bazarbackdoor | 845b0953c143daf9382b38c8ac7faeef62d5298bb0191f1be60865f78a942bac

Analysis

max time kernel
48s
max time network
154s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09-04-2023 14:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TLauncher-2.879-Installer-1.1.0.exe
Size

22.6MB
MD5

601b94e3b018e39e0da90881fe89156d
SHA1

dc5340d6e1cb98c6ae2fa6882a4c7284e990705b
SHA256

845b0953c143daf9382b38c8ac7faeef62d5298bb0191f1be60865f78a942bac
SHA512

493c283aa3e201501843e59d593d82b3c98d2628639c95c977c9f22c268d89f7b072907d7b5d244fb7f122348277a97f7d68ce0ebdb36d7fc479c5f3c5bd33db
SSDEEP

393216:+Xj4yibrRbGPfs/dQETVlOBbpFEjdGphRqV56Hpkf+V4scTKAjENq+:+zCrRsHExi73qqHpg+Vvc+AmX

Score

10^/10

bazarbackdoor backdoor discovery upx

Malware Config

Signatures

BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
backdoor bazarbackdoor

Bazar/Team9 Backdoor payload 1 IoCs

Processes:

resource	yara_rule
C:\Windows\Installer\6e0f4d.msi	BazarBackdoorVar3

Downloads MZ/PE file
Executes dropped EXE 4 IoCs

Processes:

irsetup.exeBrowserInstaller.exeirsetup.exeopera-installer-bro.exe

pid process

1096 irsetup.exe
3028 BrowserInstaller.exe
2320 irsetup.exe
2564 opera-installer-bro.exe

pid	process
1096	irsetup.exe
3028	BrowserInstaller.exe
2320	irsetup.exe
2564	opera-installer-bro.exe

Loads dropped DLL 24 IoCs

Processes:

TLauncher-2.879-Installer-1.1.0.exeirsetup.exeBrowserInstaller.exeirsetup.exe

pid	process
2024	TLauncher-2.879-Installer-1.1.0.exe
2024	TLauncher-2.879-Installer-1.1.0.exe
2024	TLauncher-2.879-Installer-1.1.0.exe
2024	TLauncher-2.879-Installer-1.1.0.exe
1096	irsetup.exe
1096	irsetup.exe
1096	irsetup.exe
1096	irsetup.exe
1096	irsetup.exe
1096	irsetup.exe
1096	irsetup.exe
1096	irsetup.exe
3028	BrowserInstaller.exe
3028	BrowserInstaller.exe
3028	BrowserInstaller.exe
3028	BrowserInstaller.exe
2320	irsetup.exe
2320	irsetup.exe
2320	irsetup.exe
2320	irsetup.exe
2320	irsetup.exe
2320	irsetup.exe
2320	irsetup.exe
2320	irsetup.exe

UPX packed file 48 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
behavioral1/memory/1096-364-0x0000000001140000-0x0000000001528000-memory.dmp	upx
behavioral1/memory/1096-367-0x0000000001140000-0x0000000001528000-memory.dmp	upx
behavioral1/memory/1096-410-0x0000000001140000-0x0000000001528000-memory.dmp	upx
behavioral1/memory/1096-449-0x0000000001140000-0x0000000001528000-memory.dmp	upx
behavioral1/memory/1096-489-0x0000000001140000-0x0000000001528000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
behavioral1/memory/2320-610-0x0000000000230000-0x0000000000618000-memory.dmp	upx
behavioral1/memory/2564-625-0x0000000000E70000-0x00000000013A8000-memory.dmp	upx
behavioral1/memory/2600-627-0x0000000000E70000-0x00000000013A8000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe	upx
behavioral1/memory/1096-677-0x0000000001140000-0x0000000001528000-memory.dmp	upx
behavioral1/memory/2316-676-0x0000000000940000-0x0000000000E78000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
behavioral1/memory/2528-1438-0x0000000000E70000-0x00000000013A8000-memory.dmp	upx
behavioral1/memory/680-1420-0x0000000000E70000-0x00000000013A8000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe	upx
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe	upx
behavioral1/memory/1096-1500-0x0000000001140000-0x0000000001528000-memory.dmp	upx
behavioral1/memory/1096-1733-0x0000000001140000-0x0000000001528000-memory.dmp	upx
behavioral1/memory/1096-1751-0x0000000001140000-0x0000000001528000-memory.dmp	upx
behavioral1/memory/1096-1782-0x0000000001140000-0x0000000001528000-memory.dmp	upx
behavioral1/memory/1096-1935-0x0000000001140000-0x0000000001528000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

irsetup.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main irsetup.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main	irsetup.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

irsetup.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	irsetup.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

1480 chrome.exe
1480 chrome.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exe

pid	process
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exe

pid	process
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

irsetup.exeirsetup.exe

pid process

1096 irsetup.exe
1096 irsetup.exe
1096 irsetup.exe
1096 irsetup.exe
1096 irsetup.exe
1096 irsetup.exe
2320 irsetup.exe
2320 irsetup.exe

pid	process
1096	irsetup.exe
1096	irsetup.exe
1096	irsetup.exe
1096	irsetup.exe
1096	irsetup.exe
1096	irsetup.exe
2320	irsetup.exe
2320	irsetup.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

TLauncher-2.879-Installer-1.1.0.exechrome.exe

description	pid	process	target process
PID 2024 wrote to memory of 1096	2024	TLauncher-2.879-Installer-1.1.0.exe	irsetup.exe
PID 2024 wrote to memory of 1096	2024	TLauncher-2.879-Installer-1.1.0.exe	irsetup.exe
PID 2024 wrote to memory of 1096	2024	TLauncher-2.879-Installer-1.1.0.exe	irsetup.exe
PID 2024 wrote to memory of 1096	2024	TLauncher-2.879-Installer-1.1.0.exe	irsetup.exe
PID 2024 wrote to memory of 1096	2024	TLauncher-2.879-Installer-1.1.0.exe	irsetup.exe
PID 2024 wrote to memory of 1096	2024	TLauncher-2.879-Installer-1.1.0.exe	irsetup.exe
PID 2024 wrote to memory of 1096	2024	TLauncher-2.879-Installer-1.1.0.exe	irsetup.exe
PID 1480 wrote to memory of 604	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 604	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 604	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 1048	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 2028	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 2028	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 2028	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 632	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 632	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 632	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 632	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 632	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 632	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 632	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 632	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 632	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 632	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 632	1480	chrome.exe	chrome.exe
PID 1480 wrote to memory of 632	1480	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.0.exe
"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.0.exe" "__IRCT:3" "__IRTSS:23652861" "__IRSID:S-1-5-21-1283023626-844874658-3193756055-1000"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1096
- - C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816850 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:1841947" "__IRSID:S-1-5-21-1283023626-844874658-3193756055-1000"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies system certificate store
      Suspicious use of SetWindowsHookEx
      PID:2320
    - - C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
        
        "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0
        5⤵
        Executes dropped EXE
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
        
        C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=97.0.4719.63 --initial-client-data=0x1a4,0x1a8,0x1ac,0x178,0x1b0,0x70dd33e0,0x70dd33f0,0x70dd33fc
        6⤵
        
        PID:2600
      - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe" --version
        6⤵
        
        PID:2316
      - C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
        
        "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=2564 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20230409160835" --session-guid=c83637e9-9d3d-4528-9dc8-c58207dd382a --server-tracking-blob=ZjA0ZDcxMDZhMGNmYWMwZDBiZWU1MDBmMTA2NmQ2MDJlYzUyMDdjYmM2Yzk0NmU3ZTc0ODhmZTE1OWY4MTk5MDp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjciLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNjgxMDQ5MzEzLjE4MDIiLCJ1c2VyYWdlbnQiOiJTZXR1cCBGYWN0b3J5IDkuMCIsInV0bSI6eyJjYW1wYWlnbiI6Ik9wZXJhRGVza3RvcCIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Ik1TVEwifSwidXVpZCI6IjhhMjNlNTFlLWZmNDUtNDM3Ny1hZDE0LWVjNzE2ZjVlYWE2NCJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=2403000000000000
        6⤵
        
        PID:680
        
        C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
        
        C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=97.0.4719.63 --initial-client-data=0x1b0,0x1b4,0x1b8,0x178,0x1bc,0x702b33e0,0x702b33f0,0x702b33fc
        7⤵
        
        PID:2528
      - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304091608351\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304091608351\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe"
        6⤵
        
        PID:1812
      - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304091608351\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304091608351\assistant\assistant_installer.exe" --version
        6⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304091608351\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304091608351\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=96.0.4693.50 --initial-client-data=0x148,0x14c,0x150,0x11c,0x154,0x12a6c28,0x12a6c38,0x12a6c44
        7⤵
        
        PID:3116
- - C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
    "C:\Users\Admin\AppData\Local\Temp\jre-windows.exe" STATIC=1
    3⤵
    PID:3484
  - - C:\Users\Admin\AppData\Local\Temp\jds7176342.tmp\jre-windows.exe
      "C:\Users\Admin\AppData\Local\Temp\jds7176342.tmp\jre-windows.exe" "STATIC=1"
      4⤵
      PID:2464

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6669758,0x7fef6669768,0x7fef6669778
  2⤵
  PID:604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1200 --field-trial-handle=1272,i,2526360252736443570,14567837532374577581,131072 /prefetch:2
  2⤵
  PID:1048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1532 --field-trial-handle=1272,i,2526360252736443570,14567837532374577581,131072 /prefetch:8
  2⤵
  PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1608 --field-trial-handle=1272,i,2526360252736443570,14567837532374577581,131072 /prefetch:8
  2⤵
  PID:632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2224 --field-trial-handle=1272,i,2526360252736443570,14567837532374577581,131072 /prefetch:1
  2⤵
  PID:560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2348 --field-trial-handle=1272,i,2526360252736443570,14567837532374577581,131072 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1456 --field-trial-handle=1272,i,2526360252736443570,14567837532374577581,131072 /prefetch:2
  2⤵
  PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3648 --field-trial-handle=1272,i,2526360252736443570,14567837532374577581,131072 /prefetch:2
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=2504 --field-trial-handle=1272,i,2526360252736443570,14567837532374577581,131072 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3844 --field-trial-handle=1272,i,2526360252736443570,14567837532374577581,131072 /prefetch:8
  2⤵
  PID:2840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3952 --field-trial-handle=1272,i,2526360252736443570,14567837532374577581,131072 /prefetch:8
  2⤵
  PID:2868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=584 --field-trial-handle=1272,i,2526360252736443570,14567837532374577581,131072 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=1128 --field-trial-handle=1272,i,2526360252736443570,14567837532374577581,131072 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3796 --field-trial-handle=1272,i,2526360252736443570,14567837532374577581,131072 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2584 --field-trial-handle=1272,i,2526360252736443570,14567837532374577581,131072 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2252 --field-trial-handle=1272,i,2526360252736443570,14567837532374577581,131072 /prefetch:8
  2⤵
  PID:3660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2372 --field-trial-handle=1272,i,2526360252736443570,14567837532374577581,131072 /prefetch:8
  2⤵
  PID:3768

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2092

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x55c
1⤵
PID:3748

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:2160
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 4DCF968581D4C9A8B2ADB6B28978AD1B
  2⤵
  PID:1692
- C:\Program Files\Java\jre1.8.0_351\installer.exe
  "C:\Program Files\Java\jre1.8.0_351\installer.exe" /s INSTALLDIR="C:\Program Files\Java\jre1.8.0_351\\" STATIC=1 INSTALL_SILENT=1 REPAIRMODE=0 ProductCode={26A24AE4-039D-4CA4-87B4-2F64180351F0}
  2⤵
  PID:3676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

Filesize
471B

MD5
f4ce1cd74547c6a1d0ec3dc2bbe51aec

SHA1
a1bd28f325c8f05b0005fa5e3f4ba2370db967d2

SHA256
44b430c052fc92fe5f9161ff41b96091fe806c3276f44ee74757953d89c9ac38

SHA512
8bf1eb4391df0e8e1f678a14428a19a3eae58b87ff02e125cff174e9ff1cd9e78f3f15b703890e8ee3526c29995cd2d6d9a7671164be9cd044665b71a7653cbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a194faa04a1f7ca81234049c3d5f1e1d

SHA1
dffaced539a9a174877bbbb32b1b8bb12ac63ea1

SHA256
2c03800e4d93d67f0f56a325e83ac91e9005706c207fcdfb5a9f3f3c6e4d01a3

SHA512
3f58d140eaaa95261997fd99429e43d5b04fb4dd022256d09c93c887d97faf3acfda6e4401722bcf556705cd12b6b32b6dd2bc1b68a35ea85c69d7439bdea507

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ddfe4119425fb309e9b166d9db01086

SHA1
f63effb536386b67ea3323bdd17782148fdc7263

SHA256
a1ed52cf345f679791f5c6037487f2f49c8ba61e160cbe9a923109d29987b9da

SHA512
75b8f8a3da8510055e29222001a7b4046c2f1bb79de65b8cce00adb095b878dea15ea4169d7700742642a9e02548c1da424cb0553d83827c87f40a8d715ce09b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

Filesize
404B

MD5
e872ae4f19b7d528bd7eea4d96ae77fa

SHA1
c5dd9ff18cec76d71950da578b98751fd4eb4bf1

SHA256
ab9d7b86443595d3d8b5ea14fc81dcd5d9045d594c8d8daa249a1abb2cff6619

SHA512
6424b61af1d4d97733f79edf6d8b400592070a1568306a648b9bc6bad6bbe998a0e0bcae256288664ffdd78e58600ed21b2f5dfac34a4477e7114d82afa6c031

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\37878722-6787-4d89-8b4f-a68663ab380b.tmp

Filesize
4KB

MD5
4074eb4119fdb98b8dcbcef50a8d1544

SHA1
176fdef0e0f44a1c462f2ac6a1e492e8e881fff9

SHA256
486c3ad769fcae1f8921c36b7ed23633e76da0d196215358ac6f50061000ee24

SHA512
2f73dc0afa1086cf5176c37bfbff980862ca19a8962727a6f2b451c1ff3a067d5b4816f6e25b66d9d7e0488ab3471165af8070bdabc6ae75b7f886505116a01f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT~RF6db175.TMP

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
9b8c4edc7b0ad0512e6cf8c7af8f866d

SHA1
ba7749b87b39f49057a473a121f49be35c0d4a71

SHA256
fe356862916fef23de01969914c5c5595cd9cc54e3c63bc93e3eb49f768ce511

SHA512
cf7496976c36fe6bf8f86d309bc0756e2bb03a5ad2d006a2405182367bc57042e56eecad2c3d5de7581bfd3796f842c96a5db3cbfff369b5e9576a8d9cd2bd24

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
b6ee3a905330c07db60f69aea9499215

SHA1
68821b31275c9ffeff3750df92bd8a0834e04dcc

SHA256
16998a774d7984bd0091b23362f2bd7cd35d520057b95809b6a57a4afa2b3f64

SHA512
3abb8f4ab01a2d28071fb99fd47599aa002520512746878cc3d2017299081d49c3d8de08d34fdb4af6ccbc7c54c2212ed804d29b51f1cefd53435fcbcf03a74d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
a986199a6e58ccad97f4229030c6083a

SHA1
227dca21525814ba3d4b44fa2819fbd81704d656

SHA256
7d4751add4e47f180fc1eaed6470c0e7fde6ac0f3b7dc7ebe826f2acfaa6f825

SHA512
50a40a4036effbec87f2ac86a51db31073afda580080baa9d9ffd47d8bd6b90550cdf8be7a15f31d0c2ea1af53fbdb9d4a03f99b6cdaac319dbb1cb87dc710af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
50378b0a5d6191ed08bc4d522210527d

SHA1
b708d06e305895b2a9dc2206f261d533c873416a

SHA256
2f1de3a5adca09fa47acaa4a94409eda74dccce74e1e9167f157a4be10d6343e

SHA512
0e7e7a561a96ad5198c9180b53b6d628cc4d8c829cf94305f75aa7b6b77ed7f61426907d3b17facc20f2c9fda5ded169d918f3bd3c4220a520058a11ef344c66

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
129B

MD5
cfe581cf13c4e572ba88ae5c01042b95

SHA1
d38d6bf71e57c4dcf2bcfdba49532c7d95f77ec0

SHA256
2555fa8efaf255c13f073de0af74e7d38d4b7f798e21a10b4429cf43bb35fc06

SHA512
753eca5e362f22e90623689f4d270c95812e79d242cfe58bca08172cfa8dc4d20894026112f970f2d1e415bf9fc54633e02d9c111c8bc4d26b72094aab6cb2dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
56B

MD5
ae1bccd6831ebfe5ad03b482ee266e4f

SHA1
01f4179f48f1af383b275d7ee338dd160b6f558a

SHA256
1b11047e738f76c94c9d15ee981ec46b286a54def1a7852ca1ade7f908988649

SHA512
baf7ff6747f30e542c254f46a9678b9dbf42312933962c391b79eca6fcb615e4ba9283c00f554d6021e594f18c087899bc9b5362c41c0d6f862bba7fb9f83038

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
3617161af35ef9d7bd6173b95bec65ef

SHA1
dff674734ccede53efc0fb127cc35f87cd9af689

SHA256
1255d14bc9a60d9f7f05c704cff463e85e20589e4e1f2dea6490a88e70ff9454

SHA512
5c493d158647a882681729d19d5c31f8a4681a9164f2a0edf716b69b5d73a4dfb16d4f6fee86af531658a51f978b26665db67d7f7d0c22b335206c23fea6c875

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304091608351\additional_file0.tmp

Filesize
1.7MB

MD5
b386cdcb413405daa8219af8e4cbd318

SHA1
ce275ff8514fef0629c915a6ee7b5ac481b9043d

SHA256
408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e

SHA512
91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304091608351\opera_package

Filesize
86.9MB

MD5
6b7771354e081eb94cdbf7627799da4f

SHA1
199341a750443cc6e9b2b2fa1e657d0dd327711f

SHA256
494d1247e61eebf703a6eb19c14bde88edd2f85515fefa4f0465f43873e69aab

SHA512
33e781a102ba3f5c3b1895540bc9c43b78bf4f19af4b91ae0c765594f39d6569d1bad207b33f808426d8ebdcb00c419b7bb76bb050bae0bb843f96dd84355800

Download Submit
C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDEAD.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2304091608350952316.dll

Filesize
4.6MB

MD5
4fa000d2daf4a9a8b30a36de57343e8b

SHA1
4865161c5ec70cce04079a6cbf08795e05bacbf1

SHA256
50df18de18d3cdd5cc21f8fc0dbabbe5a60690027b82af25806f679f492065de

SHA512
a52620ab7ae4e8a6c7379790fc70c5cc611a06432b83ded0a7ea476a647098fcb18797b42ed98293c3e9dd955d784819638597e3b1b419f54eeb9a0084b625ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1B6F.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDEAE.tmp

Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico

Filesize
116KB

MD5
e043a9cb014d641a56f50f9d9ac9a1b9

SHA1
61dc6aed3d0d1f3b8afe3d161410848c565247ed

SHA256
9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946

SHA512
4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe

Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.PNG

Filesize
339B

MD5
a45137507477ea159a4c0481fadbdde8

SHA1
772e535525cd41abb781167334f923f1127f6d24

SHA256
fcc6693f94f87dbb9f03bd664f029db87257c79ac9a974d2caadc790f20ea67a

SHA512
393a8d9387b388524fbf7bc8387d521c830e7d384aabe278251cb4fa1291d32e2875c464a01f93670259bc2009d69507b632a692d43244f3eb7551414c9d635a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG104.PNG

Filesize
644B

MD5
f54bbaadafacf2ed607c2b44e76bd5f2

SHA1
e6e313e86b0adb771643dc9aa465652646d83329

SHA256
2dcd3efb7e14a1439973b066c810eb3187cb851a7d01b2a03376d978b6b0d927

SHA512
1d7f940d290c3c7eca12739f7e4753901a1d070ca9f43171b4fe25530ba48b3b376c16b125a32d6e701d63d576ef829824472bcac99e568784543bfc4c50b732

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG106.PNG

Filesize
1KB

MD5
f785bd0f38d4132c404ab3233bb1766b

SHA1
7c8f01921d026646289d92d4e08529482f2dd881

SHA256
4ddf6c789a700dbbca5c405f6b9625e2dee8d6e279f8629eb1e451e5040fbd0e

SHA512
45f806a91993918177e838ac21bf59f37e2000aeefa191d0b538e156165eac82309cc0c67b5379bdaa7f7bbbc97ae25ffd741a6c35c07377a893721442811573

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG109.PNG

Filesize
2KB

MD5
c70b569d43f5e00ee3dd81530899f191

SHA1
38b7f73c29d9d355625bf7dcc611d657c263dbc4

SHA256
778c8b5a8e7422ce84f4113fc1cbd90204f3b3c0b3bb8545b3fe68003525e9e8

SHA512
f0aafa93ffd1edb8764f7e435fa982b0eb596b1962472dcefac26731382c58d44306e876f04675146595a1e7ee6ae8170e2fa01ed0fca075e36a9749709f4df7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.PNG

Filesize
280B

MD5
01e097a324673878a3cb5e8e0f3cf152

SHA1
35ef5c438eca9672c7ee19bcde3952f83dc77928

SHA256
d8d0719a20d267a73d298d2ec1fbc050fe2ce25447c7441058ea3966acfbbb22

SHA512
e873763e96b3a52fe73f3fc9b3bcfd764c807c0206b5984d5f7dddd7debec4e6f0b6705ca6a7c6379b83c2fea792d7a16880ea109469ac1af41cc7bdb5f96e27

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG22.PNG

Filesize
1KB

MD5
362d3183b2acc152c99ec123611f3297

SHA1
3db69a12917cb11a14fb9294d73c5409fe11a398

SHA256
8ae66727c5c92ca76a131aa104cc126858e8e3ed490ae08482109dfedd9a8cda

SHA512
2c7f40564479d1fe90cb59b4b413e8bf9a5bb7cd2f94193f8759e376549c0269afce030df7d306b4cd814f604ad460d744fb00d961f6d2608a4ecb6b186a4f1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.PNG

Filesize
281B

MD5
d88e18e2a020a756a8de999b76e7b1fd

SHA1
150f801600b9427039197847aaac784f8ba15258

SHA256
38b8f2202a5e48a8f528708922f504379896ef52b3882ce82efc3481c51804bb

SHA512
d048a569d155aa4636f25ed2963fd5e2234643735ad461df3ad3201cbe152b646c2893557a236fa9683aa3cb07351fa79b9e5788f631442e5142cab0bc98654a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG46.PNG

Filesize
206B

MD5
bc193c9f3fd0730341d2ba951f734652

SHA1
ebe3f410cf0bf5f30fe36b1c1df96fa27e73b01f

SHA256
e9137bc2fefbd9a3c4506708f283fe52c40b00b35c2677fc31e196b305b00e67

SHA512
355cb9a7ba6e2a77a51339bfa732537bc77d36da372fe926f1e4bf25de865b09c98122d9559f5ec234b41a83cb97de4fd49427a9476169653ac6058912261c1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG85.PNG

Filesize
43KB

MD5
16c0e37cb0c5540fd9f93a8d82d94e52

SHA1
52d5aabf804381b47d13a358d80256c4088eec21

SHA256
2b772e66ebc70c93deb0b9a9e054373ee33d9245809e16174b1f132f786a063f

SHA512
dd54308739f9621f5fe707c69f24657431fd58b46e357a79d25c3d8e96d3b2914ce19d94beeee0bbd32311737670f06b01c364f0c7d70625a4246da64c29b0af

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG86.PNG

Filesize
1KB

MD5
a7a8625948d61d814dbb29225e04f908

SHA1
16bc91a8bb3c22cf78447644a32010ad869eaf99

SHA256
61979f700f77d187c8647cba3bee95ca4a70e187bbb76323f4055385dd8879d5

SHA512
04b0bb58095a6e8f1d29203f21eee99fd837494b74736e91e5e304eb3dc3ccb32796b6959361ede965731b76607a53b0f9d211cb4b3d94b25ea34898e760d295

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

Filesize
1.7MB

MD5
1bbf5dd0b6ca80e4c7c77495c3f33083

SHA1
e0520037e60eb641ec04d1e814394c9da0a6a862

SHA256
bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

SHA512
97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

Filesize
97KB

MD5
da1d0cd400e0b6ad6415fd4d90f69666

SHA1
de9083d2902906cacf57259cf581b1466400b799

SHA256
7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

SHA512
f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
f8da4bc14cb40b7ff8cd2c798ca0f7b9

SHA1
1264c77f79f7a328d60dfd752e721a463fc3e247

SHA256
3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1

SHA512
0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
f8da4bc14cb40b7ff8cd2c798ca0f7b9

SHA1
1264c77f79f7a328d60dfd752e721a463fc3e247

SHA256
3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1

SHA512
0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
f8da4bc14cb40b7ff8cd2c798ca0f7b9

SHA1
1264c77f79f7a328d60dfd752e721a463fc3e247

SHA256
3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1

SHA512
0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat

Filesize
114KB

MD5
bd5626a0237933e0f1dccf10e7c9fbd6

SHA1
10c47d382d4f44d8d44efaa203501749e42c6d50

SHA256
7dfc1176d8a507135140b23a0c014093b7e2673f0f3e5727c3d85df4e7323762

SHA512
1fd864a5386580cf8bbafbacb12a043ef51948b729b9aedfe6dc81e6c2948a100526c7c600069f22454d550f7f736ad3045a930cc2ef97458dc1d6c782928087

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
018c68cdf5ba005b4a380c20b13fee4c

SHA1
bf6043fbd31288e8667fcfc37cd74414bee1805f

SHA256
3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

SHA512
506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
018c68cdf5ba005b4a380c20b13fee4c

SHA1
bf6043fbd31288e8667fcfc37cd74414bee1805f

SHA256
3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

SHA512
506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
018c68cdf5ba005b4a380c20b13fee4c

SHA1
bf6043fbd31288e8667fcfc37cd74414bee1805f

SHA256
3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

SHA512
506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jusched.log

Filesize
4KB

MD5
6446585249c8c70ca3be5c0836cd821c

SHA1
ccecb90745bd569fa90b968252219bd85a325d28

SHA256
334b799933822c08442ee7ba1ee2cdfef379b8ae0edfa1d625389ff629c69d19

SHA512
078279a9ac94a172ff874be6c55854a3387a0e18bcfb92cecf4b234bee5bb3f717d1920f9efe7f55159a7839c0e23a3bfefa56cbcd099d70e72aa6047cfdf002

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
3617161af35ef9d7bd6173b95bec65ef

SHA1
dff674734ccede53efc0fb127cc35f87cd9af689

SHA256
1255d14bc9a60d9f7f05c704cff463e85e20589e4e1f2dea6490a88e70ff9454

SHA512
5c493d158647a882681729d19d5c31f8a4681a9164f2a0edf716b69b5d73a4dfb16d4f6fee86af531658a51f978b26665db67d7f7d0c22b335206c23fea6c875

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
3617161af35ef9d7bd6173b95bec65ef

SHA1
dff674734ccede53efc0fb127cc35f87cd9af689

SHA256
1255d14bc9a60d9f7f05c704cff463e85e20589e4e1f2dea6490a88e70ff9454

SHA512
5c493d158647a882681729d19d5c31f8a4681a9164f2a0edf716b69b5d73a4dfb16d4f6fee86af531658a51f978b26665db67d7f7d0c22b335206c23fea6c875

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
3617161af35ef9d7bd6173b95bec65ef

SHA1
dff674734ccede53efc0fb127cc35f87cd9af689

SHA256
1255d14bc9a60d9f7f05c704cff463e85e20589e4e1f2dea6490a88e70ff9454

SHA512
5c493d158647a882681729d19d5c31f8a4681a9164f2a0edf716b69b5d73a4dfb16d4f6fee86af531658a51f978b26665db67d7f7d0c22b335206c23fea6c875

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
3617161af35ef9d7bd6173b95bec65ef

SHA1
dff674734ccede53efc0fb127cc35f87cd9af689

SHA256
1255d14bc9a60d9f7f05c704cff463e85e20589e4e1f2dea6490a88e70ff9454

SHA512
5c493d158647a882681729d19d5c31f8a4681a9164f2a0edf716b69b5d73a4dfb16d4f6fee86af531658a51f978b26665db67d7f7d0c22b335206c23fea6c875

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
3617161af35ef9d7bd6173b95bec65ef

SHA1
dff674734ccede53efc0fb127cc35f87cd9af689

SHA256
1255d14bc9a60d9f7f05c704cff463e85e20589e4e1f2dea6490a88e70ff9454

SHA512
5c493d158647a882681729d19d5c31f8a4681a9164f2a0edf716b69b5d73a4dfb16d4f6fee86af531658a51f978b26665db67d7f7d0c22b335206c23fea6c875

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
3617161af35ef9d7bd6173b95bec65ef

SHA1
dff674734ccede53efc0fb127cc35f87cd9af689

SHA256
1255d14bc9a60d9f7f05c704cff463e85e20589e4e1f2dea6490a88e70ff9454

SHA512
5c493d158647a882681729d19d5c31f8a4681a9164f2a0edf716b69b5d73a4dfb16d4f6fee86af531658a51f978b26665db67d7f7d0c22b335206c23fea6c875

Download Submit
C:\Users\Admin\AppData\Local\Temp\setuparguments.ini

Filesize
590B

MD5
2b79e7bdbba1c6f22e63c6092a096df4

SHA1
9988d39e13c762d66b12331f5d04f4b35e484f02

SHA256
0b231a74e9bd68cac5191b1ec2a25d6324301487be7ff34401d1e10181c63fc5

SHA512
cf32e990563ae8da6e2abd3bb714a6d101d26961a8a6d91e5af04e73b860f6f79808d8d608cc81ff1efe9772664795ebf1bcf9794e50eeefc3656209fdecb5bd

Download Submit
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

Filesize
6.3MB

MD5
545c62b3d98ee4cc02af837a72dd09c4

SHA1
54446a007fd9b7363d9415673b0ac0232d5d70d5

SHA256
738029a4f974128180fa2cd239e873b01e456e8bf53bfdbf34b8ba8b57897be4

SHA512
8bf9c754861ed267efd2055ac09b4ad44df61b989859fccd14190592dca1dab0fa8f57360209eaceabb5137f742c9cea73a1a985ab1955f87a6875d0be95fdcf

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.BMP

Filesize
451KB

MD5
0b445ace8798426e7185f52b7b7b6d1e

SHA1
7a77b46e0848cc9b32283ccb3f91a18c0934c079

SHA256
2bbf97ccba3f87d469eac909c4ce8a3f13ed29c8f31b611e7d5cf89a0619eda6

SHA512
51523d5b711481293305465a3a3c6a3a50dca984cdc8cca1f4c44f3c21bfa430cd9aac1a8782d9605e6954cbafb307beb6b1a52e9785de1bc3f71067d80c6b6e

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG23.PNG

Filesize
1KB

MD5
58c10711ee61290c5e53d6c235d14c7f

SHA1
6cd433f1d5224b7441efecfef8e0982bbda4415b

SHA256
2d8d51d2405fd3534f5fce5ffea5b9a100ce4aacf35caa7d165c7c6672949b35

SHA512
b895b6f07fefc06695cb521fa923534c8ef99312ab6c27295c86de29fc1bdb09e3ba17cd4aea75f8dd9cf7e1a3c4494a6ef960eadcb209eecb1b623d70c367f0

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNG

Filesize
45KB

MD5
32b9a83f00af4123b811eb6a85ee7971

SHA1
a1e6bdfe76e6103aca76bd21ce60c0b48e4de570

SHA256
a39a8cb1d54a2036257211b6364f84caf033fccf3394e9f890434563770e594d

SHA512
eb272c6dbaa3e59887cfdfd21dba5e2abc56a12beeda55ba091aa9b02da71af5ce11c0f7af4fb34f58da9836f91d787e26ab9f898b8669c861e9bacee973ca9f

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG42.PNG

Filesize
352B

MD5
034eab9a50571cbab86294322e639886

SHA1
cae94b8cfe3ecce8e750d6fd34d54e766ea607aa

SHA256
449d678cc9a235d42a5a2f4e685536d9af87c6b5fc022f28dba32b08b4e88ee1

SHA512
b364c0cbb38bfb35e3c2d29705df72a8ce7dc111f04ebc05eceec4294987f18200581a31b78a79b05da890b5358e5463d1640d2230a8af930804efa3d4da42b0

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG45.PNG

Filesize
438B

MD5
87221bf8c9222a1489e949e4266a2980

SHA1
60c9d850f696e56b53dc3f940f52463d228febf2

SHA256
8d6e1d814dd38525115ee5d77e2d2ae6df8be31562a3c6805012097d6625efc4

SHA512
fa7ba5edb212a0ad70de123b1eabebd8d4cf5e2e3f59841330923c91d6ce6d8a0bbbf0176a8215a183ea860ae5286a4205b73f70df4d032cfd6c03109d1e433c

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG48.PNG

Filesize
1KB

MD5
9eb36caea38bf80ed9fa40a3f67597b7

SHA1
3c23e2e30119f6dd321d34a82a339d52723bfacc

SHA256
6be2e43a38969226e1cbb00605cdac634d0de3e82ce605b08dcf1cf596f64370

SHA512
22b57fc57d45ec73865e5429210d6016d2bab0cd990877c8272b4fc6ded8effe3bfa0c9b0890d7b0de8296e6bc3c262f29637b8ce7840efba2f963e70a978e53

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG5.PNG

Filesize
1KB

MD5
23e26969753c07af68f232cdd684c003

SHA1
f14666db750cc2f89ccdd8852b4259fcfa663271

SHA256
17f138eea95423738d2c9b75834b607c671cb2ac4d71c9aecf100a8b847003d2

SHA512
7c57a6309da9ae381073e005d374b9c8a82c7b4e92322b91433009d41f8f34655ed9d45958ab1743023faa9e7aa0c82a05d9292b078efccb64c19992b7e4d4d2

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG66.PNG

Filesize
41KB

MD5
7aae2de61d5e6296c00fde67046dfaeb

SHA1
87a65e99d520045c39997b53c6a0aa08cec35e57

SHA256
07b11e82a30598438ac4221d6c8796739c42c2a596365464f257481a37fa00c6

SHA512
c5ebaf43ffc19a1a3b2f49e070ea1d5532ae433c3bcd02493e31bd3389b6c3edfb1e04373902fbd252eb7370612dd96c3d36eb3fac8240111f57020ab99fa882

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG67.PNG

Filesize
1KB

MD5
0bde2ca44cd4e4e31c5c0364c66eb57b

SHA1
8496e4a8dcea6e42af33b503dc200d4a1ef07101

SHA256
38031284395ba7a773a335a861536b487bbf60b81496424b8a9a8a6697a919de

SHA512
4e60f45022b0c6739db94097401f6046e5f95b26dca71e685db834338451b7ea0b3ed3afc128d564c3f79074905b7986714f75925c41f763eda6b901875af555

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

Filesize
33KB

MD5
2b6c09f59f11a052e1a826f0ad9212ec

SHA1
0747c091ca6841904a7049ffd6d1d1d76b792635

SHA256
08c27cbc512b897eaea4a218a46da2ea40bbec30b5f9b9857bcdcba4f9b23fe3

SHA512
aa78953d1488bf7e40b4935d9d8bf71d902f3463b8c086ca84c9772f29c38866f5cc91be5109d0505d6d878d68246960042976ff22c3c72810cf9ff646c1c3d0

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

Filesize
33KB

MD5
71ff25e27d25ecd5532271001f1add68

SHA1
dec1d09929573ae1127ba1dbdc33a24bd412feea

SHA256
c54b9e84f6529067ce41e07f835074be408f27d90e91b93f5f21320bc64cd5bf

SHA512
21fbd01814824a800166cb98f9d29b57e86f77558ea40cabdbfc254b5ff6139c53fdff20b3f4c64048c7584792c938ad3b4517057527880b8737c57d9fd39cd0

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

Filesize
40B

MD5
b9cbcd5972abee7566143dd9447f49bd

SHA1
f69711fc65b08f601809daf3754d889b71f4f4ce

SHA256
4557b09c2ddc651c292cd34831bf908b4d27073751c98f835bee5a87cc2ca2e1

SHA512
f76a0ee207b85fcbbc682f12d0fe561a5fb8dc47ff99dd30574fb0d8723be6ae378abb6510e1fa4be790b1df01d23f83823151668ecdc095cd59435ec76c34ee

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

Filesize
40B

MD5
b9cbcd5972abee7566143dd9447f49bd

SHA1
f69711fc65b08f601809daf3754d889b71f4f4ce

SHA256
4557b09c2ddc651c292cd34831bf908b4d27073751c98f835bee5a87cc2ca2e1

SHA512
f76a0ee207b85fcbbc682f12d0fe561a5fb8dc47ff99dd30574fb0d8723be6ae378abb6510e1fa4be790b1df01d23f83823151668ecdc095cd59435ec76c34ee

Download Submit
C:\Windows\Installer\6e0f4d.msi

Filesize
81.0MB

MD5
1794aaa17d114a315a95473c9780fc8b

SHA1
7f250c022b916b88e22254985e7552bc3ac8db04

SHA256
7682233d155e6d19f30cf61b185a02055be0dbcacd2c9accf90a99de21547eb4

SHA512
fb9defdf73786528e82ffc7e1ccfa03cfb687365ec740e9620993da785414306f03a7e1fa523192a9d690a882b012d1e426afd1757639f3ef5f1e612c01e6516

Download Submit
C:\Windows\Installer\MSI2256.tmp

Filesize
757KB

MD5
62cfeb86f117ad91b8bb52f1dda6f473

SHA1
c753b488938b3e08f7f47df209359c7b78764448

SHA256
f06cba20bd40e9d841add1877cf8d3b406f0acfa4800b80ae041ed3cc374eb7e

SHA512
c1b0e76cee4e2c3ca604dcc8f5665e72e70008acc824e20d89404f139d7e7e789e99dff131dafd76409f6ea0a813aa136f96089fbdadcf90d6485b1807762e4e

Download Submit
\??\pipe\crashpad_1480_SNGAFTCDSGBFFYLD

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
3617161af35ef9d7bd6173b95bec65ef

SHA1
dff674734ccede53efc0fb127cc35f87cd9af689

SHA256
1255d14bc9a60d9f7f05c704cff463e85e20589e4e1f2dea6490a88e70ff9454

SHA512
5c493d158647a882681729d19d5c31f8a4681a9164f2a0edf716b69b5d73a4dfb16d4f6fee86af531658a51f978b26665db67d7f7d0c22b335206c23fea6c875

Download Submit
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304091608351\opera_package

Filesize
86.9MB

MD5
6b7771354e081eb94cdbf7627799da4f

SHA1
199341a750443cc6e9b2b2fa1e657d0dd327711f

SHA256
494d1247e61eebf703a6eb19c14bde88edd2f85515fefa4f0465f43873e69aab

SHA512
33e781a102ba3f5c3b1895540bc9c43b78bf4f19af4b91ae0c765594f39d6569d1bad207b33f808426d8ebdcb00c419b7bb76bb050bae0bb843f96dd84355800

Download Submit
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304091608351\opera_package

Filesize
86.9MB

MD5
6b7771354e081eb94cdbf7627799da4f

SHA1
199341a750443cc6e9b2b2fa1e657d0dd327711f

SHA256
494d1247e61eebf703a6eb19c14bde88edd2f85515fefa4f0465f43873e69aab

SHA512
33e781a102ba3f5c3b1895540bc9c43b78bf4f19af4b91ae0c765594f39d6569d1bad207b33f808426d8ebdcb00c419b7bb76bb050bae0bb843f96dd84355800

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_2304091608316532564.dll

Filesize
4.6MB

MD5
4fa000d2daf4a9a8b30a36de57343e8b

SHA1
4865161c5ec70cce04079a6cbf08795e05bacbf1

SHA256
50df18de18d3cdd5cc21f8fc0dbabbe5a60690027b82af25806f679f492065de

SHA512
a52620ab7ae4e8a6c7379790fc70c5cc611a06432b83ded0a7ea476a647098fcb18797b42ed98293c3e9dd955d784819638597e3b1b419f54eeb9a0084b625ca

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_2304091608320692600.dll

Filesize
4.6MB

MD5
4fa000d2daf4a9a8b30a36de57343e8b

SHA1
4865161c5ec70cce04079a6cbf08795e05bacbf1

SHA256
50df18de18d3cdd5cc21f8fc0dbabbe5a60690027b82af25806f679f492065de

SHA512
a52620ab7ae4e8a6c7379790fc70c5cc611a06432b83ded0a7ea476a647098fcb18797b42ed98293c3e9dd955d784819638597e3b1b419f54eeb9a0084b625ca

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_2304091608350952316.dll

Filesize
4.6MB

MD5
4fa000d2daf4a9a8b30a36de57343e8b

SHA1
4865161c5ec70cce04079a6cbf08795e05bacbf1

SHA256
50df18de18d3cdd5cc21f8fc0dbabbe5a60690027b82af25806f679f492065de

SHA512
a52620ab7ae4e8a6c7379790fc70c5cc611a06432b83ded0a7ea476a647098fcb18797b42ed98293c3e9dd955d784819638597e3b1b419f54eeb9a0084b625ca

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_230409160835494680.dll

Filesize
4.6MB

MD5
4fa000d2daf4a9a8b30a36de57343e8b

SHA1
4865161c5ec70cce04079a6cbf08795e05bacbf1

SHA256
50df18de18d3cdd5cc21f8fc0dbabbe5a60690027b82af25806f679f492065de

SHA512
a52620ab7ae4e8a6c7379790fc70c5cc611a06432b83ded0a7ea476a647098fcb18797b42ed98293c3e9dd955d784819638597e3b1b419f54eeb9a0084b625ca

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_2304091608356532528.dll

Filesize
4.6MB

MD5
4fa000d2daf4a9a8b30a36de57343e8b

SHA1
4865161c5ec70cce04079a6cbf08795e05bacbf1

SHA256
50df18de18d3cdd5cc21f8fc0dbabbe5a60690027b82af25806f679f492065de

SHA512
a52620ab7ae4e8a6c7379790fc70c5cc611a06432b83ded0a7ea476a647098fcb18797b42ed98293c3e9dd955d784819638597e3b1b419f54eeb9a0084b625ca

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

Filesize
1.7MB

MD5
1bbf5dd0b6ca80e4c7c77495c3f33083

SHA1
e0520037e60eb641ec04d1e814394c9da0a6a862

SHA256
bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

SHA512
97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

Filesize
97KB

MD5
da1d0cd400e0b6ad6415fd4d90f69666

SHA1
de9083d2902906cacf57259cf581b1466400b799

SHA256
7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

SHA512
f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
f8da4bc14cb40b7ff8cd2c798ca0f7b9

SHA1
1264c77f79f7a328d60dfd752e721a463fc3e247

SHA256
3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1

SHA512
0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
f8da4bc14cb40b7ff8cd2c798ca0f7b9

SHA1
1264c77f79f7a328d60dfd752e721a463fc3e247

SHA256
3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1

SHA512
0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
f8da4bc14cb40b7ff8cd2c798ca0f7b9

SHA1
1264c77f79f7a328d60dfd752e721a463fc3e247

SHA256
3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1

SHA512
0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
f8da4bc14cb40b7ff8cd2c798ca0f7b9

SHA1
1264c77f79f7a328d60dfd752e721a463fc3e247

SHA256
3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1

SHA512
0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
f8da4bc14cb40b7ff8cd2c798ca0f7b9

SHA1
1264c77f79f7a328d60dfd752e721a463fc3e247

SHA256
3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1

SHA512
0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
018c68cdf5ba005b4a380c20b13fee4c

SHA1
bf6043fbd31288e8667fcfc37cd74414bee1805f

SHA256
3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

SHA512
506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
018c68cdf5ba005b4a380c20b13fee4c

SHA1
bf6043fbd31288e8667fcfc37cd74414bee1805f

SHA256
3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

SHA512
506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
018c68cdf5ba005b4a380c20b13fee4c

SHA1
bf6043fbd31288e8667fcfc37cd74414bee1805f

SHA256
3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

SHA512
506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
018c68cdf5ba005b4a380c20b13fee4c

SHA1
bf6043fbd31288e8667fcfc37cd74414bee1805f

SHA256
3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

SHA512
506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
018c68cdf5ba005b4a380c20b13fee4c

SHA1
bf6043fbd31288e8667fcfc37cd74414bee1805f

SHA256
3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

SHA512
506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
3617161af35ef9d7bd6173b95bec65ef

SHA1
dff674734ccede53efc0fb127cc35f87cd9af689

SHA256
1255d14bc9a60d9f7f05c704cff463e85e20589e4e1f2dea6490a88e70ff9454

SHA512
5c493d158647a882681729d19d5c31f8a4681a9164f2a0edf716b69b5d73a4dfb16d4f6fee86af531658a51f978b26665db67d7f7d0c22b335206c23fea6c875

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
3617161af35ef9d7bd6173b95bec65ef

SHA1
dff674734ccede53efc0fb127cc35f87cd9af689

SHA256
1255d14bc9a60d9f7f05c704cff463e85e20589e4e1f2dea6490a88e70ff9454

SHA512
5c493d158647a882681729d19d5c31f8a4681a9164f2a0edf716b69b5d73a4dfb16d4f6fee86af531658a51f978b26665db67d7f7d0c22b335206c23fea6c875

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
3617161af35ef9d7bd6173b95bec65ef

SHA1
dff674734ccede53efc0fb127cc35f87cd9af689

SHA256
1255d14bc9a60d9f7f05c704cff463e85e20589e4e1f2dea6490a88e70ff9454

SHA512
5c493d158647a882681729d19d5c31f8a4681a9164f2a0edf716b69b5d73a4dfb16d4f6fee86af531658a51f978b26665db67d7f7d0c22b335206c23fea6c875

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
3617161af35ef9d7bd6173b95bec65ef

SHA1
dff674734ccede53efc0fb127cc35f87cd9af689

SHA256
1255d14bc9a60d9f7f05c704cff463e85e20589e4e1f2dea6490a88e70ff9454

SHA512
5c493d158647a882681729d19d5c31f8a4681a9164f2a0edf716b69b5d73a4dfb16d4f6fee86af531658a51f978b26665db67d7f7d0c22b335206c23fea6c875

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
3617161af35ef9d7bd6173b95bec65ef

SHA1
dff674734ccede53efc0fb127cc35f87cd9af689

SHA256
1255d14bc9a60d9f7f05c704cff463e85e20589e4e1f2dea6490a88e70ff9454

SHA512
5c493d158647a882681729d19d5c31f8a4681a9164f2a0edf716b69b5d73a4dfb16d4f6fee86af531658a51f978b26665db67d7f7d0c22b335206c23fea6c875

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
3617161af35ef9d7bd6173b95bec65ef

SHA1
dff674734ccede53efc0fb127cc35f87cd9af689

SHA256
1255d14bc9a60d9f7f05c704cff463e85e20589e4e1f2dea6490a88e70ff9454

SHA512
5c493d158647a882681729d19d5c31f8a4681a9164f2a0edf716b69b5d73a4dfb16d4f6fee86af531658a51f978b26665db67d7f7d0c22b335206c23fea6c875

Download Submit
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.7MB

MD5
3617161af35ef9d7bd6173b95bec65ef

SHA1
dff674734ccede53efc0fb127cc35f87cd9af689

SHA256
1255d14bc9a60d9f7f05c704cff463e85e20589e4e1f2dea6490a88e70ff9454

SHA512
5c493d158647a882681729d19d5c31f8a4681a9164f2a0edf716b69b5d73a4dfb16d4f6fee86af531658a51f978b26665db67d7f7d0c22b335206c23fea6c875

Download Submit
memory/680-1420-0x0000000000E70000-0x00000000013A8000-memory.dmp

Filesize
5.2MB

Download
memory/680-1429-0x0000000002CF0000-0x0000000003228000-memory.dmp

Filesize
5.2MB

Download
memory/1096-1751-0x0000000001140000-0x0000000001528000-memory.dmp

Filesize
3.9MB

Download
memory/1096-365-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/1096-524-0x00000000030E0000-0x00000000030F0000-memory.dmp

Filesize
64KB

Download
memory/1096-677-0x0000000001140000-0x0000000001528000-memory.dmp

Filesize
3.9MB

Download
memory/1096-1935-0x0000000001140000-0x0000000001528000-memory.dmp

Filesize
3.9MB

Download
memory/1096-364-0x0000000001140000-0x0000000001528000-memory.dmp

Filesize
3.9MB

Download
memory/1096-366-0x0000000000B00000-0x0000000000B03000-memory.dmp

Filesize
12KB

Download
memory/1096-1783-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/1096-1782-0x0000000001140000-0x0000000001528000-memory.dmp

Filesize
3.9MB

Download
memory/1096-367-0x0000000001140000-0x0000000001528000-memory.dmp

Filesize
3.9MB

Download
memory/1096-1733-0x0000000001140000-0x0000000001528000-memory.dmp

Filesize
3.9MB

Download
memory/1096-368-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/1096-490-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/1096-1500-0x0000000001140000-0x0000000001528000-memory.dmp

Filesize
3.9MB

Download
memory/1096-1502-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/1096-489-0x0000000001140000-0x0000000001528000-memory.dmp

Filesize
3.9MB

Download
memory/1096-450-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/1096-449-0x0000000001140000-0x0000000001528000-memory.dmp

Filesize
3.9MB

Download
memory/1096-1669-0x00000000030E0000-0x00000000030F0000-memory.dmp

Filesize
64KB

Download
memory/1096-410-0x0000000001140000-0x0000000001528000-memory.dmp

Filesize
3.9MB

Download
memory/1096-411-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2024-412-0x0000000002BC0000-0x0000000002FA8000-memory.dmp

Filesize
3.9MB

Download
memory/2024-69-0x0000000002BC0000-0x0000000002FA8000-memory.dmp

Filesize
3.9MB

Download
memory/2024-70-0x0000000002BC0000-0x0000000002FA8000-memory.dmp

Filesize
3.9MB

Download
memory/2316-676-0x0000000000940000-0x0000000000E78000-memory.dmp

Filesize
5.2MB

Download
memory/2320-611-0x0000000000B60000-0x0000000000B70000-memory.dmp

Filesize
64KB

Download
memory/2320-616-0x0000000005800000-0x0000000005D38000-memory.dmp

Filesize
5.2MB

Download
memory/2320-1688-0x0000000005800000-0x0000000005D38000-memory.dmp

Filesize
5.2MB

Download
memory/2320-624-0x0000000005800000-0x0000000005D38000-memory.dmp

Filesize
5.2MB

Download
memory/2320-620-0x0000000005800000-0x0000000005D38000-memory.dmp

Filesize
5.2MB

Download
memory/2320-610-0x0000000000230000-0x0000000000618000-memory.dmp

Filesize
3.9MB

Download
memory/2320-615-0x0000000005800000-0x0000000005D38000-memory.dmp

Filesize
5.2MB

Download
memory/2320-1683-0x0000000000B60000-0x0000000000B70000-memory.dmp

Filesize
64KB

Download
memory/2528-1438-0x0000000000E70000-0x00000000013A8000-memory.dmp

Filesize
5.2MB

Download
memory/2564-625-0x0000000000E70000-0x00000000013A8000-memory.dmp

Filesize
5.2MB

Download
memory/2564-1716-0x00000000038D0000-0x0000000003E08000-memory.dmp

Filesize
5.2MB

Download
memory/2564-679-0x00000000038D0000-0x0000000003E08000-memory.dmp

Filesize
5.2MB

Download
memory/2564-1411-0x0000000003E50000-0x0000000004388000-memory.dmp

Filesize
5.2MB

Download
memory/2564-626-0x0000000002DB0000-0x00000000032E8000-memory.dmp

Filesize
5.2MB

Download
memory/2564-1728-0x0000000003E50000-0x0000000004388000-memory.dmp

Filesize
5.2MB

Download
memory/2600-627-0x0000000000E70000-0x00000000013A8000-memory.dmp

Filesize
5.2MB

Download
memory/3028-556-0x0000000002BD0000-0x0000000002FB8000-memory.dmp

Filesize
3.9MB

Download
memory/3028-1670-0x0000000002BD0000-0x0000000002FB8000-memory.dmp

Filesize
3.9MB

Download
memory/3028-560-0x0000000002BD0000-0x0000000002FB8000-memory.dmp

Filesize
3.9MB

Download
memory/3028-559-0x0000000002BD0000-0x0000000002FB8000-memory.dmp

Filesize
3.9MB

Download