD5

    75a215b9e921044cd2c88e73f6cb9745

    SHA1

    18cc717b85af0b12ba922abf415c2ff4716f8219

    SHA256

    7c764fa1af319b98ff452189ab31bb722ea74ed7a52b17b0c6282249c10a61fc

    SHA512

    1a44af2f3f8dbfbf38ad5f71ef11b32d5822d734f77af2cdea419fb6af845e894acb60bffbcebb4533068d86b55a22a8b0f74be20b204c2343bdb165d9c787f9

  • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\com\google\guava\guava\19.0\guava-19.0.jar

    Filesize

    2.2MB

    MD5

    43bfc49bdc7324f6daaa60c1ee9f3972

    SHA1

    6ce200f6b23222af3d8abb6b6459e6c44f4bb0e9

    SHA256

    58d4cc2e05ebb012bbac568b032f75623be1cb6fb096f3c60c72a86f7f057de4

    SHA512

    834f2bf4a5b35edffde0263409649aeaf34ca9a742ba511a06bb9b01626f9e774d2d3c8ba91a7905929dc8cd5e6471de29f7d0ab10260ece2af709b7fdbe4bc3

  • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\com\google\inject\extentions\guice-assistedinject\4.1.0\guice-assistedinject-4.1.0.jar

    Filesize

    41KB

    MD5

    65912196b6e91f2ceb933001c1fb5c94

    SHA1

    af799dd7e23e6fe8c988da12314582072b07edcb

    SHA256

    663728123fb9a6b79ea39ae289e5d56b4113e1b8e9413eb792f91e53a6dd5868

    SHA512

    60b15182130ddfd801dd0438058d641dd5ba9122f2d1e081eb63f5e2c12fff0271d9d47c58925be0be8267ed22ae893ea9d1b251faba17dc1d2552b5d93056de

  • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\com\google\inject\guice\4.1.0\guice-4.1.0.jar

    Filesize

    658KB

    MD5

    41f66d1d4d250efebde3bbf8b2d55dfa

    SHA1

    eeb69005da379a10071aa4948c48d89250febb07

    SHA256

    9b9df27a5b8c7864112b4137fd92b36c3f1395bfe57be42fedf2f520ead1a93e

    SHA512

    109a1595668293b32376e885ad59e0e4c0e088ea00f58119f0f7d0d2055f03eb93a9f92d974b6dbd56ef721792ac03c889d9add3a2850aa7ccd732c2682d17ef

  • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\dnsjava\dnsjava\2.1.8\dnsjava-2.1.8.jar

    Filesize

    307KB

    MD5

    540f330717bca9d29c8762cf6daca443

    SHA1

    eed8a2cbf56cc60d07a189a429ead3067564193c

    SHA256

    52de1ff2a7556ac2cc4284abd7123bc3d6274210fc4e3b1d9ba90efad5f6a153

    SHA512

    a4bcb8bbb43906f42faf1802c504ccc9c616e49afd5dd7db77676d13aaed79a300979ffc2195b680a9c6d5f03466b611b6f1338d824099816aa224b234760f4b

  • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\javax\inject\javax.inject\1\javax.inject-1.jar

    Filesize

    2KB

    MD5

    289075e48b909e9e74e6c915b3631d2e

    SHA1

    6975da39a7040257bd51d21a231b76c915872d38

    SHA256

    91c77044a50c481636c32d916fd89c9118a72195390452c81065080f957de7ff

    SHA512

    e126b7ccf3e42fd1984a0beef1004a7269a337c202e59e04e8e2af714280d2f2d8d2ba5e6f59481b8dcd34aaf35c966a688d0b48ec7e96f102c274dc0d3b381e

  • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\log4j\log4j\1.2.17\log4j-1.2.17.jar

    Filesize

    478KB

    MD5

    04a41f0a068986f0f73485cf507c0f40

    SHA1

    5af35056b4d257e4b64b9e8069c0746e8b08629f

    SHA256

    1d31696445697720527091754369082a6651bd49781b6005deb94e56753406f9

    SHA512

    3f12937a69ba60d0f5e86265168d6a0d069ce20d95b99a3ace463987655e7c63053f4d7e36e32f2b53f86992b888ca477bf81253ad04c721896b397f94ee57fc

  • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\net\sf\jopt-simple\jopt-simple\4.9\jopt-simple-4.9.jar

    Filesize

    64KB

    MD5

    39c6476e4de3d4f90ad4ca0ddca48ec2

    SHA1

    ee9e9eaa0a35360dcfeac129ff4923215fd65904

    SHA256

    26c5856e954b5f864db76f13b86919b59c6eecf9fd930b96baa8884626baf2f5

    SHA512

    fd04c19bce810a1548b2d2eaadb915cff2cbc81a81ec5258aafc1ba329100daedc49edad1fc7b254ab892996796124283d7004b5414f662c0efa3979add9ca5f

  • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\apache\commons\commons-lang3\3.4\commons-lang3-3.4.jar

    Filesize

    424KB

    MD5

    8667a442ee77e509fbe8176b94726eb2

    SHA1

    5fe28b9518e58819180a43a850fbc0dd24b7c050

    SHA256

    734c8356420cc8e30c795d64fd1fcd5d44ea9d90342a2cc3262c5158fbc6d98b

    SHA512

    b1b556692341a240f8b81f8f71b8b5c0225ccf857ce1b185e7fe6d7a9bb2a4d77823496cd6e2697a20386e7f3ba02d476a0e4ff38071367beb3090104544922d

  • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\apache\httpcomponents\fluent-hc\4.5.13\fluent-hc-4.5.13.jar

    Filesize

    30KB

    MD5

    8f7e4f1a95a870ebee87ddacc425362c

    SHA1

    300bf1846737e34b9ea10faae257ca8fdcd0616f

    SHA256

    f883b6b027d5e05c53e48e4fe3548715c52dbd590ffa3f52d039574f1a4d0728

    SHA512

    98e30ed27d6ac078450efe5e236117445c93e05eb280399e056816c52643a3a33adce5e3a885ce8488186f38d05e0fb6c65dfcbaa509be8c6047ef2f0870d9b0

  • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\apache\logging\log4j\log4j-core\2.14.1\log4j-core-2.14.1.jar

    Filesize

    1.7MB

    MD5

    948dda787593340a7af1a18e328b7b7f

    SHA1

    9141212b8507ab50a45525b545b39d224614528b

    SHA256

    ade7402a70667a727635d5c4c29495f4ff96f061f12539763f6f123973b465b0

    SHA512

    6e41ff42f12deedb8da06cbed73d0a9a5389660b7ee058436f8fcb6b14a6ab3105faf8e3f2c007d38ccc85af1e704505b84be5a80d8e68a434aae82b54b85f70

  • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\tlauncher\picture-bundle\3.5\picture-bundle-3.5.jar

    Filesize

    2.1MB

    MD5

    c93265b9d8bbe2b8d07f34893e5945c4

    SHA1

    ad0a3c5e104b95f842998d39c6a50f38b7bf1d03

    SHA256

    7238f234112b746de9dd96d7cafe34436c3f43a9f4ebd5659a38e5ba1b11d277

    SHA512

    0cbc136d1034ea72729cbe70e4459d015a1e4afde087f2abacb0d90603e344f828736a4c9c35e2b29e169e015ba14ddd2073694dfb789b16616275d6b89a6383

  • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\tlauncher\skin-server-API\1.0\skin-server-API-1.0.jar

    Filesize

    14KB

    MD5

    13a8e72587ac6eacfb0986f75e51eb7c

    SHA1

    6c3daf89705427f73e6106d2d4d9619e99c5ecb5

    SHA256

    1fcffa073f722737431e2699b1f3ea48b92a3b825397d8f0d1464e4d4d15a014

    SHA512

    134735390415f60d0c42ff33a060bda508e273b35fc9aab271c20ff23f331b51cf3fa36443009e0987049f6bfb22c4098a1473e65ea0349e719fbf4b528f344e

  • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\tlauncher\tlauncher-resource\1.4\tlauncher-resource-1.4.jar

    Filesize

    3.2MB

    MD5

    acbc8aa5ba5cdddf5f1e67befe8cc597

    SHA1

    63b4bf89744b532e65c1afa3294743d2b3798f2b

    SHA256

    1f46b3a163012f9729905633b5e5e03ce385066ae43138a564729c942f9ca6b9

    SHA512

    d974a032d9af451c0dd51fbc0d64840f3e03eb502f40e4ab60d6722913b8a48d44a75752fcff60656e4d19089570a894222959745af11bcdf93ea1544192fee3

  • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\tukaani\xz\1.5\xz-1.5.jar

    Filesize

    97KB

    MD5

    51050e595b308c4aec8ac314f66e18bc

    SHA1

    9c64274b7dbb65288237216e3fae7877fd3f2bee

    SHA256

    86f30fa8775fa3a62cdb39d1ed78a6019164c1058864048d42cbee244e26e840

    SHA512

    c5c130bf22f24f61b57fc0c6243e7f961ca2a8928416e8bb288aec6650c1c1c06ace4383913cd1277fc6785beb9a74458807ea7e3d6b2e09189cfaf2fb9ab7e1

  • C:\Users\Admin\AppData\Roaming\.tlauncher\doubleRunningProtection.txt

    Filesize

    13B

    MD5

    0b868dc8d6b26711dbd49ef76c6514b0

    SHA1

    14fe1e315c218cb7e95433f8cedc302b8813ab39

    SHA256

    1ada29ac4c0cab4e70034a4af6547a947a9973d0507ce7ba9cef72cbfc42b3a9

    SHA512

    d371f33959be9b80e2d868c2daaabc5d7183dcfd90058ee01c4681d9d0545e1d86628fa18f145d50433b51ed550fda860fa2cbf704ad66f400ef293150c6347b

  • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

    Filesize

    40B

    MD5

    4cb01d480d86664da5ca25b2be76711a

    SHA1

    8740e368d65a99f959f4e2c89db1ad91a85ffc52

    SHA256

    e2b74bced3839ee6673cdf81f4cface6745f9b61c62e459bdfcb6514ba1a5532

    SHA512

    635f66b55f0ffda52ddf0381ae6ef337de73e7ad72d90911776d5f2bdf9cdccb4fe60f77754ab9b45f1872b0081a246d68362109b9a80c4a9fb18578e2a89cf1

  • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

    Filesize

    40B

    MD5

    4cb01d480d86664da5ca25b2be76711a

    SHA1

    8740e368d65a99f959f4e2c89db1ad91a85ffc52

    SHA256

    e2b74bced3839ee6673cdf81f4cface6745f9b61c62e459bdfcb6514ba1a5532

    SHA512

    635f66b55f0ffda52ddf0381ae6ef337de73e7ad72d90911776d5f2bdf9cdccb4fe60f77754ab9b45f1872b0081a246d68362109b9a80c4a9fb18578e2a89cf1

  • memory/3656-176-0x00000000002D0000-0x00000000006B8000-memory.dmp

    Filesize

    3.9MB

  • memory/3656-152-0x00000000002D0000-0x00000000006B8000-memory.dmp

    Filesize

    3.9MB

  • memory/3688-240-0x00000000033C0000-0x00000000043C0000-memory.dmp

    Filesize

    16.0MB

  • memory/3688-261-0x00000000033C0000-0x00000000043C0000-memory.dmp

    Filesize

    16.0MB

  • memory/3688-195-0x00000000033C0000-0x00000000043C0000-memory.dmp

    Filesize

    16.0MB

  • memory/3688-273-0x00000000033C0000-0x00000000043C0000-memory.dmp

    Filesize

    16.0MB

  • memory/3688-272-0x00000000033C0000-0x00000000043C0000-memory.dmp

    Filesize

    16.0MB

  • memory/3688-271-0x00000000033C0000-0x00000000043C0000-memory.dmp

    Filesize

    16.0MB

  • memory/3688-232-0x00000000033C0000-0x00000000043C0000-memory.dmp

    Filesize

    16.0MB

  • memory/3688-268-0x00000000033C0000-0x00000000043C0000-memory.dmp

    Filesize

    16.0MB

  • memory/3688-264-0x00000000033C0000-0x00000000043C0000-memory.dmp

    Filesize

    16.0MB

  • memory/3868-140-0x0000000010000000-0x0000000010051000-memory.dmp

    Filesize

    324KB

  • memory/3868-142-0x0000000000C00000-0x0000000000FE8000-memory.dmp

    Filesize

    3.9MB

  • memory/3868-185-0x0000000000C00000-0x0000000000FE8000-memory.dmp

    Filesize

    3.9MB

  • memory/3868-137-0x0000000000C00000-0x0000000000FE8000-memory.dmp

    Filesize

    3.9MB

  • memory/3868-141-0x0000000006DD0000-0x0000000006DD3000-memory.dmp

    Filesize

    12KB

  • memory/3980-165-0x0000000000400000-0x0000000000908000-memory.dmp

    Filesize

    5.0MB

  • memory/4412-178-0x0000000000400000-0x0000000000908000-memory.dmp

    Filesize

    5.0MB

  • memory/4420-224-0x00000000029A0000-0x00000000039A0000-memory.dmp

    Filesize

    16.0MB

  • memory/4420-216-0x00000000029A0000-0x00000000039A0000-memory.dmp

    Filesize

    16.0MB

  • memory/4784-166-0x0000000000400000-0x0000000000908000-memory.dmp

    Filesize

    5.0MB

  • memory/4904-177-0x0000000000400000-0x0000000000908000-memory.dmp

    Filesize

    5.0MB

  • memory/4988-163-0x0000000000400000-0x0000000000908000-memory.dmp

    Filesize

    5.0MB