bazarbackdoor | hxxps://tlauncher[.]org/en/

Analysis

max time kernel
166s
max time network
567s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
06-04-2023 18:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://tlauncher.org/en/

Score

10^/10

bazarbackdoor backdoor discovery upx

Malware Config

Signatures

BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
backdoor bazarbackdoor

Bazar/Team9 Backdoor payload 1 IoCs

Processes:

resource	yara_rule
C:\Windows\Installer\709e82.msi	BazarBackdoorVar3

Downloads MZ/PE file
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2484 icacls.exe

pid	process
2484	icacls.exe

UPX packed file 44 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
behavioral1/memory/2984-1032-0x0000000001230000-0x0000000001618000-memory.dmp	upx
behavioral1/memory/2984-1318-0x0000000001230000-0x0000000001618000-memory.dmp	upx
behavioral1/memory/2984-1352-0x0000000001230000-0x0000000001618000-memory.dmp	upx
behavioral1/memory/2984-1359-0x0000000001230000-0x0000000001618000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
behavioral1/memory/3012-1465-0x0000000000D40000-0x0000000001128000-memory.dmp	upx
behavioral1/memory/2984-1482-0x0000000001230000-0x0000000001618000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
behavioral1/memory/3436-2336-0x00000000013D0000-0x0000000001908000-memory.dmp	upx
behavioral1/memory/3960-2174-0x00000000011B0000-0x00000000016E8000-memory.dmp	upx
behavioral1/memory/2836-2149-0x00000000011B0000-0x00000000016E8000-memory.dmp	upx
behavioral1/memory/2080-2383-0x00000000011B0000-0x00000000016E8000-memory.dmp	upx
behavioral1/memory/2252-2388-0x00000000011B0000-0x00000000016E8000-memory.dmp	upx
behavioral1/memory/3012-2402-0x0000000000D40000-0x0000000001128000-memory.dmp	upx
behavioral1/memory/2984-2407-0x0000000001230000-0x0000000001618000-memory.dmp	upx
behavioral1/memory/2984-2487-0x0000000001230000-0x0000000001618000-memory.dmp	upx
behavioral1/memory/3012-2633-0x0000000000D40000-0x0000000001128000-memory.dmp	upx
behavioral1/memory/2984-2703-0x0000000001230000-0x0000000001618000-memory.dmp	upx
behavioral1/memory/2764-3050-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/2764-3065-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/2764-3072-0x0000000000400000-0x0000000000417000-memory.dmp	upx

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 2 IoCs

Processes:

firefox.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

2548 chrome.exe
2548 chrome.exe

pid	process
2548	chrome.exe
2548	chrome.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

Processes:

firefox.exechrome.exe

description	pid	process
Token: SeDebugPrivilege	2036	firefox.exe
Token: SeDebugPrivilege	2036	firefox.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe

Suspicious use of FindShellTrayWindow 38 IoCs

Processes:

firefox.exechrome.exe

pid	process
2036	firefox.exe
2036	firefox.exe
2036	firefox.exe
2036	firefox.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe

Suspicious use of SendNotifyMessage 35 IoCs

Processes:

firefox.exechrome.exe

pid	process
2036	firefox.exe
2036	firefox.exe
2036	firefox.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 1088 wrote to memory of 2036	1088	firefox.exe	firefox.exe
PID 1088 wrote to memory of 2036	1088	firefox.exe	firefox.exe
PID 1088 wrote to memory of 2036	1088	firefox.exe	firefox.exe
PID 1088 wrote to memory of 2036	1088	firefox.exe	firefox.exe
PID 1088 wrote to memory of 2036	1088	firefox.exe	firefox.exe
PID 1088 wrote to memory of 2036	1088	firefox.exe	firefox.exe
PID 1088 wrote to memory of 2036	1088	firefox.exe	firefox.exe
PID 1088 wrote to memory of 2036	1088	firefox.exe	firefox.exe
PID 1088 wrote to memory of 2036	1088	firefox.exe	firefox.exe
PID 1088 wrote to memory of 2036	1088	firefox.exe	firefox.exe
PID 1088 wrote to memory of 2036	1088	firefox.exe	firefox.exe
PID 1088 wrote to memory of 2036	1088	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1332	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1332	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1332	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1512	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1968	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1968	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1968	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1968	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 1968	2036	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://tlauncher.org/en/
1⤵
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://tlauncher.org/en/
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2036.0.2071175511\998468839" -parentBuildID 20221007134813 -prefsHandle 1192 -prefMapHandle 1184 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9dca90d-a8ab-4143-923d-03fc547f30bb} 2036 "\\.\pipe\gecko-crash-server-pipe.2036" 1256 13ea8858 gpu
    3⤵
    PID:1332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2036.1.174731531\935856473" -parentBuildID 20221007134813 -prefsHandle 1460 -prefMapHandle 1456 -prefsLen 21751 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c984a605-9fee-4892-bc46-b8ecc53a643d} 2036 "\\.\pipe\gecko-crash-server-pipe.2036" 1472 e71f58 socket
    3⤵
    PID:1512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2036.2.1173672072\508395516" -childID 1 -isForBrowser -prefsHandle 2000 -prefMapHandle 1996 -prefsLen 21899 -prefMapSize 232675 -jsInitHandle 844 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8df86d50-4438-4fcc-a078-e9d7a38d54c2} 2036 "\\.\pipe\gecko-crash-server-pipe.2036" 2024 1a6f9558 tab
    3⤵
    PID:1968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2036.3.859039356\537181866" -childID 2 -isForBrowser -prefsHandle 2856 -prefMapHandle 2852 -prefsLen 26564 -prefMapSize 232675 -jsInitHandle 844 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b8e84048-96ae-403b-a97e-bd9ec04e15d8} 2036 "\\.\pipe\gecko-crash-server-pipe.2036" 2868 e61958 tab
    3⤵
    PID:972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2036.4.797425045\921215442" -childID 3 -isForBrowser -prefsHandle 3400 -prefMapHandle 3372 -prefsLen 26623 -prefMapSize 232675 -jsInitHandle 844 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e97f6f7e-e613-4d9f-8675-d5f1777df884} 2036 "\\.\pipe\gecko-crash-server-pipe.2036" 3416 1cc21b58 tab
    3⤵
    PID:2268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2036.5.137431894\2020616383" -childID 4 -isForBrowser -prefsHandle 3164 -prefMapHandle 3428 -prefsLen 26623 -prefMapSize 232675 -jsInitHandle 844 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a034f72-07a1-4851-b73a-4b44bf296f9e} 2036 "\\.\pipe\gecko-crash-server-pipe.2036" 3396 1d488358 tab
    3⤵
    PID:2292
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2036.6.559539204\916545789" -childID 5 -isForBrowser -prefsHandle 3632 -prefMapHandle 3628 -prefsLen 26623 -prefMapSize 232675 -jsInitHandle 844 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fcf4e3f0-9a32-4f55-a65a-b0da2228019f} 2036 "\\.\pipe\gecko-crash-server-pipe.2036" 3640 1d488958 tab
    3⤵
    PID:2304

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef4559758,0x7fef4559768,0x7fef4559778
  2⤵
  PID:2808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1188 --field-trial-handle=1336,i,13633794768311216154,17767028506196947038,131072 /prefetch:2
  2⤵
  PID:2728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1556 --field-trial-handle=1336,i,13633794768311216154,17767028506196947038,131072 /prefetch:8
  2⤵
  PID:2740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1604 --field-trial-handle=1336,i,13633794768311216154,17767028506196947038,131072 /prefetch:8
  2⤵
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2304 --field-trial-handle=1336,i,13633794768311216154,17767028506196947038,131072 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2276 --field-trial-handle=1336,i,13633794768311216154,17767028506196947038,131072 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1464 --field-trial-handle=1336,i,13633794768311216154,17767028506196947038,131072 /prefetch:2
  2⤵
  PID:1968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1440 --field-trial-handle=1336,i,13633794768311216154,17767028506196947038,131072 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3900 --field-trial-handle=1336,i,13633794768311216154,17767028506196947038,131072 /prefetch:8
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4028 --field-trial-handle=1336,i,13633794768311216154,17767028506196947038,131072 /prefetch:8
  2⤵
  PID:2904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4164 --field-trial-handle=1336,i,13633794768311216154,17767028506196947038,131072 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3216 --field-trial-handle=1336,i,13633794768311216154,17767028506196947038,131072 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5028 --field-trial-handle=1336,i,13633794768311216154,17767028506196947038,131072 /prefetch:8
  2⤵
  PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5016 --field-trial-handle=1336,i,13633794768311216154,17767028506196947038,131072 /prefetch:8
  2⤵
  PID:1424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 --field-trial-handle=1336,i,13633794768311216154,17767028506196947038,131072 /prefetch:8
  2⤵
  PID:2944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5196 --field-trial-handle=1336,i,13633794768311216154,17767028506196947038,131072 /prefetch:8
  2⤵
  PID:1224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5188 --field-trial-handle=1336,i,13633794768311216154,17767028506196947038,131072 /prefetch:8
  2⤵
  PID:188
- C:\Users\Admin\Downloads\TLauncher-2.879-Installer-1.1.0.exe
  "C:\Users\Admin\Downloads\TLauncher-2.879-Installer-1.1.0.exe"
  2⤵
  PID:1864
- - C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
    "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\Downloads\TLauncher-2.879-Installer-1.1.0.exe" "__IRCT:3" "__IRTSS:23652861" "__IRSID:S-1-5-21-2647223082-2067913677-935928954-1000"
    3⤵
    PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
      4⤵
      PID:2976
    - - C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816850 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:1841947" "__IRSID:S-1-5-21-2647223082-2067913677-935928954-1000"
        5⤵
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
        
        "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0
        6⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe" --version
        7⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
        
        "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=2836 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20230406202415" --session-guid=427457ed-839a-42d1-bd2b-913e2f3fbec7 --server-tracking-blob=YjljNDliYjVlYThmZjg2ZTJjZTI1MDU2MWNlNzRlNjNlM2NkZDY2MmE2YzRjNjcyMzQ0YjYwNmE3ZDg0ZDRiZDp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjciLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNjgwODA1NDU0LjI4MTkiLCJ1c2VyYWdlbnQiOiJTZXR1cCBGYWN0b3J5IDkuMCIsInV0bSI6eyJjYW1wYWlnbiI6Ik9wZXJhRGVza3RvcCIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Ik1TVEwifSwidXVpZCI6ImEzYTJhN2QzLTE3NzQtNDUyOS1iZDI3LTdmODk1YjU0MDZhOCJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=2403000000000000
        7⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
        
        C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=97.0.4719.63 --initial-client-data=0x1b0,0x1b4,0x1b8,0x178,0x1bc,0x6ffe33e0,0x6ffe33f0,0x6ffe33fc
        8⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
        
        C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=97.0.4719.63 --initial-client-data=0x1a4,0x1a8,0x1ac,0x178,0x1b0,0x70a633e0,0x70a633f0,0x70a633fc
        7⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304062024151\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304062024151\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe"
        7⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304062024151\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304062024151\assistant\assistant_installer.exe" --version
        7⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304062024151\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304062024151\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=96.0.4693.50 --initial-client-data=0x148,0x14c,0x150,0x11c,0x154,0xba6c28,0xba6c38,0xba6c44
        8⤵
        
        PID:1768
  - - C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
      "C:\Users\Admin\AppData\Local\Temp\jre-windows.exe" STATIC=1
      4⤵
      PID:2824
    - - C:\Users\Admin\AppData\Local\Temp\jds7331376.tmp\jre-windows.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jds7331376.tmp\jre-windows.exe" "STATIC=1"
        5⤵
        
        PID:4004
      - C:\Program Files\Java\jre1.8.0_351\bin\javaw.exe
        
        -Djdk.disableLastUsageTracking -cp "C:\Program Files\Java\jre1.8.0_351\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserWebJavaStatus
        6⤵
        
        PID:1784
      - C:\Program Files\Java\jre1.8.0_351\bin\javaw.exe
        
        -Djdk.disableLastUsageTracking -cp "C:\Program Files\Java\jre1.8.0_351\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserPreviousDecisionsExist 30
        6⤵
        
        PID:3440

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3004

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:2196
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 8C5232B7D9DFA45C42573C3CAE5485A8
  2⤵
  PID:2380
- C:\Program Files\Java\jre1.8.0_351\installer.exe
  "C:\Program Files\Java\jre1.8.0_351\installer.exe" /s INSTALLDIR="C:\Program Files\Java\jre1.8.0_351\\" STATIC=1 INSTALL_SILENT=1 REPAIRMODE=0 ProductCode={26A24AE4-039D-4CA4-87B4-2F64180351F0}
  2⤵
  PID:1868
- - C:\ProgramData\Oracle\Java\installcache_x64\7385633.tmp\bspatch.exe
    "bspatch.exe" baseimagefam8 newimage diff
    3⤵
    PID:2764
- - C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
    "C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/plugin.pack" "C:\Program Files\Java\jre1.8.0_351\lib/plugin.jar"
    3⤵
    PID:2228
- - C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
    "C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/javaws.pack" "C:\Program Files\Java\jre1.8.0_351\lib/javaws.jar"
    3⤵
    PID:1384
- - C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
    "C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/deploy.pack" "C:\Program Files\Java\jre1.8.0_351\lib/deploy.jar"
    3⤵
    PID:1400
- - C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
    "C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/rt.pack" "C:\Program Files\Java\jre1.8.0_351\lib/rt.jar"
    3⤵
    PID:584
- - C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
    "C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/jsse.pack" "C:\Program Files\Java\jre1.8.0_351\lib/jsse.jar"
    3⤵
    PID:2544
- - C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
    "C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/charsets.pack" "C:\Program Files\Java\jre1.8.0_351\lib/charsets.jar"
    3⤵
    PID:1468
- - C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
    "C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/ext/localedata.pack" "C:\Program Files\Java\jre1.8.0_351\lib/ext/localedata.jar"
    3⤵
    PID:1496
- - C:\Program Files\Java\jre1.8.0_351\bin\javaw.exe
    "C:\Program Files\Java\jre1.8.0_351\bin\javaw.exe" -Xshare:dump -Djdk.disableLastUsageTracking
    3⤵
    PID:1472
- - C:\Program Files\Java\jre1.8.0_351\bin\ssvagent.exe
    "C:\Program Files\Java\jre1.8.0_351\bin\ssvagent.exe" -doHKCUSSVSetup
    3⤵
    PID:3516
- - C:\Program Files\Java\jre1.8.0_351\bin\javaws.exe
    "C:\Program Files\Java\jre1.8.0_351\bin\javaws.exe" -wait -fix -permissions -silent
    3⤵
    PID:3828
  - - C:\Program Files\Java\jre1.8.0_351\bin\jp2launcher.exe
      "C:\Program Files\Java\jre1.8.0_351\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre1.8.0_351" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzM1MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF8zNTFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzM1MVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==
      4⤵
      PID:3840
- - C:\Program Files\Java\jre1.8.0_351\bin\javaws.exe
    "C:\Program Files\Java\jre1.8.0_351\bin\javaws.exe" -wait -fix -shortcut -silent
    3⤵
    PID:1756
  - - C:\Program Files\Java\jre1.8.0_351\bin\jp2launcher.exe
      "C:\Program Files\Java\jre1.8.0_351\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre1.8.0_351" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzM1MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF8zNTFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzM1MVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtc2hvcnRjdXQALXNpbGVudAAtbm90V2ViSmF2YQ==
      4⤵
      PID:1924
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 2996DD74F0A4C18103712485B6B24451 M Global\MSI0000
  2⤵
  PID:3232
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2589917AFCDBD7639324DC5E59BB0F24
  2⤵
  PID:648
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8E4376FD5CF5B137D4F1B0AA99391CC0 M Global\MSI0000
  2⤵
  PID:2816

C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
"C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
1⤵
PID:2972
- C:\Program Files\Java\jre1.8.0_351\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_351\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
  2⤵
  PID:3000
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
    3⤵
    - Modifies file permissions
    PID:2484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\709e85.rbs

Filesize
925KB

MD5
28081a6dd06c42373f92bbd17eae9a5a

SHA1
4307620db608c6e65ef3f2d4c6c511174d4fc6e1

SHA256
0716df31bfd700de1d2ed76743b01fc17241dde6a7473f016d5d8bec79f6992f

SHA512
86ec47c7ee71d47ae033d6d5cbfbf68cf4e843fb359b88658ae0df22dbf23af4510fd45d65b20df8c4373c07ef0e58b112c7a07cf20c73831e3d8d23b24d8df5

Download Submit
C:\Config.Msi\709e8a.rbs

Filesize
7KB

MD5
270b6558757bcc22b70d259fcf7d956a

SHA1
b3ef8791225510378a4d6456ce28b98952a8d652

SHA256
aaf74b2fbf1211a06523f0b7df0e3a9a9e26bdf8c5a5021605f963c693d311f3

SHA512
c5b0e1006eb5275c4b1e01bf101add98f480892f7f70405e47eeff002d990f5682e5e654853fce57f2ff8d46a125c52e5ade975f4f076583ef90c66f90e2c391

Download Submit
C:\Program Files\Java\jre1.8.0_351\bin\dtplugin\npdeployJava1.dll

Filesize
1.8MB

MD5
ff91ac355dc6b1df63795886125bccf8

SHA1
90979fc6ea3a89031598d2146bf5cdbbb6db6b77

SHA256
14b30467cfea0071dffc658dd31b8a25b7b4e79608933f171911c2cba6aa9a0a

SHA512
77aa8c7930730004bdb8d49a82712e1042db978102f6eca0d38317b6fd98ef03e52279130eadc7a0da1148e759db6589f7f8334d4c2eccfb2613e8f19542e197

Download Submit
C:\Program Files\Java\jre1.8.0_351\bin\javacpl.exe

Filesize
103KB

MD5
7a9d69862a2021508931a197cd6501ec

SHA1
a0f7d313a874552f4972784d15042b564e4067fc

SHA256
51ff63cbac78bd133333e98d91b02b652c88cd57cedd0052519051a17be77856

SHA512
5c331e6deefc8256ea203d63770484f6b485d4c3832a60ecf4a540dff3cb75a76dbde37980fe1763ca487401b68126f58f8d1a4c72ee610f5144c624c4736850

Download Submit
C:\Program Files\Java\jre1.8.0_351\bin\javaws.exe

Filesize
446KB

MD5
24ccb37646e1f52ce4f47164cccf2b91

SHA1
bc265e26417026286d6ed951904305086c4f693c

SHA256
adf2d659c2b2a4afff1ca58f3a742d27d767d27eabeca6a8b6ee243e9c913a39

SHA512
cb174e7a219f6ffae3715e37beb428979bc1462202729c05a25fa7b8da90e2dd6faa92c03cd9ca21567d354dce7acc1852669f4071298e953d6a286243794e32

Download Submit
C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe

Filesize
216KB

MD5
691f68efcd902bfdfb60b556a3e11c2c

SHA1
c279fa09293185bddfd73d1170b6a73bd266cf07

SHA256
471d70ebf91bdc762dcacbea9f6ca883f97921938e83269fef911dbf83598a70

SHA512
a4816ae0654f41bd130d56e44839d9f29ab48bd2f99c3d6db38ce3358ac46c1cef09da09184c6291dd378018a49f9e56173c35d780d3eaefcce459592c75de3f

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit\Reference Documentation.lnk

Filesize
197B

MD5
b5e1de7d05841796c6d96dfe5b8b338c

SHA1
c7c64e5b35d0cca1a5c98a1c68e1e5d4c8b72547

SHA256
062cb9dec2b2ce02c633fc442d1a23e910e602548a54a54c8310b0dde9ae074d

SHA512
963a89b04f34bc00fea5b8e0f9648596c428beac2db30d8b0932974b15c0eb90b7c801ba6fa1082ea9d133258f393ae27e61f27fd3b3951f5c2e4b8c6a212c2d

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Get Help.url

Filesize
182B

MD5
7fadb9e200dbbd992058cefa41212796

SHA1
e2525d7ba66bb07bc1cd5ba93f88c54e7e2042b4

SHA256
b05abacd15117b1ffcd2a288308f50c0542214d264b852eddfa9025307ac401b

SHA512
94b7bf1f1f5cea2a74f8c326113dd25652cb14e5fa356ac83d16b6ac5a5cac26c9d2b20259f5c2cf8ebc1e022490511e2996335a5d8dd7f5b64dce429fb6dfb1

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Visit Java.com.url

Filesize
178B

MD5
3b1c6b5701ef2829986a6bdc3f6fbf94

SHA1
1a2fe685aba9430625cba281d1a8f7ba9d392af0

SHA256
6a2cdce88637830202e1031bc8c11f083103a6bbb8c1ce16fb805671a46633c8

SHA512
f3391d790bb6acb1c25b82253b19c334e7cd73648e9821b7050fefbd5b0bc4b48a0cedd97e425a83c788f9b798337d33dee2e989771604c4f886da46d2debea0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2043647a5ab9c80ace2e34f758186f9e

SHA1
4d2873cb6eeb6db7cbb63cee7024358c1d9d3c57

SHA256
2e7e8a607a8c3c8c0b8011047f044ef38ad099a768213f3623f9a73aa4de4881

SHA512
9b40f8c23da16c00e75f119f0fd268c85c03e0250f70fdcae682f0d8f4b3d84807f6278007c692cdd539e4c751c015d1f4f60a6fe440ad41fd0bf61e8bbf0783

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0e13736e-f7f5-4bf3-94aa-8d43e71a7f3c.tmp

Filesize
199KB

MD5
12a282b2854c076b27aed0e8eab6a0ab

SHA1
3ed42a553cc48ee6fec905705782f97636315c0e

SHA256
b0c2efd4206653099a6995a2e10ece1c5b21c658137dc6dd0e967da1889ad775

SHA512
f179b623a0a862dbc642e2ef16c5765fbfb970661875129c9b3c5bad5cdb975dea8b35dc2621218b189a6b3a159af03edfe5eef01ca653c3f99d08b63f385186

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\946be21a-e05a-4906-bb07-76fed5455bf0.tmp

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
64866b68e40c72ca516591a5d4ad5259

SHA1
e4e97be03ce057d3c11f19f8e27920385ab35a6f

SHA256
e972e2e5afa80758a6351ff6d30acfbb62658605bcea053abfc23180d23f81ef

SHA512
47b2f81f4cc77f4cdf4015ff35145884915fc3a27647b25a19b775d6edf7f70b34c69177923102cfd81dab5ba20e86cdfcee9c460b2c66c2971f9dbef9b82150

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
8a57d03e92e7f3e742921fc93a35b4a1

SHA1
c803e652e4ebabe42d777b86769a99b47cefdad9

SHA256
c5adf6af9e15c845ed83443b3e6d9d54e8ae720d75ba56184ebcef5714e2fbc7

SHA512
751a84ba6af7570c41e0c8ccd330da9a53fd356e4024bc9674d035d7412f94a8152881e8eca114da784cb6f34792ac71474137883351e711f4a1347ce495b089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
7f252b06fe2ca6c0a799e7d476ed4dc4

SHA1
b94e12107d39e4cde7ab6552adece6948b74477a

SHA256
0fe51588f39ac5a37fb207cd8619265fc31033017ba5767bc0308aa9c8e2fc52

SHA512
58361fdbb15a4c2f12195572d7289f3a69ec258bd79556fddc5b65e0524eb737c0e8d90a1a572cc3f1ae41854d03295699adf330e7b13f564cc5e3bca41152fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
200KB

MD5
872975c5c80a2a48e3e5e4bf02d19dbe

SHA1
6959957159da4ef97776ee4ddc11912a1080b997

SHA256
f9e69f5330cfcaa56f0c995a0993a0a3d98f5739920ecef03907767df7d57dc7

SHA512
0fdf8370cc3aa37df26191846881bc4d47b81b8616b1762540c3b67485a49f664d597d0e603f2baab93a972c90225df723ae582d11545a904857a01b3bc0b210

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ONXID7T\host[2]

Filesize
1KB

MD5
a752a4469ac0d91dd2cb1b766ba157de

SHA1
724ae6b6d6063306cc53b6ad07be6f88eaffbab3

SHA256
1e67043252582aea0e042f5a7be4a849b7cd01b133a489c3b2e67c10ade086f3

SHA512
abc2899705a23f15862acf3d407b700bb91c545722c02c7429745ab7f722507285c62614dcb87ea846f88fc0779345cb2e22dc3ad5f8113f6907821505be2c02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ONXID7T\layout[2]

Filesize
2KB

MD5
cc86b13a186fa96dfc6480a8024d2275

SHA1
d892a7f06dc12a0f2996cc094e0730fe14caf51a

SHA256
fab91ced243da62ec1d938503fa989462374df470be38707fbf59f73715af058

SHA512
0e3e4c9755aa8377e00fc9998faab0cd839dfa9f88ce4f4a46d8b5aaf7a33e59e26dbf55e9e7d1f8ef325d43302c68c44216adb565913d30818c159a182120fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ONXID7T\masthead_left[2]

Filesize
4KB

MD5
b663555027df2f807752987f002e52e7

SHA1
aef83d89f9c712a1cbf6f1cd98869822b73d08a6

SHA256
0ce32c034dfb7a635a7f6e8152666def16d860b6c631369013a0f34af9d17879

SHA512
b104ed3327fed172501c5aa990357b44e3b31bb75373fb8a4ea6470ee6a72e345c9dc4bcf46a1983c81adb567979e6e8e6517d943eb204c3f7fac559cd17c451

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DE9Y0H7M\l10n[1]

Filesize
4KB

MD5
1fd5111b757493a27e697d57b351bb56

SHA1
9ca81a74fa5c960f4e8b3ad8a0e1ec9f55237711

SHA256
85bbec802e8624e7081abeae4f30bd98d9a9df6574bd01fe5251047e8fdaf59f

SHA512
80f532e4671d685fa8360ef47a09efcb3342bcfcf929170275465f9800bfbfffc35728a1ba496d4c04a1fdefb2776af02262c3774f83fea289585a5296d560b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DE9Y0H7M\masthead_fill[2]

Filesize
1KB

MD5
91a7b390315635f033459904671c196d

SHA1
b996e96492a01e1b26eb62c17212e19f22b865f3

SHA256
155d2a08198237a22ed23dbb6babbd87a0d4f96ffdc73e0119ab14e5dd3b7e00

SHA512
b3c8b6f86ecf45408ac6b6387ee2c1545115ba79771714c4dd4bbe98f41f7034eae0257ec43c880c2ee88c44e8fc48c775c5bb4fd48666a9a27a8f8ac6bcfdcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NZTPJYNO\common[2]

Filesize
1KB

MD5
f5bb484d82e7842a602337e34d11a8f6

SHA1
09ea1dee4b7c969771e97991c8f5826de637716f

SHA256
219108bfef63f97562c4532681b03675c9e698c5ae495205853dbcbfd93faf1a

SHA512
a23cc05b94842e1f3a53c2ea8a0b78061649e0a97fcd51c8673b2bcb6de80162c841e9fdde212d3dfd453933df2362dcb237fe629f802bafaa144e33ca78b978

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QCNSQOTT\rtutils[2]

Filesize
244B

MD5
c0a4cebb2c15be8262bf11de37606e07

SHA1
cafc2ccb797df31eecd3ae7abd396567de8e736d

SHA256
7da9aa32aa10b69f34b9d3602a3b8a15eb7c03957512714392f12458726ac5f1

SHA512
cc68f4bc22601430a77258c1d7e18d6366b6bf8f707d31933698b2008092ba5348c33fa8b03e18c4c707abf20ce3cbcb755226dc6489d2b19833809c98a11c74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QCNSQOTT\runtime[2]

Filesize
41KB

MD5
c65bc05f8e3c03fe4899862480f4d3f3

SHA1
5a5d38a3154430d1ada06724567eba14f652ae4e

SHA256
cc8f816e080d837cf1d98a1a301ab2a8ddd64ccad69d01995125645710b5ef21

SHA512
874112843ebc5eb4bc1038a003bd3706e55844205f0ad676ca76aaa9e51f8e9e05b61c427ee50bd193ed693124c9adff94689df1a73cfa35d981df9540a928ce

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\tt2bc8ln.default-release\activity-stream.discovery_stream.json.tmp

Filesize
147KB

MD5
c38862fead8225ddacb3b8416d8dc194

SHA1
dee3dfcfab2c11a69c95ed9d37205c4f484e8933

SHA256
5693a8e150c6ff469f7815f085813e96a9535f9dfcf65348582ec07aad9e82dc

SHA512
840d51b6e9cbf2ff71711b1b4cb2c19a6ac208c6e739b296538d6b1320b7920d45459a5249a6e71119069cc31fc408b1a93b947fe4f3757fd52587c18106d757

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304062024151\additional_file0.tmp

Filesize
1.7MB

MD5
b386cdcb413405daa8219af8e4cbd318

SHA1
ce275ff8514fef0629c915a6ee7b5ac481b9043d

SHA256
408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e

SHA512
91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304062024151\opera_package

Filesize
86.9MB

MD5
6b7771354e081eb94cdbf7627799da4f

SHA1
199341a750443cc6e9b2b2fa1e657d0dd327711f

SHA256
494d1247e61eebf703a6eb19c14bde88edd2f85515fefa4f0465f43873e69aab

SHA512
33e781a102ba3f5c3b1895540bc9c43b78bf4f19af4b91ae0c765594f39d6569d1bad207b33f808426d8ebdcb00c419b7bb76bb050bae0bb843f96dd84355800

Download Submit
C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2304062024152253436.dll

Filesize
4.6MB

MD5
4fa000d2daf4a9a8b30a36de57343e8b

SHA1
4865161c5ec70cce04079a6cbf08795e05bacbf1

SHA256
50df18de18d3cdd5cc21f8fc0dbabbe5a60690027b82af25806f679f492065de

SHA512
a52620ab7ae4e8a6c7379790fc70c5cc611a06432b83ded0a7ea476a647098fcb18797b42ed98293c3e9dd955d784819638597e3b1b419f54eeb9a0084b625ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar945B.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico

Filesize
116KB

MD5
e043a9cb014d641a56f50f9d9ac9a1b9

SHA1
61dc6aed3d0d1f3b8afe3d161410848c565247ed

SHA256
9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946

SHA512
4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe

Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.PNG

Filesize
339B

MD5
a45137507477ea159a4c0481fadbdde8

SHA1
772e535525cd41abb781167334f923f1127f6d24

SHA256
fcc6693f94f87dbb9f03bd664f029db87257c79ac9a974d2caadc790f20ea67a

SHA512
393a8d9387b388524fbf7bc8387d521c830e7d384aabe278251cb4fa1291d32e2875c464a01f93670259bc2009d69507b632a692d43244f3eb7551414c9d635a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG104.PNG

Filesize
644B

MD5
f54bbaadafacf2ed607c2b44e76bd5f2

SHA1
e6e313e86b0adb771643dc9aa465652646d83329

SHA256
2dcd3efb7e14a1439973b066c810eb3187cb851a7d01b2a03376d978b6b0d927

SHA512
1d7f940d290c3c7eca12739f7e4753901a1d070ca9f43171b4fe25530ba48b3b376c16b125a32d6e701d63d576ef829824472bcac99e568784543bfc4c50b732

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG109.PNG

Filesize
2KB

MD5
c70b569d43f5e00ee3dd81530899f191

SHA1
38b7f73c29d9d355625bf7dcc611d657c263dbc4

SHA256
778c8b5a8e7422ce84f4113fc1cbd90204f3b3c0b3bb8545b3fe68003525e9e8

SHA512
f0aafa93ffd1edb8764f7e435fa982b0eb596b1962472dcefac26731382c58d44306e876f04675146595a1e7ee6ae8170e2fa01ed0fca075e36a9749709f4df7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.PNG

Filesize
280B

MD5
01e097a324673878a3cb5e8e0f3cf152

SHA1
35ef5c438eca9672c7ee19bcde3952f83dc77928

SHA256
d8d0719a20d267a73d298d2ec1fbc050fe2ce25447c7441058ea3966acfbbb22

SHA512
e873763e96b3a52fe73f3fc9b3bcfd764c807c0206b5984d5f7dddd7debec4e6f0b6705ca6a7c6379b83c2fea792d7a16880ea109469ac1af41cc7bdb5f96e27

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG22.PNG

Filesize
1KB

MD5
362d3183b2acc152c99ec123611f3297

SHA1
3db69a12917cb11a14fb9294d73c5409fe11a398

SHA256
8ae66727c5c92ca76a131aa104cc126858e8e3ed490ae08482109dfedd9a8cda

SHA512
2c7f40564479d1fe90cb59b4b413e8bf9a5bb7cd2f94193f8759e376549c0269afce030df7d306b4cd814f604ad460d744fb00d961f6d2608a4ecb6b186a4f1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.PNG

Filesize
281B

MD5
d88e18e2a020a756a8de999b76e7b1fd

SHA1
150f801600b9427039197847aaac784f8ba15258

SHA256
38b8f2202a5e48a8f528708922f504379896ef52b3882ce82efc3481c51804bb

SHA512
d048a569d155aa4636f25ed2963fd5e2234643735ad461df3ad3201cbe152b646c2893557a236fa9683aa3cb07351fa79b9e5788f631442e5142cab0bc98654a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG85.PNG

Filesize
43KB

MD5
16c0e37cb0c5540fd9f93a8d82d94e52

SHA1
52d5aabf804381b47d13a358d80256c4088eec21

SHA256
2b772e66ebc70c93deb0b9a9e054373ee33d9245809e16174b1f132f786a063f

SHA512
dd54308739f9621f5fe707c69f24657431fd58b46e357a79d25c3d8e96d3b2914ce19d94beeee0bbd32311737670f06b01c364f0c7d70625a4246da64c29b0af

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG86.PNG

Filesize
1KB

MD5
a7a8625948d61d814dbb29225e04f908

SHA1
16bc91a8bb3c22cf78447644a32010ad869eaf99

SHA256
61979f700f77d187c8647cba3bee95ca4a70e187bbb76323f4055385dd8879d5

SHA512
04b0bb58095a6e8f1d29203f21eee99fd837494b74736e91e5e304eb3dc3ccb32796b6959361ede965731b76607a53b0f9d211cb4b3d94b25ea34898e760d295

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

Filesize
1.7MB

MD5
1bbf5dd0b6ca80e4c7c77495c3f33083

SHA1
e0520037e60eb641ec04d1e814394c9da0a6a862

SHA256
bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

SHA512
97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

Filesize
97KB

MD5
da1d0cd400e0b6ad6415fd4d90f69666

SHA1
de9083d2902906cacf57259cf581b1466400b799

SHA256
7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

SHA512
f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
f8da4bc14cb40b7ff8cd2c798ca0f7b9

SHA1
1264c77f79f7a328d60dfd752e721a463fc3e247

SHA256
3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1

SHA512
0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
f8da4bc14cb40b7ff8cd2c798ca0f7b9

SHA1
1264c77f79f7a328d60dfd752e721a463fc3e247

SHA256
3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1

SHA512
0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
f8da4bc14cb40b7ff8cd2c798ca0f7b9

SHA1
1264c77f79f7a328d60dfd752e721a463fc3e247

SHA256
3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1

SHA512
0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat

Filesize
114KB

MD5
bd5626a0237933e0f1dccf10e7c9fbd6

SHA1
10c47d382d4f44d8d44efaa203501749e42c6d50

SHA256
7dfc1176d8a507135140b23a0c014093b7e2673f0f3e5727c3d85df4e7323762

SHA512
1fd864a5386580cf8bbafbacb12a043ef51948b729b9aedfe6dc81e6c2948a100526c7c600069f22454d550f7f736ad3045a930cc2ef97458dc1d6c782928087

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
018c68cdf5ba005b4a380c20b13fee4c

SHA1
bf6043fbd31288e8667fcfc37cd74414bee1805f

SHA256
3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

SHA512
506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
018c68cdf5ba005b4a380c20b13fee4c

SHA1
bf6043fbd31288e8667fcfc37cd74414bee1805f

SHA256
3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

SHA512
506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
018c68cdf5ba005b4a380c20b13fee4c

SHA1
bf6043fbd31288e8667fcfc37cd74414bee1805f

SHA256
3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

SHA512
506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jusched.log

Filesize
3KB

MD5
ca9159c1186f59b78e4fee592fe16914

SHA1
d66559ed20fca1926e951f52f400a9e2f9bc32d7

SHA256
b5015829e14c5efa17d05e2384dc95815f94e06cf4f3b31ce64ecf7cb2d20ad3

SHA512
9e7bf77652ac831686dda0199b0bed5755486874b5f72d8468d6d6e47c21847d22aa4d1d8419c3c913af022a260f4ecf533f0759250954eb54caa201104f4b68

Download Submit
C:\Users\Admin\AppData\Local\Temp\jusched.log

Filesize
4KB

MD5
09fd2ea21387d7872c4fe7b64c2be83f

SHA1
9dc7713609d619ff463bcd472651e5be481d538e

SHA256
0c52ecd1f16cb84c89fba57975e8b0cc4b7ef09f22ee3176a3ef14717c0be75e

SHA512
073abb5e6a2852d009069462be24aa7023c2a895e35c11d810492a3db9d37f3358486d4b53c73032da403bd4d7047d82c9aa7a417057e5f991520d1145a71487

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
0a878fdd559b6c43d59bee6c143b1a1d

SHA1
3c9994c09fd42e17953aeb8040b4610bbf8b2706

SHA256
5cbcfa9715671c6bf2264f2d1efb9b70172c5da769a674bb3b93407dbc180fd9

SHA512
02d1ed8e75d1ede1b7fae1c17ad5d9e31950eb60017a9ecc2db8ede8907e9ca7d977339e98f6d0f4e459d33caea88afa5c4a34092fe9df7282cbd0eb8fcdf077

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
0a878fdd559b6c43d59bee6c143b1a1d

SHA1
3c9994c09fd42e17953aeb8040b4610bbf8b2706

SHA256
5cbcfa9715671c6bf2264f2d1efb9b70172c5da769a674bb3b93407dbc180fd9

SHA512
02d1ed8e75d1ede1b7fae1c17ad5d9e31950eb60017a9ecc2db8ede8907e9ca7d977339e98f6d0f4e459d33caea88afa5c4a34092fe9df7282cbd0eb8fcdf077

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
0a878fdd559b6c43d59bee6c143b1a1d

SHA1
3c9994c09fd42e17953aeb8040b4610bbf8b2706

SHA256
5cbcfa9715671c6bf2264f2d1efb9b70172c5da769a674bb3b93407dbc180fd9

SHA512
02d1ed8e75d1ede1b7fae1c17ad5d9e31950eb60017a9ecc2db8ede8907e9ca7d977339e98f6d0f4e459d33caea88afa5c4a34092fe9df7282cbd0eb8fcdf077

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
0a878fdd559b6c43d59bee6c143b1a1d

SHA1
3c9994c09fd42e17953aeb8040b4610bbf8b2706

SHA256
5cbcfa9715671c6bf2264f2d1efb9b70172c5da769a674bb3b93407dbc180fd9

SHA512
02d1ed8e75d1ede1b7fae1c17ad5d9e31950eb60017a9ecc2db8ede8907e9ca7d977339e98f6d0f4e459d33caea88afa5c4a34092fe9df7282cbd0eb8fcdf077

Download Submit
C:\Users\Admin\AppData\Local\Temp\setuparguments.ini

Filesize
590B

MD5
37169980b986ea3aa8377d057ea50757

SHA1
49705fe586aba3e71bd3987adcf37026165963d3

SHA256
1afdeb4fda3bf6878ef0469c6fa8bdc61f06de4bf3a4b7ec4105f63a5c8092b1

SHA512
8156674798e1c766a3a1959c944cce7ec2a6abb174efd3b63cb131d2c37c6bc1b9a8b772b949d631c6ac315e7f5f8d59dad7c0e8900ba1533d9012c8aaee955d

Download Submit
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

Filesize
6.3MB

MD5
545c62b3d98ee4cc02af837a72dd09c4

SHA1
54446a007fd9b7363d9415673b0ac0232d5d70d5

SHA256
738029a4f974128180fa2cd239e873b01e456e8bf53bfdbf34b8ba8b57897be4

SHA512
8bf9c754861ed267efd2055ac09b4ad44df61b989859fccd14190592dca1dab0fa8f57360209eaceabb5137f742c9cea73a1a985ab1955f87a6875d0be95fdcf

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.BMP

Filesize
451KB

MD5
0b445ace8798426e7185f52b7b7b6d1e

SHA1
7a77b46e0848cc9b32283ccb3f91a18c0934c079

SHA256
2bbf97ccba3f87d469eac909c4ce8a3f13ed29c8f31b611e7d5cf89a0619eda6

SHA512
51523d5b711481293305465a3a3c6a3a50dca984cdc8cca1f4c44f3c21bfa430cd9aac1a8782d9605e6954cbafb307beb6b1a52e9785de1bc3f71067d80c6b6e

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG23.PNG

Filesize
1KB

MD5
58c10711ee61290c5e53d6c235d14c7f

SHA1
6cd433f1d5224b7441efecfef8e0982bbda4415b

SHA256
2d8d51d2405fd3534f5fce5ffea5b9a100ce4aacf35caa7d165c7c6672949b35

SHA512
b895b6f07fefc06695cb521fa923534c8ef99312ab6c27295c86de29fc1bdb09e3ba17cd4aea75f8dd9cf7e1a3c4494a6ef960eadcb209eecb1b623d70c367f0

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNG

Filesize
45KB

MD5
32b9a83f00af4123b811eb6a85ee7971

SHA1
a1e6bdfe76e6103aca76bd21ce60c0b48e4de570

SHA256
a39a8cb1d54a2036257211b6364f84caf033fccf3394e9f890434563770e594d

SHA512
eb272c6dbaa3e59887cfdfd21dba5e2abc56a12beeda55ba091aa9b02da71af5ce11c0f7af4fb34f58da9836f91d787e26ab9f898b8669c861e9bacee973ca9f

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG41.PNG

Filesize
457B

MD5
19678bec078614865a71ade211a305f2

SHA1
9da7f2ff66044138863ed5d1dcf2fc7e90ffedf4

SHA256
d80c15c79946fbe8b3a6a5280f2509eed654338e53096fa6f22d280ad2f6263d

SHA512
b2894b6bbdb5ab639fcc615ff0d2b414fb517d9e1ea8062c61d23182056a0de02e118b9e43824b4765a8617dc4fd330c7f4187e3b395ee92c6ac5e893f242602

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG42.PNG

Filesize
352B

MD5
034eab9a50571cbab86294322e639886

SHA1
cae94b8cfe3ecce8e750d6fd34d54e766ea607aa

SHA256
449d678cc9a235d42a5a2f4e685536d9af87c6b5fc022f28dba32b08b4e88ee1

SHA512
b364c0cbb38bfb35e3c2d29705df72a8ce7dc111f04ebc05eceec4294987f18200581a31b78a79b05da890b5358e5463d1640d2230a8af930804efa3d4da42b0

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG45.PNG

Filesize
438B

MD5
87221bf8c9222a1489e949e4266a2980

SHA1
60c9d850f696e56b53dc3f940f52463d228febf2

SHA256
8d6e1d814dd38525115ee5d77e2d2ae6df8be31562a3c6805012097d6625efc4

SHA512
fa7ba5edb212a0ad70de123b1eabebd8d4cf5e2e3f59841330923c91d6ce6d8a0bbbf0176a8215a183ea860ae5286a4205b73f70df4d032cfd6c03109d1e433c

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG46.PNG

Filesize
206B

MD5
bc193c9f3fd0730341d2ba951f734652

SHA1
ebe3f410cf0bf5f30fe36b1c1df96fa27e73b01f

SHA256
e9137bc2fefbd9a3c4506708f283fe52c40b00b35c2677fc31e196b305b00e67

SHA512
355cb9a7ba6e2a77a51339bfa732537bc77d36da372fe926f1e4bf25de865b09c98122d9559f5ec234b41a83cb97de4fd49427a9476169653ac6058912261c1e

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG48.PNG

Filesize
1KB

MD5
9eb36caea38bf80ed9fa40a3f67597b7

SHA1
3c23e2e30119f6dd321d34a82a339d52723bfacc

SHA256
6be2e43a38969226e1cbb00605cdac634d0de3e82ce605b08dcf1cf596f64370

SHA512
22b57fc57d45ec73865e5429210d6016d2bab0cd990877c8272b4fc6ded8effe3bfa0c9b0890d7b0de8296e6bc3c262f29637b8ce7840efba2f963e70a978e53

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG5.PNG

Filesize
1KB

MD5
23e26969753c07af68f232cdd684c003

SHA1
f14666db750cc2f89ccdd8852b4259fcfa663271

SHA256
17f138eea95423738d2c9b75834b607c671cb2ac4d71c9aecf100a8b847003d2

SHA512
7c57a6309da9ae381073e005d374b9c8a82c7b4e92322b91433009d41f8f34655ed9d45958ab1743023faa9e7aa0c82a05d9292b078efccb64c19992b7e4d4d2

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG66.PNG

Filesize
41KB

MD5
7aae2de61d5e6296c00fde67046dfaeb

SHA1
87a65e99d520045c39997b53c6a0aa08cec35e57

SHA256
07b11e82a30598438ac4221d6c8796739c42c2a596365464f257481a37fa00c6

SHA512
c5ebaf43ffc19a1a3b2f49e070ea1d5532ae433c3bcd02493e31bd3389b6c3edfb1e04373902fbd252eb7370612dd96c3d36eb3fac8240111f57020ab99fa882

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG67.PNG

Filesize
1KB

MD5
0bde2ca44cd4e4e31c5c0364c66eb57b

SHA1
8496e4a8dcea6e42af33b503dc200d4a1ef07101

SHA256
38031284395ba7a773a335a861536b487bbf60b81496424b8a9a8a6697a919de

SHA512
4e60f45022b0c6739db94097401f6046e5f95b26dca71e685db834338451b7ea0b3ed3afc128d564c3f79074905b7986714f75925c41f763eda6b901875af555

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

Filesize
8KB

MD5
87625cff3223b4c60f6f5e0e74091103

SHA1
c52c4011bdca15f0460c6ea8a9f34b0ba026feb9

SHA256
9799fa748ef0d894f668a3272a4735dcfa80a6e4509cf6e0d1b589bb6ad91a85

SHA512
a40de91ab870637b90d215da55d95726ff1a4bc3dc17fc7fcdf0782834e2872890704cb0cf5c8e873ca8073370f4e2acecd18f8f6ec4524f30825eafc0144ebf

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

Filesize
33KB

MD5
f64acbbad2df4cd8cacfd1defc6be52e

SHA1
761e18194bc79fca3166964fba966e6732958a5a

SHA256
1493e1392c9914236795acfcb1276eb1a5ed9c6c82ccc6dc16bd68da28999584

SHA512
963e5c2cbbe27f4a8377c49e92985bc047a7d28f8f1f90c938bb90a9e52acd0cb35a206ca56885f02265a190bd964bb79bdc9998db33faab9ce0fca835b8aa6e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tt2bc8ln.default-release\prefs.js

Filesize
6KB

MD5
15e6fd3520be0606f38df7a78060e401

SHA1
78b9cf1c9b974cb5ab4a912ebed975859eb91e2e

SHA256
d675e2c405b8587769a923ecec85974204f50b0661c97e75b226e66426903acf

SHA512
064f4e03eadefae10972135515882063bcdc68e21431abd8f2ef5955a1ff5265e3550733f8fc56a7de9d4084364a4703aeb7e7385e5008f09ed4fdc8efcd29c6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tt2bc8ln.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
932B

MD5
d746229584975d850ee3e9d2866d5b4a

SHA1
e69a50d2e11f44d6ba0f2c889cdcc7eb5dd14097

SHA256
9b5facb05d1fb9799855cbb12cf55384c7b08c4fe7900f651cf08a69520d24ec

SHA512
5c0df2aa3e538c782abe143b1fb5a0505df5b737bbd0b50ec5138964908a89b540e9632750ac17851ae52094ac77ef87e4c7399874e1cbe5d8aa36fa1613f567

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tt2bc8ln.default-release\sessionstore.jsonlz4

Filesize
595B

MD5
7af5f7c22647270e57485f43893e2fb2

SHA1
c44beb1d4d2428160fbe139917446fc4531d311e

SHA256
94df90e32267f7d14f6d100489f6a6d38f4793f8943f60e7c122ab9cb6bd2fb8

SHA512
c9baf58da565f395c482797dae27c05fedbafe06b2b027bc9211e87d9c452ba5b89146acb54dbc68de06ed309edd58b16e0336be112215b9f1fc4c5a543ebf24

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tt2bc8ln.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
85397a473ab0c323cd3335bc6139c2ae

SHA1
c665276759243168ccdf14334af2ebec7bae9001

SHA256
1ddbcaaab46e4ce4c3f70aecbc8b0b5288e9674f2e02fff0fe02c4aaaa70c1a1

SHA512
3e1d492222e4ec0d721bf537dd1eb4e55d1cc19e9c1a65b08c84ac5a739c7507a1670d466079ee78c7a2c618c3566fa674337811ed4ccba1770769dcf9f04ae6

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

Filesize
40B

MD5
c8c71757338a62280b6eda22a153cdce

SHA1
968f3414c4dad8ace0a3965c799d2fe8a7a55b56

SHA256
d5518a577cdfa72c7ad199971d46c9f74d73a1c38b9c6935c56646f81e81e4ab

SHA512
10d3a33a48790db2d48505b109953b25f2f42d9941a439436da0ffc3567e5412897101ecdb56108e456d60c6835ee8f0e977cc8841761bc5f586e3e19c24ed2b

Download Submit
C:\Users\Admin\Downloads\TLauncher-2.879-Installer-1.1.0.exe

Filesize
22.6MB

MD5
601b94e3b018e39e0da90881fe89156d

SHA1
dc5340d6e1cb98c6ae2fa6882a4c7284e990705b

SHA256
845b0953c143daf9382b38c8ac7faeef62d5298bb0191f1be60865f78a942bac

SHA512
493c283aa3e201501843e59d593d82b3c98d2628639c95c977c9f22c268d89f7b072907d7b5d244fb7f122348277a97f7d68ce0ebdb36d7fc479c5f3c5bd33db

Download Submit
C:\Users\Admin\Downloads\TLauncher-2.879-Installer-1.1.0.exe

Filesize
22.6MB

MD5
601b94e3b018e39e0da90881fe89156d

SHA1
dc5340d6e1cb98c6ae2fa6882a4c7284e990705b

SHA256
845b0953c143daf9382b38c8ac7faeef62d5298bb0191f1be60865f78a942bac

SHA512
493c283aa3e201501843e59d593d82b3c98d2628639c95c977c9f22c268d89f7b072907d7b5d244fb7f122348277a97f7d68ce0ebdb36d7fc479c5f3c5bd33db

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 332997.crdownload

Filesize
22.6MB

MD5
601b94e3b018e39e0da90881fe89156d

SHA1
dc5340d6e1cb98c6ae2fa6882a4c7284e990705b

SHA256
845b0953c143daf9382b38c8ac7faeef62d5298bb0191f1be60865f78a942bac

SHA512
493c283aa3e201501843e59d593d82b3c98d2628639c95c977c9f22c268d89f7b072907d7b5d244fb7f122348277a97f7d68ce0ebdb36d7fc479c5f3c5bd33db

Download Submit
C:\Windows\Installer\709e82.msi

Filesize
81.0MB

MD5
1794aaa17d114a315a95473c9780fc8b

SHA1
7f250c022b916b88e22254985e7552bc3ac8db04

SHA256
7682233d155e6d19f30cf61b185a02055be0dbcacd2c9accf90a99de21547eb4

SHA512
fb9defdf73786528e82ffc7e1ccfa03cfb687365ec740e9620993da785414306f03a7e1fa523192a9d690a882b012d1e426afd1757639f3ef5f1e612c01e6516

Download Submit
C:\Windows\Installer\709e87.msi

Filesize
1016KB

MD5
b29f7d1be8b1e479c9040e1342344ca0

SHA1
6e7e31889f809912e17fb2ad029c181f615e9f1c

SHA256
b232940538b2a1db90f16ff422a947bf42e94fad7e7e154fb8782b0f982dac2e

SHA512
f9b02d017b6851ea0d0eed32b3528a03c9a9b9255f3227e19c2115285af76d849512c86c8bd50a1ea1a961c561f943bc8c7b1a4cc4dcbec80ad99fd7fe49709a

Download Submit
C:\Windows\Installer\MSIA5E6.tmp

Filesize
757KB

MD5
62cfeb86f117ad91b8bb52f1dda6f473

SHA1
c753b488938b3e08f7f47df209359c7b78764448

SHA256
f06cba20bd40e9d841add1877cf8d3b406f0acfa4800b80ae041ed3cc374eb7e

SHA512
c1b0e76cee4e2c3ca604dcc8f5665e72e70008acc824e20d89404f139d7e7e789e99dff131dafd76409f6ea0a813aa136f96089fbdadcf90d6485b1807762e4e

Download Submit
\??\pipe\crashpad_2548_TCUUYHZCYCPJYCDZ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_2304062024138452836.dll

Filesize
4.6MB

MD5
4fa000d2daf4a9a8b30a36de57343e8b

SHA1
4865161c5ec70cce04079a6cbf08795e05bacbf1

SHA256
50df18de18d3cdd5cc21f8fc0dbabbe5a60690027b82af25806f679f492065de

SHA512
a52620ab7ae4e8a6c7379790fc70c5cc611a06432b83ded0a7ea476a647098fcb18797b42ed98293c3e9dd955d784819638597e3b1b419f54eeb9a0084b625ca

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_2304062024146553960.dll

Filesize
4.6MB

MD5
4fa000d2daf4a9a8b30a36de57343e8b

SHA1
4865161c5ec70cce04079a6cbf08795e05bacbf1

SHA256
50df18de18d3cdd5cc21f8fc0dbabbe5a60690027b82af25806f679f492065de

SHA512
a52620ab7ae4e8a6c7379790fc70c5cc611a06432b83ded0a7ea476a647098fcb18797b42ed98293c3e9dd955d784819638597e3b1b419f54eeb9a0084b625ca

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

Filesize
1.7MB

MD5
1bbf5dd0b6ca80e4c7c77495c3f33083

SHA1
e0520037e60eb641ec04d1e814394c9da0a6a862

SHA256
bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

SHA512
97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

Filesize
97KB

MD5
da1d0cd400e0b6ad6415fd4d90f69666

SHA1
de9083d2902906cacf57259cf581b1466400b799

SHA256
7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

SHA512
f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
f8da4bc14cb40b7ff8cd2c798ca0f7b9

SHA1
1264c77f79f7a328d60dfd752e721a463fc3e247

SHA256
3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1

SHA512
0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
f8da4bc14cb40b7ff8cd2c798ca0f7b9

SHA1
1264c77f79f7a328d60dfd752e721a463fc3e247

SHA256
3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1

SHA512
0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
f8da4bc14cb40b7ff8cd2c798ca0f7b9

SHA1
1264c77f79f7a328d60dfd752e721a463fc3e247

SHA256
3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1

SHA512
0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
f8da4bc14cb40b7ff8cd2c798ca0f7b9

SHA1
1264c77f79f7a328d60dfd752e721a463fc3e247

SHA256
3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1

SHA512
0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
f8da4bc14cb40b7ff8cd2c798ca0f7b9

SHA1
1264c77f79f7a328d60dfd752e721a463fc3e247

SHA256
3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1

SHA512
0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
018c68cdf5ba005b4a380c20b13fee4c

SHA1
bf6043fbd31288e8667fcfc37cd74414bee1805f

SHA256
3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

SHA512
506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
018c68cdf5ba005b4a380c20b13fee4c

SHA1
bf6043fbd31288e8667fcfc37cd74414bee1805f

SHA256
3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

SHA512
506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
018c68cdf5ba005b4a380c20b13fee4c

SHA1
bf6043fbd31288e8667fcfc37cd74414bee1805f

SHA256
3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

SHA512
506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
018c68cdf5ba005b4a380c20b13fee4c

SHA1
bf6043fbd31288e8667fcfc37cd74414bee1805f

SHA256
3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

SHA512
506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
018c68cdf5ba005b4a380c20b13fee4c

SHA1
bf6043fbd31288e8667fcfc37cd74414bee1805f

SHA256
3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

SHA512
506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
0a878fdd559b6c43d59bee6c143b1a1d

SHA1
3c9994c09fd42e17953aeb8040b4610bbf8b2706

SHA256
5cbcfa9715671c6bf2264f2d1efb9b70172c5da769a674bb3b93407dbc180fd9

SHA512
02d1ed8e75d1ede1b7fae1c17ad5d9e31950eb60017a9ecc2db8ede8907e9ca7d977339e98f6d0f4e459d33caea88afa5c4a34092fe9df7282cbd0eb8fcdf077

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
0a878fdd559b6c43d59bee6c143b1a1d

SHA1
3c9994c09fd42e17953aeb8040b4610bbf8b2706

SHA256
5cbcfa9715671c6bf2264f2d1efb9b70172c5da769a674bb3b93407dbc180fd9

SHA512
02d1ed8e75d1ede1b7fae1c17ad5d9e31950eb60017a9ecc2db8ede8907e9ca7d977339e98f6d0f4e459d33caea88afa5c4a34092fe9df7282cbd0eb8fcdf077

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
0a878fdd559b6c43d59bee6c143b1a1d

SHA1
3c9994c09fd42e17953aeb8040b4610bbf8b2706

SHA256
5cbcfa9715671c6bf2264f2d1efb9b70172c5da769a674bb3b93407dbc180fd9

SHA512
02d1ed8e75d1ede1b7fae1c17ad5d9e31950eb60017a9ecc2db8ede8907e9ca7d977339e98f6d0f4e459d33caea88afa5c4a34092fe9df7282cbd0eb8fcdf077

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
0a878fdd559b6c43d59bee6c143b1a1d

SHA1
3c9994c09fd42e17953aeb8040b4610bbf8b2706

SHA256
5cbcfa9715671c6bf2264f2d1efb9b70172c5da769a674bb3b93407dbc180fd9

SHA512
02d1ed8e75d1ede1b7fae1c17ad5d9e31950eb60017a9ecc2db8ede8907e9ca7d977339e98f6d0f4e459d33caea88afa5c4a34092fe9df7282cbd0eb8fcdf077

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
0a878fdd559b6c43d59bee6c143b1a1d

SHA1
3c9994c09fd42e17953aeb8040b4610bbf8b2706

SHA256
5cbcfa9715671c6bf2264f2d1efb9b70172c5da769a674bb3b93407dbc180fd9

SHA512
02d1ed8e75d1ede1b7fae1c17ad5d9e31950eb60017a9ecc2db8ede8907e9ca7d977339e98f6d0f4e459d33caea88afa5c4a34092fe9df7282cbd0eb8fcdf077

Download Submit
\Users\Admin\Downloads\TLauncher-2.879-Installer-1.1.0.exe

Filesize
22.6MB

MD5
601b94e3b018e39e0da90881fe89156d

SHA1
dc5340d6e1cb98c6ae2fa6882a4c7284e990705b

SHA256
845b0953c143daf9382b38c8ac7faeef62d5298bb0191f1be60865f78a942bac

SHA512
493c283aa3e201501843e59d593d82b3c98d2628639c95c977c9f22c268d89f7b072907d7b5d244fb7f122348277a97f7d68ce0ebdb36d7fc479c5f3c5bd33db

Download Submit
\Users\Admin\Downloads\TLauncher-2.879-Installer-1.1.0.exe

Filesize
22.6MB

MD5
601b94e3b018e39e0da90881fe89156d

SHA1
dc5340d6e1cb98c6ae2fa6882a4c7284e990705b

SHA256
845b0953c143daf9382b38c8ac7faeef62d5298bb0191f1be60865f78a942bac

SHA512
493c283aa3e201501843e59d593d82b3c98d2628639c95c977c9f22c268d89f7b072907d7b5d244fb7f122348277a97f7d68ce0ebdb36d7fc479c5f3c5bd33db

Download Submit
memory/1864-999-0x0000000003000000-0x00000000033E8000-memory.dmp

Filesize
3.9MB

Download
memory/1864-998-0x0000000003000000-0x00000000033E8000-memory.dmp

Filesize
3.9MB

Download
memory/2080-2383-0x00000000011B0000-0x00000000016E8000-memory.dmp

Filesize
5.2MB

Download
memory/2080-2387-0x0000000002BF0000-0x0000000003128000-memory.dmp

Filesize
5.2MB

Download
memory/2080-2547-0x0000000002BF0000-0x0000000003128000-memory.dmp

Filesize
5.2MB

Download
memory/2252-2388-0x00000000011B0000-0x00000000016E8000-memory.dmp

Filesize
5.2MB

Download
memory/2764-3052-0x0000000000230000-0x0000000000247000-memory.dmp

Filesize
92KB

Download
memory/2764-3069-0x0000000000230000-0x0000000000247000-memory.dmp

Filesize
92KB

Download
memory/2764-3067-0x0000000000230000-0x0000000000247000-memory.dmp

Filesize
92KB

Download
memory/2764-3066-0x0000000000230000-0x0000000000247000-memory.dmp

Filesize
92KB

Download
memory/2764-3065-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2764-3053-0x0000000000230000-0x0000000000247000-memory.dmp

Filesize
92KB

Download
memory/2764-3050-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2764-3051-0x0000000000230000-0x0000000000247000-memory.dmp

Filesize
92KB

Download
memory/2764-3072-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2836-2545-0x0000000003380000-0x00000000038B8000-memory.dmp

Filesize
5.2MB

Download
memory/2836-2382-0x0000000003EC0000-0x00000000043F8000-memory.dmp

Filesize
5.2MB

Download
memory/2836-2546-0x0000000003EC0000-0x00000000043F8000-memory.dmp

Filesize
5.2MB

Download
memory/2836-2381-0x0000000003380000-0x00000000038B8000-memory.dmp

Filesize
5.2MB

Download
memory/2836-2378-0x0000000002AF0000-0x0000000003028000-memory.dmp

Filesize
5.2MB

Download
memory/2836-2149-0x00000000011B0000-0x00000000016E8000-memory.dmp

Filesize
5.2MB

Download
memory/2836-2536-0x0000000002AF0000-0x0000000003028000-memory.dmp

Filesize
5.2MB

Download
memory/2976-1464-0x0000000002C20000-0x0000000003008000-memory.dmp

Filesize
3.9MB

Download
memory/2976-1463-0x0000000002C20000-0x0000000003008000-memory.dmp

Filesize
3.9MB

Download
memory/2984-1360-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2984-1453-0x00000000032B0000-0x00000000032C0000-memory.dmp

Filesize
64KB

Download
memory/2984-1032-0x0000000001230000-0x0000000001618000-memory.dmp

Filesize
3.9MB

Download
memory/2984-2487-0x0000000001230000-0x0000000001618000-memory.dmp

Filesize
3.9MB

Download
memory/2984-1298-0x0000000000C50000-0x0000000000C53000-memory.dmp

Filesize
12KB

Download
memory/2984-2488-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2984-2439-0x00000000032B0000-0x00000000032C0000-memory.dmp

Filesize
64KB

Download
memory/2984-2407-0x0000000001230000-0x0000000001618000-memory.dmp

Filesize
3.9MB

Download
memory/2984-2408-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2984-1297-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2984-1319-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2984-1318-0x0000000001230000-0x0000000001618000-memory.dmp

Filesize
3.9MB

Download
memory/2984-1352-0x0000000001230000-0x0000000001618000-memory.dmp

Filesize
3.9MB

Download
memory/2984-1359-0x0000000001230000-0x0000000001618000-memory.dmp

Filesize
3.9MB

Download
memory/2984-2703-0x0000000001230000-0x0000000001618000-memory.dmp

Filesize
3.9MB

Download
memory/2984-1482-0x0000000001230000-0x0000000001618000-memory.dmp

Filesize
3.9MB

Download
memory/2984-1485-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/3012-1953-0x0000000005760000-0x0000000005C98000-memory.dmp

Filesize
5.2MB

Download
memory/3012-1465-0x0000000000D40000-0x0000000001128000-memory.dmp

Filesize
3.9MB

Download
memory/3012-1997-0x0000000005760000-0x0000000005C98000-memory.dmp

Filesize
5.2MB

Download
memory/3012-2096-0x0000000005760000-0x0000000005C98000-memory.dmp

Filesize
5.2MB

Download
memory/3012-1867-0x0000000002830000-0x0000000002840000-memory.dmp

Filesize
64KB

Download
memory/3012-2402-0x0000000000D40000-0x0000000001128000-memory.dmp

Filesize
3.9MB

Download
memory/3012-2489-0x0000000002830000-0x0000000002840000-memory.dmp

Filesize
64KB

Download
memory/3012-2633-0x0000000000D40000-0x0000000001128000-memory.dmp

Filesize
3.9MB

Download
memory/3436-2336-0x00000000013D0000-0x0000000001908000-memory.dmp

Filesize
5.2MB

Download
memory/3960-2174-0x00000000011B0000-0x00000000016E8000-memory.dmp

Filesize
5.2MB

Download