Analysis

  • max time kernel
    96s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-03-2023 20:58

General

  • Target

    TLauncher-2.876-Installer-1.0.7-global.exe

  • Size

    22.6MB

  • MD5

    e89a95bce6075955a4e1acdb6bb56561

  • SHA1

    8b17013cbf2ea69d625d7bcb1e578933c13678fc

  • SHA256

    78d84068b47cf28b76c88ba4474c7c187510f4e4e967d079d3761dcab7851655

  • SHA512

    4ccb33f60c9292e12daa53b49524a36bbe1c1ca86d794b5134b8b954736a532e9f202123b39036c6a9c557e128bd8361e5c1cb86d40723cc00784026741d5e65

  • SSDEEP

    393216:DXkoYB+UAVl/Pfs/dQETVlOBbpFEjdGphRqV56HpkvQFa2Vj4h2cU:D0oYB+3fHHExi73qqHpU2Vj4hE

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 9 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 32 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 22 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3016
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe" "__IRCT:3" "__IRTSS:23645635" "__IRSID:S-1-5-21-144354903-2550862337-1367551827-1000"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2380
      • C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
        "C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2520
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816338 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:1840798" "__IRSID:S-1-5-21-144354903-2550862337-1367551827-1000"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4972
          • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
            "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Enumerates connected drives
            • Modifies system certificate store
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:396
            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=97.0.4719.26 --initial-client-data=0x340,0x344,0x348,0x31c,0x34c,0x6f5833e0,0x6f5833f0,0x6f5833fc
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:4032
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe" --version
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:388
            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=396 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20230322210120" --session-guid=bb52c04d-3a48-488a-a45a-0f1db510bc48 --server-tracking-blob="ZTUzMjNlOTc5MGExOTgyYzg3MDYxMjFmMDA5N2RmMmUxZGI3ZjU3NjMwODkxNGRmMGY5MWI0OTdjYzc5YWY0MDp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTY3OTUxODg4MS4wMzk3IiwidXNlcmFnZW50IjoiU2V0dXAgRmFjdG9yeSA5LjAiLCJ1dG0iOnsiY2FtcGFpZ24iOiJPcGVyYURlc2t0b3AiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJNU1RMIn0sInV1aWQiOiI0YzMyNmJlYy1iODU2LTRmNzktOTU3MS1kMDQxMWY2NmNmODYifQ== " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=E005000000000000
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Enumerates connected drives
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3376
              • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=97.0.4719.26 --initial-client-data=0x34c,0x350,0x354,0x31c,0x358,0x6ea633e0,0x6ea633f0,0x6ea633fc
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:4176
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303222101201\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303222101201\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:3408
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303222101201\assistant\assistant_installer.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303222101201\assistant\assistant_installer.exe" --version
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1804
              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303222101201\assistant\assistant_installer.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303222101201\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=96.0.4693.50 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x2fc,0x8a6c28,0x8a6c38,0x8a6c44
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1700
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ad.tlauncher.org/link/hight-gpu-settings-en
        3⤵
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1836
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe04b746f8,0x7ffe04b74708,0x7ffe04b74718
          4⤵
            PID:808
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1972,4922419093091638977,14328339641295914484,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:3
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:5216
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,4922419093091638977,14328339641295914484,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1988 /prefetch:2
            4⤵
              PID:5200
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1972,4922419093091638977,14328339641295914484,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2968 /prefetch:8
              4⤵
                PID:5280
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,4922419093091638977,14328339641295914484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
                4⤵
                  PID:2776
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,4922419093091638977,14328339641295914484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
                  4⤵
                    PID:2248
                • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
                  "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:5884
                  • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
                    "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
                    4⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:5624
            • C:\Windows\System32\CompPkgSrv.exe
              C:\Windows\System32\CompPkgSrv.exe -Embedding
              1⤵
                PID:5412
              • C:\Windows\System32\GameBarPresenceWriter.exe
                "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
                1⤵
                  PID:5856
                • C:\Windows\system32\OpenWith.exe
                  C:\Windows\system32\OpenWith.exe -Embedding
                  1⤵
                    PID:5976
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
                    1⤵
                      PID:4072

                    Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

                      Filesize

                      1KB

                      MD5

                      9e6d8dc41604f29e642cd0388dedbc39

                      SHA1

                      356865a43d9fe59ffa43408c8656722239df3746

                      SHA256

                      81ba5efa129a1fe50f089166e3bef04a5472f35d87fe32e48ec078557b809537

                      SHA512

                      2e8ee9015b023d1da8c7c00eff12d780c1e640171306f8ebfcf6ac344a3f4553d2b181c5983e4c792b3e226e96eb8236bb9cf43c3c51ed504e27d047ff9d5dc3

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

                      Filesize

                      471B

                      MD5

                      1b6f11b8e1688d0556236b6e84514489

                      SHA1

                      21afec35f52d55af2fedae9ac5f7cfaa7ffd4b1c

                      SHA256

                      fd8dac615c35ecaff2e38650e16f1945d7793a2b77c7d11fee7706abbd0c7db6

                      SHA512

                      7e85280ff8b52988cb9b1c12c7a1d835089afc81ddb6dbc42254de1ed53e06826c9ac2632f65d96de94ef96dcc46e0db976bc02e91cb50aa7aa42b37b28324fa

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

                      Filesize

                      438B

                      MD5

                      e73b7ce4f413b07b20175bf9a96d3952

                      SHA1

                      64b09df11be24e8564ff678c7eb2f8096c6e53e3

                      SHA256

                      ffab9aca844719a1bf74500fdf8b27addd6011dc3b403d363fd045fb5795eca4

                      SHA512

                      1c29461ec61afadf8820f73665b34003cdb0d7e3cffa4018874ede867b327f29be31cab76ea40fda61601951898414dc507b51d2f7c2a34a3cefc95869d412e5

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

                      Filesize

                      434B

                      MD5

                      3075dfa0aee00594c8691a40226c83c0

                      SHA1

                      33a616e6ca16673b0e53e404391d45f89ee07799

                      SHA256

                      c1ae0fdff2ad16f1d6c2fbaaf8118bd04294f2fec3d62a4eee43d9564fc27fd7

                      SHA512

                      2fd2be370acfbb647941957a237d608835361e8648e41ce70119a69a55a2c811eb4b4f25dbc55a3cda63956c85f54ce6d978b0771fadf0609a95b3f3d3c3266f

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                      Filesize

                      152B

                      MD5

                      462f3c1360a4b5e319363930bc4806f6

                      SHA1

                      9ba5e43d833c284b89519423f6b6dab5a859a8d0

                      SHA256

                      fec64069c72a8d223ed89a816501b3950f5e4f5dd88f289a923c5f961d259f85

                      SHA512

                      5584ef75dfb8a1907c071a194fa78f56d10d1555948dffb8afcacaaa2645fd9d842a923437d0e94fad1d1919dcef5b25bf065863405c8d2a28216df27c87a417

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                      Filesize

                      152B

                      MD5

                      d2642245b1e4572ba7d7cd13a0675bb8

                      SHA1

                      96456510884685146d3fa2e19202fd2035d64833

                      SHA256

                      3763676934b31fe2e3078256adb25b01fdf899db6616b6b41dff3062b68e20a1

                      SHA512

                      99e35f5eefc1e654ecfcf0493ccc02475ca679d3527293f35c3adea66879e21575ab037bec77775915ec42ac53e30416c3928bc3c57910ce02f3addd880392e9

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                      Filesize

                      96B

                      MD5

                      3bb2756ea2d2aab2b9f29c97d07ba496

                      SHA1

                      4ac7982b0ddde42a72acebb80289ae7aaab750b4

                      SHA256

                      8978277367d1e3ef75dfddad07b7c5eb618e693af3a8776136a36c9e51531ae6

                      SHA512

                      754432dc9e284e1a167dd660e9d7fbb354e7019dacda5dd22d4747ff7f4ecfbdb62f50d7366462eb5abee7ee692da74822ddb290d48e5b6c18e2eaef972ea287

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57cd14.TMP

                      Filesize

                      48B

                      MD5

                      f67d76ff25f4ca329df862dc4f9ca5a1

                      SHA1

                      160abff18934b544118d3ebc7dfbd7c39babce98

                      SHA256

                      5f71965144b75bc9c5e731ab90eb155b9ffea5583c124931035336dd4f5d3384

                      SHA512

                      d3ec6a00d61b44b74cee549a3672688ef887de88505ee297fdd0def31eae8076722efb33c4878010521584a2088ead853cf923ea7fc1e06179aa067fd5bc5784

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

                      Filesize

                      70KB

                      MD5

                      e5e3377341056643b0494b6842c0b544

                      SHA1

                      d53fd8e256ec9d5cef8ef5387872e544a2df9108

                      SHA256

                      e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

                      SHA512

                      83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

                      Filesize

                      2KB

                      MD5

                      87f2aecb494b6edf58622024a9840557

                      SHA1

                      10770fff9e21f56bdd596d6c4481e4cf9beb1292

                      SHA256

                      f8f0f987077e2d9b281f29fb7ee99c34ebfb1d4cbfa63f2aef9dfcc12976aacd

                      SHA512

                      ba630c3e1457cdd219c82c297a91d3e3b4a41e2d9ebe18b968a37c5dc711247b479d2c1916a9e914a7b03799248ec11441dd8468bf643d7aa10434ef1a0e24c6

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                      Filesize

                      1KB

                      MD5

                      e79e432450442fe738f9d300f3d6d471

                      SHA1

                      e3ab0c5c6e87090d261884866169d115bd712889

                      SHA256

                      ded5bbad63bc08000b0ab29c207bf470b3ce77ca116591b76ff696c400fe2f84

                      SHA512

                      9aa4f40e51c4f29417daa45f8b1c25d7a7816b27af94e0646982ba95eab8ef6a2ec7a86e8fb06b0d63f081227b6456b3b5aa0991122e5381d97bf750263eb615

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                      Filesize

                      4KB

                      MD5

                      265aa214aafb501a6657fa7cdc398510

                      SHA1

                      a5423ab9845bf8e3dbc7d9d44481887ce8251a9b

                      SHA256

                      20a0a3f3be290604ead2296791ef92d98bd1a04ab31192f6234c10b8a0b9a14d

                      SHA512

                      50b020b39204ae8f01cf22ab3fa4be12e97b42d375a75f304e121d1cd038d30c75ed08560d50ec387f9f8d2d173665c436815723e9a0908e34cdecb1795d4c0b

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                      Filesize

                      6KB

                      MD5

                      bc61ea4fb411c3c0d41e0bc556eb5648

                      SHA1

                      41ddf08337795813d61ff09e473970bf0db54889

                      SHA256

                      255524168a30a8a977b04d2e187d0ce1c0cf74f273b55b183662e87745fdf4fd

                      SHA512

                      781d26b3c303e110066e031002e70013e74160abe7742740c7041c34bd3d4cfc5235247e7d0a113da5b873c378213b6637f4243c9d7149bfa4874419d2aa12a0

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                      Filesize

                      24KB

                      MD5

                      130644a5f79b27202a13879460f2c31a

                      SHA1

                      29e213847a017531e849139c7449bce6b39cb2fa

                      SHA256

                      1306a93179e1eaf354d9daa6043ae8ffb37b76a1d1396e7b8df671485582bcd1

                      SHA512

                      fbc8606bf988cf0a6dea28c16d4394c9b1e47f6b68256132b5c85caf1ec7b516c0e3d33034db275adf267d5a84af2854f50bd38a9ed5e86eb392144c63252e01

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT

                      Filesize

                      16B

                      MD5

                      46295cac801e5d4857d09837238a6394

                      SHA1

                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                      SHA256

                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                      SHA512

                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

                      Filesize

                      41B

                      MD5

                      5af87dfd673ba2115e2fcf5cfdb727ab

                      SHA1

                      d5b5bbf396dc291274584ef71f444f420b6056f1

                      SHA256

                      f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                      SHA512

                      de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

                      Filesize

                      264KB

                      MD5

                      f50f89a0a91564d0b8a211f8921aa7de

                      SHA1

                      112403a17dd69d5b9018b8cede023cb3b54eab7d

                      SHA256

                      b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                      SHA512

                      bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                      Filesize

                      9KB

                      MD5

                      3984943dd2a6bcc2595f829041f80822

                      SHA1

                      91c08df7be63f1e6a00a456cdced14035e926f0e

                      SHA256

                      9666b1692c7fbf73c1b30cb1182bd7d50038144bf538944dce87ed51ee2de6d0

                      SHA512

                      a4b917dbf04f3ec365f1c27b0139798d4a87feddafa71e687128f0657d64334258f4ecd69617c59b989fc93982ef5519081ddc2281e95347b83e1273dfcdf3bd

                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe

                      Filesize

                      2.7MB

                      MD5

                      8e0148dbe1a36178b195660afd10021b

                      SHA1

                      3152f0af345dab4a3943f83c708a510937a36224

                      SHA256

                      4a5acb5309f33415f9980a06c54c0bb055cb5ef2342b1ccdd791713a27f181cc

                      SHA512

                      896dec9cbeb05c231503679d54ced2702e553bc6c5b799430623382c34dd30eed7b69e2bb4f2f421a556dc06bae28a746c89277be6dc7e8257845942ad3e94d1

                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe

                      Filesize

                      2.7MB

                      MD5

                      8e0148dbe1a36178b195660afd10021b

                      SHA1

                      3152f0af345dab4a3943f83c708a510937a36224

                      SHA256

                      4a5acb5309f33415f9980a06c54c0bb055cb5ef2342b1ccdd791713a27f181cc

                      SHA512

                      896dec9cbeb05c231503679d54ced2702e553bc6c5b799430623382c34dd30eed7b69e2bb4f2f421a556dc06bae28a746c89277be6dc7e8257845942ad3e94d1

                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303222101201\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe

                      Filesize

                      1.7MB

                      MD5

                      b386cdcb413405daa8219af8e4cbd318

                      SHA1

                      ce275ff8514fef0629c915a6ee7b5ac481b9043d

                      SHA256

                      408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e

                      SHA512

                      91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303222101201\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe

                      Filesize

                      1.7MB

                      MD5

                      b386cdcb413405daa8219af8e4cbd318

                      SHA1

                      ce275ff8514fef0629c915a6ee7b5ac481b9043d

                      SHA256

                      408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e

                      SHA512

                      91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303222101201\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe

                      Filesize

                      1.7MB

                      MD5

                      b386cdcb413405daa8219af8e4cbd318

                      SHA1

                      ce275ff8514fef0629c915a6ee7b5ac481b9043d

                      SHA256

                      408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e

                      SHA512

                      91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303222101201\assistant\assistant_installer.exe

                      Filesize

                      2.1MB

                      MD5

                      2f3d9e21e232b9bfea064d3b2264db06

                      SHA1

                      bafddc657d8d1bb531683b29b0342cc065ee51d2

                      SHA256

                      25528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d

                      SHA512

                      94e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5

                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303222101201\assistant\assistant_installer.exe

                      Filesize

                      2.1MB

                      MD5

                      2f3d9e21e232b9bfea064d3b2264db06

                      SHA1

                      bafddc657d8d1bb531683b29b0342cc065ee51d2

                      SHA256

                      25528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d

                      SHA512

                      94e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5

                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303222101201\assistant\assistant_installer.exe

                      Filesize

                      2.1MB

                      MD5

                      2f3d9e21e232b9bfea064d3b2264db06

                      SHA1

                      bafddc657d8d1bb531683b29b0342cc065ee51d2

                      SHA256

                      25528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d

                      SHA512

                      94e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5

                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303222101201\opera_package

                      Filesize

                      89.4MB

                      MD5

                      3f423ff3f1a233df2d8c2a1ffbaa3d1d

                      SHA1

                      a40b4b806c94aab21c7e43f6b64abdebbca5e3ad

                      SHA256

                      76a58587142192201504e315f45e2ff7c6e849c3954e590756f4984681fdd353

                      SHA512

                      9baa0aef2682bae63630becf86f204b1abb57a3872dde52de122f0c4ecf4253f1b778ca198653c5e08e069184f6c08d6d1f3345d38fb47751239c11e84b7bc58

                    • C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

                      Filesize

                      1.8MB

                      MD5

                      52e46b1adf9cd40428b41755df527bd4

                      SHA1

                      5f0bb9c9c14208851beb5c93d9268c16ab39dc07

                      SHA256

                      a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

                      SHA512

                      813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

                    • C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

                      Filesize

                      1.8MB

                      MD5

                      52e46b1adf9cd40428b41755df527bd4

                      SHA1

                      5f0bb9c9c14208851beb5c93d9268c16ab39dc07

                      SHA256

                      a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

                      SHA512

                      813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

                    • C:\Users\Admin\AppData\Local\Temp\Opera_installer_230322210118981396.dll

                      Filesize

                      4.6MB

                      MD5

                      a6f93e61dde36e7b1f89f4ea3e63beb6

                      SHA1

                      7fa39bf4132419e44f3adafca2d6e08ef4896d79

                      SHA256

                      16284d9592f327ed0160d0034fd9668b919f558ccea6a9976cdee064d3ec4bfe

                      SHA512

                      12a120318c894068bb798347a1bb08865abe69e4b4ad8f683dc8d77941e37494429fe54c8674d28704bb0f76ab5919e6c37c4c3db799865ccf899c6abe470d4e

                    • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2303222101197004032.dll

                      Filesize

                      4.6MB

                      MD5

                      a6f93e61dde36e7b1f89f4ea3e63beb6

                      SHA1

                      7fa39bf4132419e44f3adafca2d6e08ef4896d79

                      SHA256

                      16284d9592f327ed0160d0034fd9668b919f558ccea6a9976cdee064d3ec4bfe

                      SHA512

                      12a120318c894068bb798347a1bb08865abe69e4b4ad8f683dc8d77941e37494429fe54c8674d28704bb0f76ab5919e6c37c4c3db799865ccf899c6abe470d4e

                    • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2303222101197004032.dll

                      Filesize

                      4.6MB

                      MD5

                      a6f93e61dde36e7b1f89f4ea3e63beb6

                      SHA1

                      7fa39bf4132419e44f3adafca2d6e08ef4896d79

                      SHA256

                      16284d9592f327ed0160d0034fd9668b919f558ccea6a9976cdee064d3ec4bfe

                      SHA512

                      12a120318c894068bb798347a1bb08865abe69e4b4ad8f683dc8d77941e37494429fe54c8674d28704bb0f76ab5919e6c37c4c3db799865ccf899c6abe470d4e

                    • C:\Users\Admin\AppData\Local\Temp\Opera_installer_230322210120090388.dll

                      Filesize

                      4.6MB

                      MD5

                      a6f93e61dde36e7b1f89f4ea3e63beb6

                      SHA1

                      7fa39bf4132419e44f3adafca2d6e08ef4896d79

                      SHA256

                      16284d9592f327ed0160d0034fd9668b919f558ccea6a9976cdee064d3ec4bfe

                      SHA512

                      12a120318c894068bb798347a1bb08865abe69e4b4ad8f683dc8d77941e37494429fe54c8674d28704bb0f76ab5919e6c37c4c3db799865ccf899c6abe470d4e

                    • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2303222101206843376.dll

                      Filesize

                      4.6MB

                      MD5

                      a6f93e61dde36e7b1f89f4ea3e63beb6

                      SHA1

                      7fa39bf4132419e44f3adafca2d6e08ef4896d79

                      SHA256

                      16284d9592f327ed0160d0034fd9668b919f558ccea6a9976cdee064d3ec4bfe

                      SHA512

                      12a120318c894068bb798347a1bb08865abe69e4b4ad8f683dc8d77941e37494429fe54c8674d28704bb0f76ab5919e6c37c4c3db799865ccf899c6abe470d4e

                    • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2303222101214034176.dll

                      Filesize

                      4.6MB

                      MD5

                      a6f93e61dde36e7b1f89f4ea3e63beb6

                      SHA1

                      7fa39bf4132419e44f3adafca2d6e08ef4896d79

                      SHA256

                      16284d9592f327ed0160d0034fd9668b919f558ccea6a9976cdee064d3ec4bfe

                      SHA512

                      12a120318c894068bb798347a1bb08865abe69e4b4ad8f683dc8d77941e37494429fe54c8674d28704bb0f76ab5919e6c37c4c3db799865ccf899c6abe470d4e

                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico

                      Filesize

                      116KB

                      MD5

                      e043a9cb014d641a56f50f9d9ac9a1b9

                      SHA1

                      61dc6aed3d0d1f3b8afe3d161410848c565247ed

                      SHA256

                      9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946

                      SHA512

                      4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe

                      Filesize

                      1.8MB

                      MD5

                      52e46b1adf9cd40428b41755df527bd4

                      SHA1

                      5f0bb9c9c14208851beb5c93d9268c16ab39dc07

                      SHA256

                      a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

                      SHA512

                      813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.PNG

                      Filesize

                      339B

                      MD5

                      bbdf2e8c0262e7e606d41ddbe5a3cd12

                      SHA1

                      acbb25f729af14b692ec9c8187a23b1a696f8e47

                      SHA256

                      d7c76896d206d977739556ad2d5811f7cf3117252afcd439a5aa0f2b645f6949

                      SHA512

                      0334fae3682889adbc18594b7917d8c93252a86bc04d08efc6860d5714ba4eb8aabc39c51e532c4aee57a938021540d2f2899781d9cd1de311036e1850a65067

                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG104.PNG

                      Filesize

                      644B

                      MD5

                      38c12e1a54f8fd216ed3f13b36798cc6

                      SHA1

                      ccf1fe585d3374ebce4c1ec025e2d8ec39968a7c

                      SHA256

                      608924ba294590b5b706658d9aaa71b480ad9aa1b6797bbc5cf1632ac6c616b1

                      SHA512

                      0918af63f006d7fa04a3faeeb813e61c060316a126c4742a948a30f5b6ea368c3b8592011319dad3dbf8427dfcc095aa72f7b651d6fc31061f861f070447331b

                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG106.PNG

                      Filesize

                      1KB

                      MD5

                      0f414e91b67121d55587e7c004f35cb2

                      SHA1

                      6d63b4c6fa858f8cfd4b257600037e9c370355a8

                      SHA256

                      015dd2b2df51cd90438286d28b5719cbdf9a2e7bebf326b99c6c091ad98e4cc1

                      SHA512

                      1b7d8bbb97f6acb4984cd93578b5045cd4ce0813645a28d3b778489b646194e68b2a931f26a9c6a7026f98de29719132972eb983d771affdfe42c42622b786e9

                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG108.PNG

                      Filesize

                      2KB

                      MD5

                      03b1d78771eb279766efb2d9f2fa8463

                      SHA1

                      8f10e304fd65e58136ccd6ab012ffc594e6fb707

                      SHA256

                      eec16d2cb57e38b485b6a269e9c2554c1dfc3b70dec9f7bbddc2b62526b3d832

                      SHA512

                      ca51cbaf20e6f62eb6ec69555d259ef61828d3166d09106bcd335dd417ed30660af71e7fd8db6bd22bf134cc530e1a55ecdd2c307e64e8edb28af95299d66f5a

                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG19.PNG

                      Filesize

                      1KB

                      MD5

                      46a65321aa1fce57d465c26e8b6eb392

                      SHA1

                      9efb9a3acd5b32556ea66398c74b014f91087559

                      SHA256

                      61df7a1f0367209668d4f0f6a285b8baff864d1341d382ebbc7fd4e71036b666

                      SHA512

                      094d69016f066ae835c71d7a950217b9ad09e8cd4d74131787203cae950e572c18213dc1ded139b1fa46c7f803cc15bf4f596c9d51aefe0d43850ae2865f3707

                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.PNG

                      Filesize

                      280B

                      MD5

                      5a7901f7df307fba45b1c377f2c94ccc

                      SHA1

                      d6630cf733033cdfbda7af3213d49b32f5b06919

                      SHA256

                      d8471d5a5b4792c4b49e80b5cb22ef1e938dc3069b210646704f658548d7a9f8

                      SHA512

                      fc0036a7ed4b53edd72b91c4824919e6e8a82b5be1e82cdc134e267ef4792424124fb6ba5d7c86cf686910da0baba8453d7a6c12b39a5b4c0cb70658580f3bc9

                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.PNG

                      Filesize

                      281B

                      MD5

                      05d7bba3d6ac92766c4495b8928202a6

                      SHA1

                      50b65a8ba5ed2633e43929ee4bd58c95a91a3363

                      SHA256

                      4804f3c4fae714657fdb85e98244828acc6ac938505c2da1ed694ae7b58f2949

                      SHA512

                      1544d5cd6f85aaeeacd26f2deb9da9eb510226b41079ee78c4dede14386e5ea3446efdfd475bfbfa3a6846fa2ff23d64f4dad3a4ddd304e32de80e4d7bcbc600

                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG45.PNG

                      Filesize

                      438B

                      MD5

                      09229c3bfb801177839a7c2e22e33a1b

                      SHA1

                      f679c05c4c7b2f3722069420c6d6481fc856e7aa

                      SHA256

                      cbf81d779b469942613297a3ca6c09d885e3b1d4aa952dc1994a7175fbfc7e3f

                      SHA512

                      503bfa063b29dda95f15da303f707e5b78a6bdb74662c222d8a8b7e3a33264016a66acdd9de44aea932e7cde80a43c2406ea6f0250d3df8e182217bc4a0a7ed7

                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG85.PNG

                      Filesize

                      43KB

                      MD5

                      667b0b54ee5ba0d1cb66190226596e46

                      SHA1

                      b8658b35e7cf44b24053e4d01d3b51233d6526f6

                      SHA256

                      3a9ab8c3640f1b40b33553d7d3dd3d15bd6e702ef510ec0b66a2f14aa744bf83

                      SHA512

                      9ccc773214a0074634be66801d81d7a593ab154351fdbd1b93f56ffa80cf824ee31ff2e13f26536d5f3096e90df43fa223080b4dc55340614b076c08ef976dcb

                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG86.PNG

                      Filesize

                      1KB

                      MD5

                      5bc85d12eb492baa3be9230f1fbdc342

                      SHA1

                      456fe4284fa916ad3817e7c3d419c13f4c949737

                      SHA256

                      9a27f240758513aa1cc05500171fe22fdb3a485781cba4798cefc29f6944373c

                      SHA512

                      3d55c597ac29d7f810980dfd89404d3ecbd2e652ae1bc5e6710668ad5386a0caecf3149289df13f6dabed6b2e4305a26684ab3bd21b255b37f8a596fe8d641b9

                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

                      Filesize

                      1.7MB

                      MD5

                      1bbf5dd0b6ca80e4c7c77495c3f33083

                      SHA1

                      e0520037e60eb641ec04d1e814394c9da0a6a862

                      SHA256

                      bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

                      SHA512

                      97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

                      Filesize

                      1.7MB

                      MD5

                      1bbf5dd0b6ca80e4c7c77495c3f33083

                      SHA1

                      e0520037e60eb641ec04d1e814394c9da0a6a862

                      SHA256

                      bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

                      SHA512

                      97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

                      Filesize

                      97KB

                      MD5

                      da1d0cd400e0b6ad6415fd4d90f69666

                      SHA1

                      de9083d2902906cacf57259cf581b1466400b799

                      SHA256

                      7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

                      SHA512

                      f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

                      Filesize

                      97KB

                      MD5

                      da1d0cd400e0b6ad6415fd4d90f69666

                      SHA1

                      de9083d2902906cacf57259cf581b1466400b799

                      SHA256

                      7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

                      SHA512

                      f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

                      Filesize

                      1.3MB

                      MD5

                      111dddf2f308abc2a8f7555d5f642751

                      SHA1

                      11e6cdccbf29a71a97011b9444cf20c83ad8b57b

                      SHA256

                      c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

                      SHA512

                      11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

                      Filesize

                      1.3MB

                      MD5

                      111dddf2f308abc2a8f7555d5f642751

                      SHA1

                      11e6cdccbf29a71a97011b9444cf20c83ad8b57b

                      SHA256

                      c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

                      SHA512

                      11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

                      Filesize

                      1.3MB

                      MD5

                      111dddf2f308abc2a8f7555d5f642751

                      SHA1

                      11e6cdccbf29a71a97011b9444cf20c83ad8b57b

                      SHA256

                      c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

                      SHA512

                      11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

                      Filesize

                      326KB

                      MD5

                      80d93d38badecdd2b134fe4699721223

                      SHA1

                      e829e58091bae93bc64e0c6f9f0bac999cfda23d

                      SHA256

                      c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                      SHA512

                      9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

                      Filesize

                      326KB

                      MD5

                      80d93d38badecdd2b134fe4699721223

                      SHA1

                      e829e58091bae93bc64e0c6f9f0bac999cfda23d

                      SHA256

                      c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                      SHA512

                      9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat

                      Filesize

                      108KB

                      MD5

                      aec508468d53ab8d55f5b4beb82c347d

                      SHA1

                      477d1ffb28834243f5811a4a2a54b4f0ca240120

                      SHA256

                      ebee84e34e221ad822486432333bad9e6357af2fb0d9651cc61c7fab8ec9b5bf

                      SHA512

                      26a0278af2a9e75ef966bc3f7f40d7669204c2004a043adaad102ef440caa6282e69372ca0c3c7d39a8450691d528c2dc77a4386bfb0c6e5a2a76c3fef900fbe

                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

                      Filesize

                      1.3MB

                      MD5

                      5027f3112ac2d6f764769102a9145c8e

                      SHA1

                      a369a0e1d4ace1a8d66908aa43543bea03c76f5b

                      SHA256

                      d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

                      SHA512

                      181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

                      Filesize

                      1.3MB

                      MD5

                      5027f3112ac2d6f764769102a9145c8e

                      SHA1

                      a369a0e1d4ace1a8d66908aa43543bea03c76f5b

                      SHA256

                      d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

                      SHA512

                      181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

                      Filesize

                      1.3MB

                      MD5

                      5027f3112ac2d6f764769102a9145c8e

                      SHA1

                      a369a0e1d4ace1a8d66908aa43543bea03c76f5b

                      SHA256

                      d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

                      SHA512

                      181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

                      Filesize

                      326KB

                      MD5

                      80d93d38badecdd2b134fe4699721223

                      SHA1

                      e829e58091bae93bc64e0c6f9f0bac999cfda23d

                      SHA256

                      c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                      SHA512

                      9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

                      Filesize

                      326KB

                      MD5

                      80d93d38badecdd2b134fe4699721223

                      SHA1

                      e829e58091bae93bc64e0c6f9f0bac999cfda23d

                      SHA256

                      c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                      SHA512

                      9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                    • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

                      Filesize

                      2.7MB

                      MD5

                      8e0148dbe1a36178b195660afd10021b

                      SHA1

                      3152f0af345dab4a3943f83c708a510937a36224

                      SHA256

                      4a5acb5309f33415f9980a06c54c0bb055cb5ef2342b1ccdd791713a27f181cc

                      SHA512

                      896dec9cbeb05c231503679d54ced2702e553bc6c5b799430623382c34dd30eed7b69e2bb4f2f421a556dc06bae28a746c89277be6dc7e8257845942ad3e94d1

                    • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

                      Filesize

                      2.7MB

                      MD5

                      8e0148dbe1a36178b195660afd10021b

                      SHA1

                      3152f0af345dab4a3943f83c708a510937a36224

                      SHA256

                      4a5acb5309f33415f9980a06c54c0bb055cb5ef2342b1ccdd791713a27f181cc

                      SHA512

                      896dec9cbeb05c231503679d54ced2702e553bc6c5b799430623382c34dd30eed7b69e2bb4f2f421a556dc06bae28a746c89277be6dc7e8257845942ad3e94d1

                    • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

                      Filesize

                      2.7MB

                      MD5

                      8e0148dbe1a36178b195660afd10021b

                      SHA1

                      3152f0af345dab4a3943f83c708a510937a36224

                      SHA256

                      4a5acb5309f33415f9980a06c54c0bb055cb5ef2342b1ccdd791713a27f181cc

                      SHA512

                      896dec9cbeb05c231503679d54ced2702e553bc6c5b799430623382c34dd30eed7b69e2bb4f2f421a556dc06bae28a746c89277be6dc7e8257845942ad3e94d1

                    • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

                      Filesize

                      2.7MB

                      MD5

                      8e0148dbe1a36178b195660afd10021b

                      SHA1

                      3152f0af345dab4a3943f83c708a510937a36224

                      SHA256

                      4a5acb5309f33415f9980a06c54c0bb055cb5ef2342b1ccdd791713a27f181cc

                      SHA512

                      896dec9cbeb05c231503679d54ced2702e553bc6c5b799430623382c34dd30eed7b69e2bb4f2f421a556dc06bae28a746c89277be6dc7e8257845942ad3e94d1

                    • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

                      Filesize

                      2.7MB

                      MD5

                      8e0148dbe1a36178b195660afd10021b

                      SHA1

                      3152f0af345dab4a3943f83c708a510937a36224

                      SHA256

                      4a5acb5309f33415f9980a06c54c0bb055cb5ef2342b1ccdd791713a27f181cc

                      SHA512

                      896dec9cbeb05c231503679d54ced2702e553bc6c5b799430623382c34dd30eed7b69e2bb4f2f421a556dc06bae28a746c89277be6dc7e8257845942ad3e94d1

                    • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

                      Filesize

                      2.7MB

                      MD5

                      8e0148dbe1a36178b195660afd10021b

                      SHA1

                      3152f0af345dab4a3943f83c708a510937a36224

                      SHA256

                      4a5acb5309f33415f9980a06c54c0bb055cb5ef2342b1ccdd791713a27f181cc

                      SHA512

                      896dec9cbeb05c231503679d54ced2702e553bc6c5b799430623382c34dd30eed7b69e2bb4f2f421a556dc06bae28a746c89277be6dc7e8257845942ad3e94d1

                    • C:\Users\Admin\AppData\Local\Temp\setuparguments.ini

                      Filesize

                      647B

                      MD5

                      9b72ce376fcdcfffc8a26762b215008a

                      SHA1

                      1f79be618404180c1ef3ccb2d812761fccbdf2c8

                      SHA256

                      54b6794eee2db6effb9527687eb3604035cd89e507d0d24a4cbb7c99b0de9926

                      SHA512

                      86d6d6248f2a936bdd9b715084ab96624d6585562b5ba5f08ea6fcb9d14114de0345371ef749cf66c7545fb51c6fd76b0628dadc2dc1d3ea899077959f9ba668

                    • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

                      Filesize

                      6.3MB

                      MD5

                      f08d9bbc61cff8e8c3504524c3220bef

                      SHA1

                      b4268c667469620bb528c04eaa819d508159b398

                      SHA256

                      2c4d8b48344ae221e349e525ac16eb364ffb5ab8deae80c7caa28dd5967cabdb

                      SHA512

                      a64a03d959487399fb57e1bd062c0e9f88a17ff9b3ad15e6b96a4b7332341d0fc9186ef99b2ab9bdcfa51864f21d08bce48479202c01d15470916e90fb09fef4

                    • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

                      Filesize

                      6.3MB

                      MD5

                      f08d9bbc61cff8e8c3504524c3220bef

                      SHA1

                      b4268c667469620bb528c04eaa819d508159b398

                      SHA256

                      2c4d8b48344ae221e349e525ac16eb364ffb5ab8deae80c7caa28dd5967cabdb

                      SHA512

                      a64a03d959487399fb57e1bd062c0e9f88a17ff9b3ad15e6b96a4b7332341d0fc9186ef99b2ab9bdcfa51864f21d08bce48479202c01d15470916e90fb09fef4

                    • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

                      Filesize

                      6.3MB

                      MD5

                      f08d9bbc61cff8e8c3504524c3220bef

                      SHA1

                      b4268c667469620bb528c04eaa819d508159b398

                      SHA256

                      2c4d8b48344ae221e349e525ac16eb364ffb5ab8deae80c7caa28dd5967cabdb

                      SHA512

                      a64a03d959487399fb57e1bd062c0e9f88a17ff9b3ad15e6b96a4b7332341d0fc9186ef99b2ab9bdcfa51864f21d08bce48479202c01d15470916e90fb09fef4

                    • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\aopalliance\aopalliance\1.0\aopalliance-1.0.jar

                      Filesize

                      4KB

                      MD5

                      04177054e180d09e3998808efa0401c7

                      SHA1

                      0235ba8b489512805ac13a8f9ea77a1ca5ebe3e8

                      SHA256

                      0addec670fedcd3f113c5c8091d783280d23f75e3acb841b61a9cdb079376a08

                      SHA512

                      3f44a932d8c00cfeee2eb057bcd7c301a2d029063e0a916e1e20b3aec4877d19d67a2fd8aaf58fa2d5a00133d1602128a7f50912ffb6cabc7b0fdc7fbda3f8a1

                    • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\com\github\junrar\junrar\0.7\junrar-0.7.jar

                      Filesize

                      151KB

                      MD5

                      75a215b9e921044cd2c88e73f6cb9745

                      SHA1

                      18cc717b85af0b12ba922abf415c2ff4716f8219

                      SHA256

                      7c764fa1af319b98ff452189ab31bb722ea74ed7a52b17b0c6282249c10a61fc

                      SHA512

                      1a44af2f3f8dbfbf38ad5f71ef11b32d5822d734f77af2cdea419fb6af845e894acb60bffbcebb4533068d86b55a22a8b0f74be20b204c2343bdb165d9c787f9

                    • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\com\google\guava\guava\19.0\guava-19.0.jar

                      Filesize

                      2.2MB

                      MD5

                      43bfc49bdc7324f6daaa60c1ee9f3972

                      SHA1

                      6ce200f6b23222af3d8abb6b6459e6c44f4bb0e9

                      SHA256

                      58d4cc2e05ebb012bbac568b032f75623be1cb6fb096f3c60c72a86f7f057de4

                      SHA512

                      834f2bf4a5b35edffde0263409649aeaf34ca9a742ba511a06bb9b01626f9e774d2d3c8ba91a7905929dc8cd5e6471de29f7d0ab10260ece2af709b7fdbe4bc3

                    • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\com\google\inject\extentions\guice-assistedinject\4.1.0\guice-assistedinject-4.1.0.jar

                      Filesize

                      41KB

                      MD5

                      65912196b6e91f2ceb933001c1fb5c94

                      SHA1

                      af799dd7e23e6fe8c988da12314582072b07edcb

                      SHA256

                      663728123fb9a6b79ea39ae289e5d56b4113e1b8e9413eb792f91e53a6dd5868

                      SHA512

                      60b15182130ddfd801dd0438058d641dd5ba9122f2d1e081eb63f5e2c12fff0271d9d47c58925be0be8267ed22ae893ea9d1b251faba17dc1d2552b5d93056de

                    • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\com\google\inject\guice\4.1.0\guice-4.1.0.jar

                      Filesize

                      658KB

                      MD5

                      41f66d1d4d250efebde3bbf8b2d55dfa

                      SHA1

                      eeb69005da379a10071aa4948c48d89250febb07

                      SHA256

                      9b9df27a5b8c7864112b4137fd92b36c3f1395bfe57be42fedf2f520ead1a93e

                      SHA512

                      109a1595668293b32376e885ad59e0e4c0e088ea00f58119f0f7d0d2055f03eb93a9f92d974b6dbd56ef721792ac03c889d9add3a2850aa7ccd732c2682d17ef

                    • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\dnsjava\dnsjava\2.1.8\dnsjava-2.1.8.jar

                      Filesize

                      307KB

                      MD5

                      540f330717bca9d29c8762cf6daca443

                      SHA1

                      eed8a2cbf56cc60d07a189a429ead3067564193c

                      SHA256

                      52de1ff2a7556ac2cc4284abd7123bc3d6274210fc4e3b1d9ba90efad5f6a153

                      SHA512

                      a4bcb8bbb43906f42faf1802c504ccc9c616e49afd5dd7db77676d13aaed79a300979ffc2195b680a9c6d5f03466b611b6f1338d824099816aa224b234760f4b

                    • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\javax\inject\javax.inject\1\javax.inject-1.jar

                      Filesize

                      2KB

                      MD5

                      289075e48b909e9e74e6c915b3631d2e

                      SHA1

                      6975da39a7040257bd51d21a231b76c915872d38

                      SHA256

                      91c77044a50c481636c32d916fd89c9118a72195390452c81065080f957de7ff

                      SHA512

                      e126b7ccf3e42fd1984a0beef1004a7269a337c202e59e04e8e2af714280d2f2d8d2ba5e6f59481b8dcd34aaf35c966a688d0b48ec7e96f102c274dc0d3b381e

                    • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\log4j\log4j\1.2.17\log4j-1.2.17.jar

                      Filesize

                      478KB

                      MD5

                      04a41f0a068986f0f73485cf507c0f40

                      SHA1

                      5af35056b4d257e4b64b9e8069c0746e8b08629f

                      SHA256

                      1d31696445697720527091754369082a6651bd49781b6005deb94e56753406f9

                      SHA512

                      3f12937a69ba60d0f5e86265168d6a0d069ce20d95b99a3ace463987655e7c63053f4d7e36e32f2b53f86992b888ca477bf81253ad04c721896b397f94ee57fc

                    • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\net\sf\jopt-simple\jopt-simple\4.9\jopt-simple-4.9.jar

                      Filesize

                      64KB

                      MD5

                      39c6476e4de3d4f90ad4ca0ddca48ec2

                      SHA1

                      ee9e9eaa0a35360dcfeac129ff4923215fd65904

                      SHA256

                      26c5856e954b5f864db76f13b86919b59c6eecf9fd930b96baa8884626baf2f5

                      SHA512

                      fd04c19bce810a1548b2d2eaadb915cff2cbc81a81ec5258aafc1ba329100daedc49edad1fc7b254ab892996796124283d7004b5414f662c0efa3979add9ca5f

                    • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\apache\commons\commons-lang3\3.4\commons-lang3-3.4.jar

                      Filesize

                      424KB

                      MD5

                      8667a442ee77e509fbe8176b94726eb2

                      SHA1

                      5fe28b9518e58819180a43a850fbc0dd24b7c050

                      SHA256

                      734c8356420cc8e30c795d64fd1fcd5d44ea9d90342a2cc3262c5158fbc6d98b

                      SHA512

                      b1b556692341a240f8b81f8f71b8b5c0225ccf857ce1b185e7fe6d7a9bb2a4d77823496cd6e2697a20386e7f3ba02d476a0e4ff38071367beb3090104544922d

                    • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\apache\httpcomponents\fluent-hc\4.5.13\fluent-hc-4.5.13.jar

                      Filesize

                      30KB

                      MD5

                      8f7e4f1a95a870ebee87ddacc425362c

                      SHA1

                      300bf1846737e34b9ea10faae257ca8fdcd0616f

                      SHA256

                      f883b6b027d5e05c53e48e4fe3548715c52dbd590ffa3f52d039574f1a4d0728

                      SHA512

                      98e30ed27d6ac078450efe5e236117445c93e05eb280399e056816c52643a3a33adce5e3a885ce8488186f38d05e0fb6c65dfcbaa509be8c6047ef2f0870d9b0

                    • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\apache\logging\log4j\log4j-core\2.14.1\log4j-core-2.14.1.jar

                      Filesize

                      1.7MB

                      MD5

                      948dda787593340a7af1a18e328b7b7f

                      SHA1

                      9141212b8507ab50a45525b545b39d224614528b

                      SHA256

                      ade7402a70667a727635d5c4c29495f4ff96f061f12539763f6f123973b465b0

                      SHA512

                      6e41ff42f12deedb8da06cbed73d0a9a5389660b7ee058436f8fcb6b14a6ab3105faf8e3f2c007d38ccc85af1e704505b84be5a80d8e68a434aae82b54b85f70

                    • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\tlauncher\picture-bundle\3.7\picture-bundle-3.7.jar

                      Filesize

                      2.1MB

                      MD5

                      904094a40b7d81b12936f43b49952922

                      SHA1

                      5ccf048dd51a7d0cdd59a1ea6ce2e3b167feacf3

                      SHA256

                      0cd5746118a3a38b7e6126770bc53c0f7c4641fab786e3d6004a4caace4fc536

                      SHA512

                      36e2bc67d73319b8f10a572ee3ca6f541aa51ca16c1efea9430111f3a058c9c922a43865b064811117f1c3892e39aee3bc79d7fc5ce20ccd75a13d447ca68911

                    • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\tlauncher\skin-server-API\1.0\skin-server-API-1.0.jar

                      Filesize

                      14KB

                      MD5

                      13a8e72587ac6eacfb0986f75e51eb7c

                      SHA1

                      6c3daf89705427f73e6106d2d4d9619e99c5ecb5

                      SHA256

                      1fcffa073f722737431e2699b1f3ea48b92a3b825397d8f0d1464e4d4d15a014

                      SHA512

                      134735390415f60d0c42ff33a060bda508e273b35fc9aab271c20ff23f331b51cf3fa36443009e0987049f6bfb22c4098a1473e65ea0349e719fbf4b528f344e

                    • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\tlauncher\tlauncher-resource\1.4\tlauncher-resource-1.4.jar

                      Filesize

                      3.2MB

                      MD5

                      acbc8aa5ba5cdddf5f1e67befe8cc597

                      SHA1

                      63b4bf89744b532e65c1afa3294743d2b3798f2b

                      SHA256

                      1f46b3a163012f9729905633b5e5e03ce385066ae43138a564729c942f9ca6b9

                      SHA512

                      d974a032d9af451c0dd51fbc0d64840f3e03eb502f40e4ab60d6722913b8a48d44a75752fcff60656e4d19089570a894222959745af11bcdf93ea1544192fee3

                    • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\tukaani\xz\1.5\xz-1.5.jar

                      Filesize

                      97KB

                      MD5

                      51050e595b308c4aec8ac314f66e18bc

                      SHA1

                      9c64274b7dbb65288237216e3fae7877fd3f2bee

                      SHA256

                      86f30fa8775fa3a62cdb39d1ed78a6019164c1058864048d42cbee244e26e840

                      SHA512

                      c5c130bf22f24f61b57fc0c6243e7f961ca2a8928416e8bb288aec6650c1c1c06ace4383913cd1277fc6785beb9a74458807ea7e3d6b2e09189cfaf2fb9ab7e1

                    • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.BMP

                      Filesize

                      451KB

                      MD5

                      0b445ace8798426e7185f52b7b7b6d1e

                      SHA1

                      7a77b46e0848cc9b32283ccb3f91a18c0934c079

                      SHA256

                      2bbf97ccba3f87d469eac909c4ce8a3f13ed29c8f31b611e7d5cf89a0619eda6

                      SHA512

                      51523d5b711481293305465a3a3c6a3a50dca984cdc8cca1f4c44f3c21bfa430cd9aac1a8782d9605e6954cbafb307beb6b1a52e9785de1bc3f71067d80c6b6e

                    • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG23.PNG

                      Filesize

                      1KB

                      MD5

                      fa8aa84ef4bf0de505f6e3447d4b55b3

                      SHA1

                      b99654dfa5f6c56857b4f4102af2d27503bcdc74

                      SHA256

                      f3b7e85e8e5e41496fb563816fbf79e6640feb1591bd5e0c0b876d80053ad913

                      SHA512

                      b3a7d0d5abe554301b8745bd738662d80e439fba8df6f984cc05151ec8c081a61f0538765653e8587b431cdc97d384ee35d17ab3324c06a2ca40a069e1525ba6

                    • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNG

                      Filesize

                      45KB

                      MD5

                      2799f9daca46770a871ce1b5eed32e7c

                      SHA1

                      a2792f571210a7f38cdbe49391017300ee7b1ce4

                      SHA256

                      fc22676f5b6cdae17b78ddfd16bb070687516fbc827a7edd0541f3a32d85c9e9

                      SHA512

                      c41f2e4c4ca59d6f9d11fac11296ab87f1b508b5d64e5db7762f2f6dd387aa96206b2b0fa127f17c0b8c24a0b56e81af12d5937474a450222d9c4416c1acb16a

                    • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG41.PNG

                      Filesize

                      457B

                      MD5

                      ce17d7ce06488f394ce124f17d5acafc

                      SHA1

                      8a5dceae9ea369b686123c8f940bb0ea07870ffa

                      SHA256

                      c4b04568930f03979d71f48a57b9ad06b4cdf687272f6753ff662006e8e6237f

                      SHA512

                      c33f1370213cabd1b84c936f1ac14f9bcc83bc03a633bbe25efe1e906bcee515d0e615c86b7ee3b34404dd1d95ce74d1a00908de8cdacbf9961de3f1ceb8362b

                    • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG42.PNG

                      Filesize

                      352B

                      MD5

                      1f5c8939031a7f93762862cfc88a8e56

                      SHA1

                      6dc4df87344db0ddf09c777e7a80d1b5661559b8

                      SHA256

                      14be26e969eb15ef7e76e0ad02d8aa0516c5391e8b09dba0a9a6c5f57ae24aba

                      SHA512

                      de45d700c86329c704777917863fd1ddeca90d2bed67a72794164882bf15725ce83c7733f664ee0a2af7df54a6be2def729d19237fb2c434115396ac126ff47f

                    • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG46.PNG

                      Filesize

                      206B

                      MD5

                      d8a095202e08fa1ac2578982e9a486db

                      SHA1

                      397ffc8af43ac18466b8df245b4faa6b278659e6

                      SHA256

                      28fed2b9a3cbde34da4b6b5d1af2d2844437d21f6dec85b3ca2faa5cd3b512e5

                      SHA512

                      ac751386a0004e335f4e5f4ea24bf6a474478c8a7ca54d018734e7cd44b8e9a0eb262b00fe1219b1c62c96b018b08ba6b1056d3a13e64b55c7e70d748a6ae9c6

                    • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG48.PNG

                      Filesize

                      1KB

                      MD5

                      59d6f22fdc11d6b116b38193ed5f4b97

                      SHA1

                      cddc7eb2110b3179dd6d1e32b4b37f3568a22ebf

                      SHA256

                      782cafea76d24d76885d88ee1302e5f78d75a4e335529dc20ad476fdb9e34744

                      SHA512

                      5b0fab5139736d30a69c98ea88d95a5c70f59aab1b82394c58b33617b824447b861a6e6067b62dd1ca1812a4989937e06ad473c6c94376af957871e9e63553fa

                    • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG5.PNG

                      Filesize

                      1KB

                      MD5

                      3094925a8de871bcc72ae50882d2a6f7

                      SHA1

                      9f7894bc4b2a498ad20b14b2b3cac175bf4d7a9f

                      SHA256

                      523e7230db0c47a436abbc442db93e41b6f549b32da6c2a10db7a18228491216

                      SHA512

                      bf2349354321397652d834507aae4c32885273209d1409b796170292e37ebf35878e2934d3f53545e66724561e646cc660f952e0bb5006cd7a262a790b64e39e

                    • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG66.PNG

                      Filesize

                      41KB

                      MD5

                      1557c08e187b7783083e0b80051fd321

                      SHA1

                      2c6ee47799d713e88fd589609b81912a4522044e

                      SHA256

                      0c0e74dd07c45833a5dd7ba931e5d528eb16334defdd06171df2f632d6e47842

                      SHA512

                      485f69b3878b2bd7fdf52ad020dde2cbc34dd1970aaa4e5eb8f8618f6091b5b827b428447859499c3d61ea9cde2edcbb97c8fb0560cd0aaff50027c0f97ee6f3

                    • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG67.PNG

                      Filesize

                      1KB

                      MD5

                      5eecdc666e6dc0b8e5e8d2fc3b9cc1b2

                      SHA1

                      72a16d461bd2410d5749c6bf939a127683d83a95

                      SHA256

                      052f0289886f9cc0931d7026dfe1f5253ad39123479627e37afa5c430e8f8ff1

                      SHA512

                      5d465d2c61d97ec2a52db3aeee8d42ececdef08930692842f9c6a41b0611cb774015d369e4fe5186079e97839acc78e8403ea6a6c33ee54a7aef3eea41c3d7db

                    • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

                      Filesize

                      33KB

                      MD5

                      bc5f5268d3f4a75df5329fea1e426282

                      SHA1

                      5d236a183cbf688629878f2b3d3c466742440d64

                      SHA256

                      e8936666ebf2bff0e35b5d877581faad1cbf67c07c46ff6ab4b8f041909f766c

                      SHA512

                      51a1135425ac4642a82428d6f0468a2c97eb0422f7a11d2307c548a6d67fbdf583116d38868951645ff82aa6024cc166ed2492211db55ef683bf032241589f38

                    • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

                      Filesize

                      6KB

                      MD5

                      2c4cda8192b43d5bd69056ae5d1d758e

                      SHA1

                      6e3d2f0043f4afa99cdf7dc441d33bc90deb6110

                      SHA256

                      17892b14a8b323ebb8499578b92d8ac0dd3c5f41f08da197e81bdcdef4461184

                      SHA512

                      0204244228a5ba22529933d4aa130c4b23e6c2b1b99a6506b288aa70245bfe16d19a8a5f9456469374ebe36a2717486c4655abba386949d83c1cd99faa174c5b

                    • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

                      Filesize

                      40B

                      MD5

                      bf21282b9ab7bc664f2adac08b7cb7b2

                      SHA1

                      d9b85ccfa1c63826a4b6452879c4df20ebcfa4d6

                      SHA256

                      ed279a4d8b262c8d55b1fca7a8797782efbb413c7ed77d14cfa6a116beb071a5

                      SHA512

                      93b7fe28a29d3c79c5f58412c0a2c280896255e8213d978396da7439cd7b2c288595fa7f1c281ad62936b0d7773db063d5b13d8c5fd491bd89eac35c6c0c1a57

                    • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

                      Filesize

                      40B

                      MD5

                      bf21282b9ab7bc664f2adac08b7cb7b2

                      SHA1

                      d9b85ccfa1c63826a4b6452879c4df20ebcfa4d6

                      SHA256

                      ed279a4d8b262c8d55b1fca7a8797782efbb413c7ed77d14cfa6a116beb071a5

                      SHA512

                      93b7fe28a29d3c79c5f58412c0a2c280896255e8213d978396da7439cd7b2c288595fa7f1c281ad62936b0d7773db063d5b13d8c5fd491bd89eac35c6c0c1a57

                    • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

                      Filesize

                      40B

                      MD5

                      bf21282b9ab7bc664f2adac08b7cb7b2

                      SHA1

                      d9b85ccfa1c63826a4b6452879c4df20ebcfa4d6

                      SHA256

                      ed279a4d8b262c8d55b1fca7a8797782efbb413c7ed77d14cfa6a116beb071a5

                      SHA512

                      93b7fe28a29d3c79c5f58412c0a2c280896255e8213d978396da7439cd7b2c288595fa7f1c281ad62936b0d7773db063d5b13d8c5fd491bd89eac35c6c0c1a57

                    • \??\pipe\LOCAL\crashpad_1836_EDUSTHGXJZLKYBZI

                      MD5

                      d41d8cd98f00b204e9800998ecf8427e

                      SHA1

                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                      SHA256

                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                      SHA512

                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    • memory/388-566-0x0000000000FC0000-0x00000000014F8000-memory.dmp

                      Filesize

                      5.2MB

                    • memory/388-567-0x0000000000FC0000-0x00000000014F8000-memory.dmp

                      Filesize

                      5.2MB

                    • memory/396-543-0x0000000000750000-0x0000000000C88000-memory.dmp

                      Filesize

                      5.2MB

                    • memory/396-598-0x0000000000750000-0x0000000000C88000-memory.dmp

                      Filesize

                      5.2MB

                    • memory/2380-479-0x0000000010000000-0x0000000010051000-memory.dmp

                      Filesize

                      324KB

                    • memory/2380-147-0x0000000000310000-0x00000000006F8000-memory.dmp

                      Filesize

                      3.9MB

                    • memory/2380-830-0x0000000000310000-0x00000000006F8000-memory.dmp

                      Filesize

                      3.9MB

                    • memory/2380-2209-0x0000000000310000-0x00000000006F8000-memory.dmp

                      Filesize

                      3.9MB

                    • memory/2380-596-0x0000000010000000-0x0000000010051000-memory.dmp

                      Filesize

                      324KB

                    • memory/2380-1659-0x0000000000310000-0x00000000006F8000-memory.dmp

                      Filesize

                      3.9MB

                    • memory/2380-595-0x0000000000310000-0x00000000006F8000-memory.dmp

                      Filesize

                      3.9MB

                    • memory/2380-478-0x0000000000310000-0x00000000006F8000-memory.dmp

                      Filesize

                      3.9MB

                    • memory/2380-1906-0x0000000010000000-0x0000000010051000-memory.dmp

                      Filesize

                      324KB

                    • memory/2380-1905-0x0000000000310000-0x00000000006F8000-memory.dmp

                      Filesize

                      3.9MB

                    • memory/2380-440-0x0000000010000000-0x0000000010051000-memory.dmp

                      Filesize

                      324KB

                    • memory/2380-441-0x0000000005660000-0x0000000005663000-memory.dmp

                      Filesize

                      12KB

                    • memory/3376-586-0x0000000000750000-0x0000000000C88000-memory.dmp

                      Filesize

                      5.2MB

                    • memory/4032-561-0x0000000000750000-0x0000000000C88000-memory.dmp

                      Filesize

                      5.2MB

                    • memory/4176-594-0x0000000000750000-0x0000000000C88000-memory.dmp

                      Filesize

                      5.2MB

                    • memory/4972-528-0x0000000000F40000-0x0000000001328000-memory.dmp

                      Filesize

                      3.9MB

                    • memory/4972-1909-0x0000000000F40000-0x0000000001328000-memory.dmp

                      Filesize

                      3.9MB

                    • memory/4972-597-0x0000000000F40000-0x0000000001328000-memory.dmp

                      Filesize

                      3.9MB

                    • memory/4972-626-0x0000000000F40000-0x0000000001328000-memory.dmp

                      Filesize

                      3.9MB

                    • memory/5624-2255-0x0000000002320000-0x0000000002321000-memory.dmp

                      Filesize

                      4KB

                    • memory/5624-2232-0x0000000002320000-0x0000000002321000-memory.dmp

                      Filesize

                      4KB

                    • memory/5624-2225-0x0000000002320000-0x0000000002321000-memory.dmp

                      Filesize

                      4KB

                    • memory/5624-2282-0x0000000002320000-0x0000000002321000-memory.dmp

                      Filesize

                      4KB

                    • memory/5884-2206-0x0000000000400000-0x0000000000417000-memory.dmp

                      Filesize

                      92KB