Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

TLauncher-...al.exe

windows7-x64

10

TLauncher-...al.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    152s
  • max time network
    180s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    12/02/2023, 03:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    TLauncher-2.871-Installer-1.0.6-global.exe

  • Size

    23.6MB

  • MD5

    7a4472a78d0651e11d20aa08e43cc045

  • SHA1

    aab1d5f80d7399ae2c1982201733be7681d100b1

  • SHA256

    318df7404e6c4d5538a6d31997b95af52bbb8d40caf5553b3cbd9b1bc4f6db96

  • SHA512

    c152c9d21b0615548173dcc61accb1a1afd5b6f98e6ec21f6a7119536397f07a54ad4087669716c3344dd338ce4f24cecf9989d472f65eaa18c87d496f23c681

  • SSDEEP

    393216:gXQLpnUN/n8IPfs/dQETVlOBbpFEj9GZ1GphRqV56Hpk7IXOzDnKI17fyVS:ggLFUp8aHExiTI3qqHp6zvKcfyVS

Score
8/10
discoveryspywarestealerupx

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 9 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies system certificate store 2 TTPs 10 IoCs
    evasionspywaretrojan
  • Suspicious use of SetWindowsHookEx 22 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2184
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe" "__IRCT:3" "__IRTSS:24771453" "__IRSID:S-1-5-21-2295526160-1155304984-640977766-1000"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4972
      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
        "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4604
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816850 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" "__IRCT:3" "__IRTSS:1840872" "__IRSID:S-1-5-21-2295526160-1155304984-640977766-1000"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4356
          • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
            "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Enumerates connected drives
            • Modifies system certificate store
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4368
            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=95.0.4635.37 --initial-client-data=0x340,0x344,0x348,0x31c,0x34c,0x6f9ce428,0x6f9ce438,0x6f9ce444
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:4480
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe" --version
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:1516
            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=es --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --pin-additional-shortcuts=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=4368 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20230212050001" --session-guid=d98695b7-1a8f-42b7-98df-f3b5845ba032 --server-tracking-blob=MjQ1NTdlNzY1YTI5MTFlOTc5YWY5ZmNlOWIwMWIzODI4MmUyYWFmYTEyZGZjOTNmYmY3ZmY0OTQ0OTliM2Q0NDp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInRpbWVzdGFtcCI6IjE2NzYxNzQ0MDYuMzk5OSIsInVzZXJhZ2VudCI6IlNldHVwIEZhY3RvcnkgOS4wIiwidXRtIjp7ImNhbXBhaWduIjoiT3BlcmFEZXNrdG9wIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiTVNUTCJ9LCJ1dWlkIjoiMGE3MDFjMTctMTI4ZS00NzQ1LWE2MGMtOTk0Zjg0MzQyMDEzIn0= --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=B805000000000000
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Enumerates connected drives
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4168
              • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=95.0.4635.37 --initial-client-data=0x34c,0x350,0x354,0x31c,0x358,0x6eeae428,0x6eeae438,0x6eeae444
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:4304
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302120500011\assistant\_sfx.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302120500011\assistant\_sfx.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:4280
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302120500011\assistant\assistant_installer.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302120500011\assistant\assistant_installer.exe" --version
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1096
              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302120500011\assistant\assistant_installer.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302120500011\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x2fc,0x262dc0,0x262dd0,0x262ddc
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4128
      • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
        "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:504
        • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
          "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
          4⤵
          • Suspicious use of SetWindowsHookEx
          PID:4436

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
    Filesize

    471B

    MD5

    1f4ed1c10e0b0c3cb9f5e9b8a7467e77

    SHA1

    16eb955e1825fbc737db36e82fdf8778c80e9fbb

    SHA256

    03eb24ad11bba3590d0100ff5bed07fa895bbff5ae7af13d5121deb4b509e918

    SHA512

    06c9be897247ccc5d066b597c7c485f2cd491b3ceed849d4f8ab02120715138753dea5236d43b2ec72500120792b14a25a5165a247b7b5395617e461339fefc0

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
    Filesize

    404B

    MD5

    cd7c9646ee66a74f800cd33e626b765e

    SHA1

    4c5c62803ffaee25ed0d8f71279b235c88654913

    SHA256

    444ed3df65739809f7c644d746d15eeb6c38f398950b9670d3cbf72aa30e9565

    SHA512

    9727ad5d2185706c59ebae07ee31629d7084897c912511e5f270323a107cedc8b74b2dc820410492de7011767a386b269fc683c352cd441ea2aca5f73e214813

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
    Filesize

    2.7MB

    MD5

    4fe52dbefaac8cd57ef4d1a0b3b34f61

    SHA1

    4ca459a86233a9ef21073fab51be0bf4ce3619b4

    SHA256

    f0ac334b00a51b96446ce25c8d00b6942dfe5795060bb3b34dda2b257e310723

    SHA512

    0190ed3bc3b4af67297d17d21a2885026cb40693988fbefb05dd83aae4aa42bcb38f6e07b7154d3d90b055dd85a323009c17ba9c7f07ee29db60c60f25545b4a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
    Filesize

    2.7MB

    MD5

    4fe52dbefaac8cd57ef4d1a0b3b34f61

    SHA1

    4ca459a86233a9ef21073fab51be0bf4ce3619b4

    SHA256

    f0ac334b00a51b96446ce25c8d00b6942dfe5795060bb3b34dda2b257e310723

    SHA512

    0190ed3bc3b4af67297d17d21a2885026cb40693988fbefb05dd83aae4aa42bcb38f6e07b7154d3d90b055dd85a323009c17ba9c7f07ee29db60c60f25545b4a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302120500011\assistant\_sfx.exe
    Filesize

    1.7MB

    MD5

    0238df215bf6943892daf85de8ad433a

    SHA1

    3d905e4e2c0e9170df61b7a199321847691f945e

    SHA256

    a7818aca6acbe347df13d51d9750f6a852c5aa2a58580f7f2015113e0a3e06d7

    SHA512

    fc6c12e359b9a4ce84ef878f29648a4c97c38fd12ed80996c5e03829833220010fff9c751a99f399dad3529bda6438424194ed18236addfbe430343807aaad69

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302120500011\assistant\_sfx.exe
    Filesize

    1.7MB

    MD5

    0238df215bf6943892daf85de8ad433a

    SHA1

    3d905e4e2c0e9170df61b7a199321847691f945e

    SHA256

    a7818aca6acbe347df13d51d9750f6a852c5aa2a58580f7f2015113e0a3e06d7

    SHA512

    fc6c12e359b9a4ce84ef878f29648a4c97c38fd12ed80996c5e03829833220010fff9c751a99f399dad3529bda6438424194ed18236addfbe430343807aaad69

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302120500011\assistant\assistant_installer.exe
    Filesize

    2.1MB

    MD5

    9df6e2fbb7e38964f35016bf91ef7424

    SHA1

    d0c1266dc46814bc6165cf6a69e90581228989a7

    SHA256

    3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

    SHA512

    b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302120500011\assistant\assistant_installer.exe
    Filesize

    2.1MB

    MD5

    9df6e2fbb7e38964f35016bf91ef7424

    SHA1

    d0c1266dc46814bc6165cf6a69e90581228989a7

    SHA256

    3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

    SHA512

    b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302120500011\assistant\assistant_installer.exe
    Filesize

    2.1MB

    MD5

    9df6e2fbb7e38964f35016bf91ef7424

    SHA1

    d0c1266dc46814bc6165cf6a69e90581228989a7

    SHA256

    3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

    SHA512

    b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302120500011\opera_package
    Filesize

    86.8MB

    MD5

    d952728a4ce9fa6fd1df1e71f2cdad79

    SHA1

    62a0cdac813c83cea2f5a406a6940982f33d839a

    SHA256

    f115d42f06f27045cf1cf04bbfa4591789547ddb3614be6c912fa75bd4eb4cb6

    SHA512

    8720da841a9d31832b943fb56271e3efcb05520d0d5506a5ce823d8d5e909ebafd796d3d2b8afd82e2479329b84ee1813de5380598a7271ca9d5b64a2d3b4534

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2302120459464284368.dll
    Filesize

    4.6MB

    MD5

    5ff9275c5cee292fff9034f03bd847e1

    SHA1

    37bf88e062278882492823c7039b7cf374756ae0

    SHA256

    2309501e723a011f4bf2b505e178cbb97af4d798a8720d344f2730c4d756ee08

    SHA512

    f58e5981e25cd6cdd5edb9d9974f137615dee7516d221bf0df08a7425ec68361f29d7b5ca1b835c476fcbcee0df4a028bfa5308867fb3976aaba67cbf8b8dd02

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2302120459468824480.dll
    Filesize

    4.6MB

    MD5

    5ff9275c5cee292fff9034f03bd847e1

    SHA1

    37bf88e062278882492823c7039b7cf374756ae0

    SHA256

    2309501e723a011f4bf2b505e178cbb97af4d798a8720d344f2730c4d756ee08

    SHA512

    f58e5981e25cd6cdd5edb9d9974f137615dee7516d221bf0df08a7425ec68361f29d7b5ca1b835c476fcbcee0df4a028bfa5308867fb3976aaba67cbf8b8dd02

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2302120459487251516.dll
    Filesize

    4.6MB

    MD5

    5ff9275c5cee292fff9034f03bd847e1

    SHA1

    37bf88e062278882492823c7039b7cf374756ae0

    SHA256

    2309501e723a011f4bf2b505e178cbb97af4d798a8720d344f2730c4d756ee08

    SHA512

    f58e5981e25cd6cdd5edb9d9974f137615dee7516d221bf0df08a7425ec68361f29d7b5ca1b835c476fcbcee0df4a028bfa5308867fb3976aaba67cbf8b8dd02

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2302120500017424168.dll
    Filesize

    4.6MB

    MD5

    5ff9275c5cee292fff9034f03bd847e1

    SHA1

    37bf88e062278882492823c7039b7cf374756ae0

    SHA256

    2309501e723a011f4bf2b505e178cbb97af4d798a8720d344f2730c4d756ee08

    SHA512

    f58e5981e25cd6cdd5edb9d9974f137615dee7516d221bf0df08a7425ec68361f29d7b5ca1b835c476fcbcee0df4a028bfa5308867fb3976aaba67cbf8b8dd02

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2302120500114384304.dll
    Filesize

    4.6MB

    MD5

    5ff9275c5cee292fff9034f03bd847e1

    SHA1

    37bf88e062278882492823c7039b7cf374756ae0

    SHA256

    2309501e723a011f4bf2b505e178cbb97af4d798a8720d344f2730c4d756ee08

    SHA512

    f58e5981e25cd6cdd5edb9d9974f137615dee7516d221bf0df08a7425ec68361f29d7b5ca1b835c476fcbcee0df4a028bfa5308867fb3976aaba67cbf8b8dd02

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
    Filesize

    1.8MB

    MD5

    aa4de04ccc16b74a4c2301da8d621ec1

    SHA1

    d05c6d8200f6e6b1283df82d24d687adc47d9664

    SHA256

    e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

    SHA512

    28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
    Filesize

    1.8MB

    MD5

    aa4de04ccc16b74a4c2301da8d621ec1

    SHA1

    d05c6d8200f6e6b1283df82d24d687adc47d9664

    SHA256

    e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

    SHA512

    28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
    Filesize

    1.7MB

    MD5

    1bbf5dd0b6ca80e4c7c77495c3f33083

    SHA1

    e0520037e60eb641ec04d1e814394c9da0a6a862

    SHA256

    bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

    SHA512

    97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
    Filesize

    97KB

    MD5

    da1d0cd400e0b6ad6415fd4d90f69666

    SHA1

    de9083d2902906cacf57259cf581b1466400b799

    SHA256

    7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

    SHA512

    f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
    Filesize

    1.3MB

    MD5

    7e08af319c9eb3297e09ca7bb8387de4

    SHA1

    4cf091f77a3eb9437ef33985e64bd10c1257284f

    SHA256

    6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

    SHA512

    bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
    Filesize

    1.3MB

    MD5

    7e08af319c9eb3297e09ca7bb8387de4

    SHA1

    4cf091f77a3eb9437ef33985e64bd10c1257284f

    SHA256

    6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

    SHA512

    bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
    Filesize

    326KB

    MD5

    80d93d38badecdd2b134fe4699721223

    SHA1

    e829e58091bae93bc64e0c6f9f0bac999cfda23d

    SHA256

    c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

    SHA512

    9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
    Filesize

    326KB

    MD5

    80d93d38badecdd2b134fe4699721223

    SHA1

    e829e58091bae93bc64e0c6f9f0bac999cfda23d

    SHA256

    c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

    SHA512

    9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
    Filesize

    1.3MB

    MD5

    e801c5847f5f9d207db53aaaf5c6f3a2

    SHA1

    8e6818ce66555e2cca92e5c5f32551fb4a91645e

    SHA256

    196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

    SHA512

    303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
    Filesize

    1.3MB

    MD5

    e801c5847f5f9d207db53aaaf5c6f3a2

    SHA1

    8e6818ce66555e2cca92e5c5f32551fb4a91645e

    SHA256

    196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

    SHA512

    303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
    Filesize

    326KB

    MD5

    80d93d38badecdd2b134fe4699721223

    SHA1

    e829e58091bae93bc64e0c6f9f0bac999cfda23d

    SHA256

    c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

    SHA512

    9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
    Filesize

    326KB

    MD5

    80d93d38badecdd2b134fe4699721223

    SHA1

    e829e58091bae93bc64e0c6f9f0bac999cfda23d

    SHA256

    c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

    SHA512

    9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
    Filesize

    2.7MB

    MD5

    4fe52dbefaac8cd57ef4d1a0b3b34f61

    SHA1

    4ca459a86233a9ef21073fab51be0bf4ce3619b4

    SHA256

    f0ac334b00a51b96446ce25c8d00b6942dfe5795060bb3b34dda2b257e310723

    SHA512

    0190ed3bc3b4af67297d17d21a2885026cb40693988fbefb05dd83aae4aa42bcb38f6e07b7154d3d90b055dd85a323009c17ba9c7f07ee29db60c60f25545b4a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
    Filesize

    2.7MB

    MD5

    4fe52dbefaac8cd57ef4d1a0b3b34f61

    SHA1

    4ca459a86233a9ef21073fab51be0bf4ce3619b4

    SHA256

    f0ac334b00a51b96446ce25c8d00b6942dfe5795060bb3b34dda2b257e310723

    SHA512

    0190ed3bc3b4af67297d17d21a2885026cb40693988fbefb05dd83aae4aa42bcb38f6e07b7154d3d90b055dd85a323009c17ba9c7f07ee29db60c60f25545b4a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
    Filesize

    2.7MB

    MD5

    4fe52dbefaac8cd57ef4d1a0b3b34f61

    SHA1

    4ca459a86233a9ef21073fab51be0bf4ce3619b4

    SHA256

    f0ac334b00a51b96446ce25c8d00b6942dfe5795060bb3b34dda2b257e310723

    SHA512

    0190ed3bc3b4af67297d17d21a2885026cb40693988fbefb05dd83aae4aa42bcb38f6e07b7154d3d90b055dd85a323009c17ba9c7f07ee29db60c60f25545b4a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
    Filesize

    2.7MB

    MD5

    4fe52dbefaac8cd57ef4d1a0b3b34f61

    SHA1

    4ca459a86233a9ef21073fab51be0bf4ce3619b4

    SHA256

    f0ac334b00a51b96446ce25c8d00b6942dfe5795060bb3b34dda2b257e310723

    SHA512

    0190ed3bc3b4af67297d17d21a2885026cb40693988fbefb05dd83aae4aa42bcb38f6e07b7154d3d90b055dd85a323009c17ba9c7f07ee29db60c60f25545b4a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
    Filesize

    2.7MB

    MD5

    4fe52dbefaac8cd57ef4d1a0b3b34f61

    SHA1

    4ca459a86233a9ef21073fab51be0bf4ce3619b4

    SHA256

    f0ac334b00a51b96446ce25c8d00b6942dfe5795060bb3b34dda2b257e310723

    SHA512

    0190ed3bc3b4af67297d17d21a2885026cb40693988fbefb05dd83aae4aa42bcb38f6e07b7154d3d90b055dd85a323009c17ba9c7f07ee29db60c60f25545b4a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
    Filesize

    647B

    MD5

    6129139303d75800335d6ca037def420

    SHA1

    9c8f9b1b3559396399bb6ac261e600b669acceeb

    SHA256

    cbf711bab0d37a0cbfac30806a8ae7e3a088dae941fc30b2d6ea27c36420336c

    SHA512

    befdd4976ca8618068c66277eb8fcd34e772a1b93f92d6e12248ad516ac69dde444b81552e8eb591ee4ce1bbb213563ea553578c4f92a3b54832b57d1147560a

    Download Submit

  • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
    Filesize

    5.2MB

    MD5

    58e22c0ee91280156cdaadacac7acddb

    SHA1

    189c552c94a9b0ae0208763bca77f2801debc224

    SHA256

    765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714

    SHA512

    9f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6

    Download Submit

  • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
    Filesize

    5.2MB

    MD5

    58e22c0ee91280156cdaadacac7acddb

    SHA1

    189c552c94a9b0ae0208763bca77f2801debc224

    SHA256

    765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714

    SHA512

    9f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
    Filesize

    40B

    MD5

    7485e363314365c83fe9304df43a808b

    SHA1

    8e2576715677a570e0fe7059c334f02ee8b30fd3

    SHA256

    77a1a289640937e8e61ca2ceba6fe19ba017bb726082723c5c865d40c91b8650

    SHA512

    8a8d00ffa47f190fd176b0a05658ac7cacc1c89566f528946fa19ad19784b893b649d99e3365afde529617f96caee214ff9b8ceffbd509737e8bdd6547f8bbef

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
    Filesize

    40B

    MD5

    7485e363314365c83fe9304df43a808b

    SHA1

    8e2576715677a570e0fe7059c334f02ee8b30fd3

    SHA256

    77a1a289640937e8e61ca2ceba6fe19ba017bb726082723c5c865d40c91b8650

    SHA512

    8a8d00ffa47f190fd176b0a05658ac7cacc1c89566f528946fa19ad19784b893b649d99e3365afde529617f96caee214ff9b8ceffbd509737e8bdd6547f8bbef

    Download Submit

  • memory/1516-169-0x0000000000400000-0x0000000000947000-memory.dmp

    Filesize

    5.3MB

    Download

  • memory/1516-165-0x0000000000400000-0x0000000000947000-memory.dmp

    Filesize

    5.3MB

    Download

  • memory/4168-174-0x0000000000400000-0x0000000000947000-memory.dmp

    Filesize

    5.3MB

    Download

  • memory/4304-178-0x0000000000400000-0x0000000000947000-memory.dmp

    Filesize

    5.3MB

    Download

  • memory/4304-179-0x0000000000400000-0x0000000000947000-memory.dmp

    Filesize

    5.3MB

    Download

  • memory/4356-168-0x0000000000DE0000-0x00000000011C8000-memory.dmp

    Filesize

    3.9MB

    Download

  • memory/4356-167-0x0000000000DE0000-0x00000000011C8000-memory.dmp

    Filesize

    3.9MB

    Download

  • memory/4356-151-0x0000000000DE0000-0x00000000011C8000-memory.dmp

    Filesize

    3.9MB

    Download

  • memory/4368-160-0x0000000000400000-0x0000000000947000-memory.dmp

    Filesize

    5.3MB

    Download

  • memory/4436-206-0x0000000003370000-0x0000000004370000-memory.dmp

    Filesize

    16.0MB

    Download

  • memory/4480-161-0x0000000000400000-0x0000000000947000-memory.dmp

    Filesize

    5.3MB

    Download

  • memory/4972-140-0x0000000010000000-0x0000000010051000-memory.dmp

    Filesize

    324KB

    Download

  • memory/4972-137-0x00000000008B0000-0x0000000000C98000-memory.dmp

    Filesize

    3.9MB

    Download

  • memory/4972-182-0x0000000010000000-0x0000000010051000-memory.dmp

    Filesize

    324KB

    Download

  • memory/4972-142-0x00000000008B0000-0x0000000000C98000-memory.dmp

    Filesize

    3.9MB

    Download

  • memory/4972-201-0x00000000008B0000-0x0000000000C98000-memory.dmp

    Filesize

    3.9MB

    Download

  • memory/4972-141-0x0000000006B60000-0x0000000006B63000-memory.dmp

    Filesize

    12KB

    Download