Malware Analysis Report

2024-09-22 06:28

Sample ID 230409-re76jsbc96
Target TLauncher-2.879-Installer-1.1.0.exe
SHA256 845b0953c143daf9382b38c8ac7faeef62d5298bb0191f1be60865f78a942bac
Tags
bazarbackdoor backdoor discovery upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

845b0953c143daf9382b38c8ac7faeef62d5298bb0191f1be60865f78a942bac

Threat Level: Known bad

The file TLauncher-2.879-Installer-1.1.0.exe was found to be: Known bad.

Malicious Activity Summary

bazarbackdoor backdoor discovery upx

BazarBackdoor

Bazar/Team9 Backdoor payload

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

UPX packed file

Loads dropped DLL

Checks installed software on the system

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Enumerates system info in registry

Modifies system certificate store

MITRE ATT&CK Matrix V6

Analysis: static1

Detonation Overview

Reported

2023-04-09 14:07

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-04-09 14:07

Reported

2023-04-09 14:10

Platform

win7-20230220-en

Max time kernel

48s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.0.exe"

Signatures

BazarBackdoor

backdoor bazarbackdoor

Bazar/Team9 Backdoor payload

Description Indicator Process Target
N/A N/A N/A N/A

Downloads MZ/PE file

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks installed software on the system

discovery

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2024 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.0.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 2024 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.0.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 2024 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.0.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 2024 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.0.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 2024 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.0.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 2024 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.0.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 2024 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.0.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 1480 wrote to memory of 604 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 604 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 604 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 2028 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 2028 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 2028 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1480 wrote to memory of 632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.0.exe

"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.0.exe"

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.0.exe" "__IRCT:3" "__IRTSS:23652861" "__IRSID:S-1-5-21-1283023626-844874658-3193756055-1000"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6669758,0x7fef6669768,0x7fef6669778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1200 --field-trial-handle=1272,i,2526360252736443570,14567837532374577581,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1532 --field-trial-handle=1272,i,2526360252736443570,14567837532374577581,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1608 --field-trial-handle=1272,i,2526360252736443570,14567837532374577581,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2224 --field-trial-handle=1272,i,2526360252736443570,14567837532374577581,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2348 --field-trial-handle=1272,i,2526360252736443570,14567837532374577581,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1456 --field-trial-handle=1272,i,2526360252736443570,14567837532374577581,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3648 --field-trial-handle=1272,i,2526360252736443570,14567837532374577581,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=2504 --field-trial-handle=1272,i,2526360252736443570,14567837532374577581,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3844 --field-trial-handle=1272,i,2526360252736443570,14567837532374577581,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3952 --field-trial-handle=1272,i,2526360252736443570,14567837532374577581,131072 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

"C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816850 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:1841947" "__IRSID:S-1-5-21-1283023626-844874658-3193756055-1000"

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

"C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=97.0.4719.63 --initial-client-data=0x1a4,0x1a8,0x1ac,0x178,0x1b0,0x70dd33e0,0x70dd33f0,0x70dd33fc

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe

"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe" --version

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

"C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=2564 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20230409160835" --session-guid=c83637e9-9d3d-4528-9dc8-c58207dd382a --server-tracking-blob=ZjA0ZDcxMDZhMGNmYWMwZDBiZWU1MDBmMTA2NmQ2MDJlYzUyMDdjYmM2Yzk0NmU3ZTc0ODhmZTE1OWY4MTk5MDp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjciLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNjgxMDQ5MzEzLjE4MDIiLCJ1c2VyYWdlbnQiOiJTZXR1cCBGYWN0b3J5IDkuMCIsInV0bSI6eyJjYW1wYWlnbiI6Ik9wZXJhRGVza3RvcCIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Ik1TVEwifSwidXVpZCI6IjhhMjNlNTFlLWZmNDUtNDM3Ny1hZDE0LWVjNzE2ZjVlYWE2NCJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=2403000000000000

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=97.0.4719.63 --initial-client-data=0x1b0,0x1b4,0x1b8,0x178,0x1bc,0x702b33e0,0x702b33f0,0x702b33fc

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304091608351\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe

"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304091608351\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe"

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304091608351\assistant\assistant_installer.exe

"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304091608351\assistant\assistant_installer.exe" --version

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304091608351\assistant\assistant_installer.exe

"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304091608351\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=96.0.4693.50 --initial-client-data=0x148,0x14c,0x150,0x11c,0x154,0x12a6c28,0x12a6c38,0x12a6c44

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=584 --field-trial-handle=1272,i,2526360252736443570,14567837532374577581,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=1128 --field-trial-handle=1272,i,2526360252736443570,14567837532374577581,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3796 --field-trial-handle=1272,i,2526360252736443570,14567837532374577581,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2584 --field-trial-handle=1272,i,2526360252736443570,14567837532374577581,131072 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\jre-windows.exe

"C:\Users\Admin\AppData\Local\Temp\jre-windows.exe" STATIC=1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2252 --field-trial-handle=1272,i,2526360252736443570,14567837532374577581,131072 /prefetch:8

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x55c

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2372 --field-trial-handle=1272,i,2526360252736443570,14567837532374577581,131072 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\jds7176342.tmp\jre-windows.exe

"C:\Users\Admin\AppData\Local\Temp\jds7176342.tmp\jre-windows.exe" "STATIC=1"

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\system32\MsiExec.exe

C:\Windows\system32\MsiExec.exe -Embedding 4DCF968581D4C9A8B2ADB6B28978AD1B

C:\Program Files\Java\jre1.8.0_351\installer.exe

"C:\Program Files\Java\jre1.8.0_351\installer.exe" /s INSTALLDIR="C:\Program Files\Java\jre1.8.0_351\\" STATIC=1 INSTALL_SILENT=1 REPAIRMODE=0 ProductCode={26A24AE4-039D-4CA4-87B4-2F64180351F0}

Network

Country Destination Domain Proto
US 8.8.8.8:53 dl2.tlauncher.org udp
US 104.20.234.70:443 dl2.tlauncher.org tcp
US 8.8.8.8:53 apis.google.com udp
NL 172.217.168.206:443 apis.google.com tcp
US 8.8.8.8:53 net.geo.opera.com udp
NL 185.26.182.112:443 net.geo.opera.com tcp
US 8.8.8.8:53 desktop-netinstaller-sub.osp.opera.software udp
US 8.8.8.8:53 autoupdate.geo.opera.com udp
NL 185.26.182.123:443 autoupdate.geo.opera.com tcp
NL 185.26.182.123:443 autoupdate.geo.opera.com tcp
NL 82.145.217.121:443 desktop-netinstaller-sub.osp.opera.software tcp
US 8.8.8.8:53 features.opera-api2.com udp
US 8.8.8.8:53 download.opera.com udp
NL 82.145.216.15:443 features.opera-api2.com tcp
NL 82.145.216.24:443 download.opera.com tcp
US 8.8.8.8:53 download5.operacdn.com udp
US 104.18.3.211:443 download5.operacdn.com tcp
NL 82.145.217.121:443 desktop-netinstaller-sub.osp.opera.software tcp
NL 82.145.217.121:443 desktop-netinstaller-sub.osp.opera.software tcp
NL 82.145.217.121:443 desktop-netinstaller-sub.osp.opera.software tcp
US 8.8.8.8:53 javadl.oracle.com udp
NL 69.192.71.29:80 javadl.oracle.com tcp
NL 69.192.71.29:443 javadl.oracle.com tcp
US 8.8.8.8:53 sdlc-esd.oracle.com udp
GB 23.44.232.84:443 sdlc-esd.oracle.com tcp
US 8.8.8.8:53 youtube.com udp
NL 216.58.214.14:443 youtube.com tcp
NL 216.58.214.14:443 youtube.com tcp
NL 216.58.214.14:443 youtube.com udp
US 8.8.8.8:53 i.ytimg.com udp
NL 142.250.179.182:443 i.ytimg.com tcp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
GB 216.58.208.98:443 googleads.g.doubleclick.net tcp
US 8.8.8.8:53 content-autofill.googleapis.com udp
NL 142.250.179.182:443 i.ytimg.com udp
US 8.8.8.8:53 yt3.ggpht.com udp
NL 142.250.179.193:443 yt3.ggpht.com tcp
NL 142.250.179.193:443 yt3.ggpht.com tcp
NL 142.250.179.193:443 yt3.ggpht.com tcp
NL 142.250.179.193:443 yt3.ggpht.com tcp
NL 142.250.179.193:443 yt3.ggpht.com tcp
NL 142.250.179.193:443 yt3.ggpht.com tcp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
US 8.8.8.8:53 static.doubleclick.net udp
NL 142.250.179.198:443 static.doubleclick.net tcp
NL 142.250.179.202:443 jnn-pa.googleapis.com tcp
NL 142.250.179.202:443 jnn-pa.googleapis.com udp
US 8.8.8.8:53 javadl-esd-secure.oracle.com udp
FR 23.65.205.24:443 javadl-esd-secure.oracle.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 rps-svcs.oracle.com udp
FR 23.65.205.24:443 rps-svcs.oracle.com tcp
US 8.8.8.8:53 suggestqueries-clients6.youtube.com udp
US 8.8.8.8:53 yt3.googleusercontent.com udp
NL 142.250.179.193:443 yt3.ggpht.com udp
NL 142.251.36.33:443 yt3.googleusercontent.com tcp
US 8.8.8.8:53 i2.ytimg.com udp
NL 172.217.168.238:443 i2.ytimg.com tcp
US 8.8.8.8:53 rr5---sn-5hnekn7d.googlevideo.com udp
NL 209.85.226.42:443 rr5---sn-5hnekn7d.googlevideo.com tcp
NL 209.85.226.42:443 rr5---sn-5hnekn7d.googlevideo.com udp

Files

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 f8da4bc14cb40b7ff8cd2c798ca0f7b9
SHA1 1264c77f79f7a328d60dfd752e721a463fc3e247
SHA256 3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1
SHA512 0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 f8da4bc14cb40b7ff8cd2c798ca0f7b9
SHA1 1264c77f79f7a328d60dfd752e721a463fc3e247
SHA256 3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1
SHA512 0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 f8da4bc14cb40b7ff8cd2c798ca0f7b9
SHA1 1264c77f79f7a328d60dfd752e721a463fc3e247
SHA256 3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1
SHA512 0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 f8da4bc14cb40b7ff8cd2c798ca0f7b9
SHA1 1264c77f79f7a328d60dfd752e721a463fc3e247
SHA256 3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1
SHA512 0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 f8da4bc14cb40b7ff8cd2c798ca0f7b9
SHA1 1264c77f79f7a328d60dfd752e721a463fc3e247
SHA256 3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1
SHA512 0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

memory/2024-69-0x0000000002BC0000-0x0000000002FA8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 f8da4bc14cb40b7ff8cd2c798ca0f7b9
SHA1 1264c77f79f7a328d60dfd752e721a463fc3e247
SHA256 3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1
SHA512 0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

memory/2024-70-0x0000000002BC0000-0x0000000002FA8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

MD5 80d93d38badecdd2b134fe4699721223
SHA1 e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256 c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA512 9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

MD5 80d93d38badecdd2b134fe4699721223
SHA1 e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256 c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA512 9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 f8da4bc14cb40b7ff8cd2c798ca0f7b9
SHA1 1264c77f79f7a328d60dfd752e721a463fc3e247
SHA256 3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1
SHA512 0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico

MD5 e043a9cb014d641a56f50f9d9ac9a1b9
SHA1 61dc6aed3d0d1f3b8afe3d161410848c565247ed
SHA256 9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946
SHA512 4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

MD5 da1d0cd400e0b6ad6415fd4d90f69666
SHA1 de9083d2902906cacf57259cf581b1466400b799
SHA256 7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575
SHA512 f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

MD5 1bbf5dd0b6ca80e4c7c77495c3f33083
SHA1 e0520037e60eb641ec04d1e814394c9da0a6a862
SHA256 bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b
SHA512 97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

memory/1096-364-0x0000000001140000-0x0000000001528000-memory.dmp

memory/1096-365-0x0000000010000000-0x0000000010051000-memory.dmp

memory/1096-366-0x0000000000B00000-0x0000000000B03000-memory.dmp

memory/1096-367-0x0000000001140000-0x0000000001528000-memory.dmp

memory/1096-368-0x0000000010000000-0x0000000010051000-memory.dmp

\??\pipe\crashpad_1480_SNGAFTCDSGBFFYLD

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000004.dbtmp

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

memory/1096-410-0x0000000001140000-0x0000000001528000-memory.dmp

memory/1096-411-0x0000000010000000-0x0000000010051000-memory.dmp

memory/2024-412-0x0000000002BC0000-0x0000000002FA8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe

MD5 8d26aecef0a7bdac2b104454d3ba1a87
SHA1 50c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256 e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA512 0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

memory/1096-449-0x0000000001140000-0x0000000001528000-memory.dmp

memory/1096-450-0x0000000010000000-0x0000000010051000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.PNG

MD5 d88e18e2a020a756a8de999b76e7b1fd
SHA1 150f801600b9427039197847aaac784f8ba15258
SHA256 38b8f2202a5e48a8f528708922f504379896ef52b3882ce82efc3481c51804bb
SHA512 d048a569d155aa4636f25ed2963fd5e2234643735ad461df3ad3201cbe152b646c2893557a236fa9683aa3cb07351fa79b9e5788f631442e5142cab0bc98654a

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.PNG

MD5 01e097a324673878a3cb5e8e0f3cf152
SHA1 35ef5c438eca9672c7ee19bcde3952f83dc77928
SHA256 d8d0719a20d267a73d298d2ec1fbc050fe2ce25447c7441058ea3966acfbbb22
SHA512 e873763e96b3a52fe73f3fc9b3bcfd764c807c0206b5984d5f7dddd7debec4e6f0b6705ca6a7c6379b83c2fea792d7a16880ea109469ac1af41cc7bdb5f96e27

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\37878722-6787-4d89-8b4f-a68663ab380b.tmp

MD5 4074eb4119fdb98b8dcbcef50a8d1544
SHA1 176fdef0e0f44a1c462f2ac6a1e492e8e881fff9
SHA256 486c3ad769fcae1f8921c36b7ed23633e76da0d196215358ac6f50061000ee24
SHA512 2f73dc0afa1086cf5176c37bfbff980862ca19a8962727a6f2b451c1ff3a067d5b4816f6e25b66d9d7e0488ab3471165af8070bdabc6ae75b7f886505116a01f

memory/1096-489-0x0000000001140000-0x0000000001528000-memory.dmp

memory/1096-490-0x0000000010000000-0x0000000010051000-memory.dmp

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 f8da4bc14cb40b7ff8cd2c798ca0f7b9
SHA1 1264c77f79f7a328d60dfd752e721a463fc3e247
SHA256 3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1
SHA512 0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

MD5 8d26aecef0a7bdac2b104454d3ba1a87
SHA1 50c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256 e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA512 0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

MD5 8d26aecef0a7bdac2b104454d3ba1a87
SHA1 50c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256 e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA512 0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

MD5 8d26aecef0a7bdac2b104454d3ba1a87
SHA1 50c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256 e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA512 0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

MD5 8d26aecef0a7bdac2b104454d3ba1a87
SHA1 50c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256 e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA512 0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

MD5 8d26aecef0a7bdac2b104454d3ba1a87
SHA1 50c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256 e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA512 0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

MD5 8d26aecef0a7bdac2b104454d3ba1a87
SHA1 50c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256 e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA512 0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG46.PNG

MD5 bc193c9f3fd0730341d2ba951f734652
SHA1 ebe3f410cf0bf5f30fe36b1c1df96fa27e73b01f
SHA256 e9137bc2fefbd9a3c4506708f283fe52c40b00b35c2677fc31e196b305b00e67
SHA512 355cb9a7ba6e2a77a51339bfa732537bc77d36da372fe926f1e4bf25de865b09c98122d9559f5ec234b41a83cb97de4fd49427a9476169653ac6058912261c1e

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.PNG

MD5 a45137507477ea159a4c0481fadbdde8
SHA1 772e535525cd41abb781167334f923f1127f6d24
SHA256 fcc6693f94f87dbb9f03bd664f029db87257c79ac9a974d2caadc790f20ea67a
SHA512 393a8d9387b388524fbf7bc8387d521c830e7d384aabe278251cb4fa1291d32e2875c464a01f93670259bc2009d69507b632a692d43244f3eb7551414c9d635a

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

MD5 018c68cdf5ba005b4a380c20b13fee4c
SHA1 bf6043fbd31288e8667fcfc37cd74414bee1805f
SHA256 3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923
SHA512 506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

memory/1096-524-0x00000000030E0000-0x00000000030F0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

MD5 018c68cdf5ba005b4a380c20b13fee4c
SHA1 bf6043fbd31288e8667fcfc37cd74414bee1805f
SHA256 3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923
SHA512 506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

MD5 018c68cdf5ba005b4a380c20b13fee4c
SHA1 bf6043fbd31288e8667fcfc37cd74414bee1805f
SHA256 3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923
SHA512 506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

MD5 018c68cdf5ba005b4a380c20b13fee4c
SHA1 bf6043fbd31288e8667fcfc37cd74414bee1805f
SHA256 3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923
SHA512 506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

MD5 018c68cdf5ba005b4a380c20b13fee4c
SHA1 bf6043fbd31288e8667fcfc37cd74414bee1805f
SHA256 3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923
SHA512 506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

MD5 018c68cdf5ba005b4a380c20b13fee4c
SHA1 bf6043fbd31288e8667fcfc37cd74414bee1805f
SHA256 3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923
SHA512 506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

MD5 80d93d38badecdd2b134fe4699721223
SHA1 e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256 c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA512 9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

MD5 80d93d38badecdd2b134fe4699721223
SHA1 e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256 c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA512 9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

MD5 018c68cdf5ba005b4a380c20b13fee4c
SHA1 bf6043fbd31288e8667fcfc37cd74414bee1805f
SHA256 3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923
SHA512 506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

MD5 8d26aecef0a7bdac2b104454d3ba1a87
SHA1 50c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256 e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA512 0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

MD5 8d26aecef0a7bdac2b104454d3ba1a87
SHA1 50c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256 e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA512 0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

C:\Users\Admin\AppData\Local\Temp\setuparguments.ini

MD5 2b79e7bdbba1c6f22e63c6092a096df4
SHA1 9988d39e13c762d66b12331f5d04f4b35e484f02
SHA256 0b231a74e9bd68cac5191b1ec2a25d6324301487be7ff34401d1e10181c63fc5
SHA512 cf32e990563ae8da6e2abd3bb714a6d101d26961a8a6d91e5af04e73b860f6f79808d8d608cc81ff1efe9772664795ebf1bcf9794e50eeefc3656209fdecb5bd

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat

MD5 bd5626a0237933e0f1dccf10e7c9fbd6
SHA1 10c47d382d4f44d8d44efaa203501749e42c6d50
SHA256 7dfc1176d8a507135140b23a0c014093b7e2673f0f3e5727c3d85df4e7323762
SHA512 1fd864a5386580cf8bbafbacb12a043ef51948b729b9aedfe6dc81e6c2948a100526c7c600069f22454d550f7f736ad3045a930cc2ef97458dc1d6c782928087

memory/3028-556-0x0000000002BD0000-0x0000000002FB8000-memory.dmp

memory/3028-559-0x0000000002BD0000-0x0000000002FB8000-memory.dmp

memory/3028-560-0x0000000002BD0000-0x0000000002FB8000-memory.dmp

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

MD5 018c68cdf5ba005b4a380c20b13fee4c
SHA1 bf6043fbd31288e8667fcfc37cd74414bee1805f
SHA256 3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923
SHA512 506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

MD5 3617161af35ef9d7bd6173b95bec65ef
SHA1 dff674734ccede53efc0fb127cc35f87cd9af689
SHA256 1255d14bc9a60d9f7f05c704cff463e85e20589e4e1f2dea6490a88e70ff9454
SHA512 5c493d158647a882681729d19d5c31f8a4681a9164f2a0edf716b69b5d73a4dfb16d4f6fee86af531658a51f978b26665db67d7f7d0c22b335206c23fea6c875

\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

MD5 3617161af35ef9d7bd6173b95bec65ef
SHA1 dff674734ccede53efc0fb127cc35f87cd9af689
SHA256 1255d14bc9a60d9f7f05c704cff463e85e20589e4e1f2dea6490a88e70ff9454
SHA512 5c493d158647a882681729d19d5c31f8a4681a9164f2a0edf716b69b5d73a4dfb16d4f6fee86af531658a51f978b26665db67d7f7d0c22b335206c23fea6c875

\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

MD5 3617161af35ef9d7bd6173b95bec65ef
SHA1 dff674734ccede53efc0fb127cc35f87cd9af689
SHA256 1255d14bc9a60d9f7f05c704cff463e85e20589e4e1f2dea6490a88e70ff9454
SHA512 5c493d158647a882681729d19d5c31f8a4681a9164f2a0edf716b69b5d73a4dfb16d4f6fee86af531658a51f978b26665db67d7f7d0c22b335206c23fea6c875

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

MD5 3617161af35ef9d7bd6173b95bec65ef
SHA1 dff674734ccede53efc0fb127cc35f87cd9af689
SHA256 1255d14bc9a60d9f7f05c704cff463e85e20589e4e1f2dea6490a88e70ff9454
SHA512 5c493d158647a882681729d19d5c31f8a4681a9164f2a0edf716b69b5d73a4dfb16d4f6fee86af531658a51f978b26665db67d7f7d0c22b335206c23fea6c875

\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

MD5 3617161af35ef9d7bd6173b95bec65ef
SHA1 dff674734ccede53efc0fb127cc35f87cd9af689
SHA256 1255d14bc9a60d9f7f05c704cff463e85e20589e4e1f2dea6490a88e70ff9454
SHA512 5c493d158647a882681729d19d5c31f8a4681a9164f2a0edf716b69b5d73a4dfb16d4f6fee86af531658a51f978b26665db67d7f7d0c22b335206c23fea6c875

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

MD5 3617161af35ef9d7bd6173b95bec65ef
SHA1 dff674734ccede53efc0fb127cc35f87cd9af689
SHA256 1255d14bc9a60d9f7f05c704cff463e85e20589e4e1f2dea6490a88e70ff9454
SHA512 5c493d158647a882681729d19d5c31f8a4681a9164f2a0edf716b69b5d73a4dfb16d4f6fee86af531658a51f978b26665db67d7f7d0c22b335206c23fea6c875

\Users\Admin\AppData\Local\Temp\Opera_installer_2304091608316532564.dll

MD5 4fa000d2daf4a9a8b30a36de57343e8b
SHA1 4865161c5ec70cce04079a6cbf08795e05bacbf1
SHA256 50df18de18d3cdd5cc21f8fc0dbabbe5a60690027b82af25806f679f492065de
SHA512 a52620ab7ae4e8a6c7379790fc70c5cc611a06432b83ded0a7ea476a647098fcb18797b42ed98293c3e9dd955d784819638597e3b1b419f54eeb9a0084b625ca

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

MD5 3617161af35ef9d7bd6173b95bec65ef
SHA1 dff674734ccede53efc0fb127cc35f87cd9af689
SHA256 1255d14bc9a60d9f7f05c704cff463e85e20589e4e1f2dea6490a88e70ff9454
SHA512 5c493d158647a882681729d19d5c31f8a4681a9164f2a0edf716b69b5d73a4dfb16d4f6fee86af531658a51f978b26665db67d7f7d0c22b335206c23fea6c875

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

MD5 3617161af35ef9d7bd6173b95bec65ef
SHA1 dff674734ccede53efc0fb127cc35f87cd9af689
SHA256 1255d14bc9a60d9f7f05c704cff463e85e20589e4e1f2dea6490a88e70ff9454
SHA512 5c493d158647a882681729d19d5c31f8a4681a9164f2a0edf716b69b5d73a4dfb16d4f6fee86af531658a51f978b26665db67d7f7d0c22b335206c23fea6c875

\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

MD5 3617161af35ef9d7bd6173b95bec65ef
SHA1 dff674734ccede53efc0fb127cc35f87cd9af689
SHA256 1255d14bc9a60d9f7f05c704cff463e85e20589e4e1f2dea6490a88e70ff9454
SHA512 5c493d158647a882681729d19d5c31f8a4681a9164f2a0edf716b69b5d73a4dfb16d4f6fee86af531658a51f978b26665db67d7f7d0c22b335206c23fea6c875

\Users\Admin\AppData\Local\Temp\Opera_installer_2304091608320692600.dll

MD5 4fa000d2daf4a9a8b30a36de57343e8b
SHA1 4865161c5ec70cce04079a6cbf08795e05bacbf1
SHA256 50df18de18d3cdd5cc21f8fc0dbabbe5a60690027b82af25806f679f492065de
SHA512 a52620ab7ae4e8a6c7379790fc70c5cc611a06432b83ded0a7ea476a647098fcb18797b42ed98293c3e9dd955d784819638597e3b1b419f54eeb9a0084b625ca

memory/2320-610-0x0000000000230000-0x0000000000618000-memory.dmp

memory/2320-611-0x0000000000B60000-0x0000000000B70000-memory.dmp

memory/2320-615-0x0000000005800000-0x0000000005D38000-memory.dmp

memory/2320-616-0x0000000005800000-0x0000000005D38000-memory.dmp

memory/2320-620-0x0000000005800000-0x0000000005D38000-memory.dmp

memory/2320-624-0x0000000005800000-0x0000000005D38000-memory.dmp

memory/2564-625-0x0000000000E70000-0x00000000013A8000-memory.dmp

memory/2564-626-0x0000000002DB0000-0x00000000032E8000-memory.dmp

memory/2600-627-0x0000000000E70000-0x00000000013A8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe

MD5 3617161af35ef9d7bd6173b95bec65ef
SHA1 dff674734ccede53efc0fb127cc35f87cd9af689
SHA256 1255d14bc9a60d9f7f05c704cff463e85e20589e4e1f2dea6490a88e70ff9454
SHA512 5c493d158647a882681729d19d5c31f8a4681a9164f2a0edf716b69b5d73a4dfb16d4f6fee86af531658a51f978b26665db67d7f7d0c22b335206c23fea6c875

\Users\Admin\AppData\Local\Temp\Opera_installer_2304091608350952316.dll

MD5 4fa000d2daf4a9a8b30a36de57343e8b
SHA1 4865161c5ec70cce04079a6cbf08795e05bacbf1
SHA256 50df18de18d3cdd5cc21f8fc0dbabbe5a60690027b82af25806f679f492065de
SHA512 a52620ab7ae4e8a6c7379790fc70c5cc611a06432b83ded0a7ea476a647098fcb18797b42ed98293c3e9dd955d784819638597e3b1b419f54eeb9a0084b625ca

memory/1096-677-0x0000000001140000-0x0000000001528000-memory.dmp

memory/2316-676-0x0000000000940000-0x0000000000E78000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

MD5 3617161af35ef9d7bd6173b95bec65ef
SHA1 dff674734ccede53efc0fb127cc35f87cd9af689
SHA256 1255d14bc9a60d9f7f05c704cff463e85e20589e4e1f2dea6490a88e70ff9454
SHA512 5c493d158647a882681729d19d5c31f8a4681a9164f2a0edf716b69b5d73a4dfb16d4f6fee86af531658a51f978b26665db67d7f7d0c22b335206c23fea6c875

\Users\Admin\AppData\Local\Temp\Opera_installer_230409160835494680.dll

MD5 4fa000d2daf4a9a8b30a36de57343e8b
SHA1 4865161c5ec70cce04079a6cbf08795e05bacbf1
SHA256 50df18de18d3cdd5cc21f8fc0dbabbe5a60690027b82af25806f679f492065de
SHA512 a52620ab7ae4e8a6c7379790fc70c5cc611a06432b83ded0a7ea476a647098fcb18797b42ed98293c3e9dd955d784819638597e3b1b419f54eeb9a0084b625ca

C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

MD5 b9cbcd5972abee7566143dd9447f49bd
SHA1 f69711fc65b08f601809daf3754d889b71f4f4ce
SHA256 4557b09c2ddc651c292cd34831bf908b4d27073751c98f835bee5a87cc2ca2e1
SHA512 f76a0ee207b85fcbbc682f12d0fe561a5fb8dc47ff99dd30574fb0d8723be6ae378abb6510e1fa4be790b1df01d23f83823151668ecdc095cd59435ec76c34ee

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG5.PNG

MD5 23e26969753c07af68f232cdd684c003
SHA1 f14666db750cc2f89ccdd8852b4259fcfa663271
SHA256 17f138eea95423738d2c9b75834b607c671cb2ac4d71c9aecf100a8b847003d2
SHA512 7c57a6309da9ae381073e005d374b9c8a82c7b4e92322b91433009d41f8f34655ed9d45958ab1743023faa9e7aa0c82a05d9292b078efccb64c19992b7e4d4d2

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNG

MD5 32b9a83f00af4123b811eb6a85ee7971
SHA1 a1e6bdfe76e6103aca76bd21ce60c0b48e4de570
SHA256 a39a8cb1d54a2036257211b6364f84caf033fccf3394e9f890434563770e594d
SHA512 eb272c6dbaa3e59887cfdfd21dba5e2abc56a12beeda55ba091aa9b02da71af5ce11c0f7af4fb34f58da9836f91d787e26ab9f898b8669c861e9bacee973ca9f

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG23.PNG

MD5 58c10711ee61290c5e53d6c235d14c7f
SHA1 6cd433f1d5224b7441efecfef8e0982bbda4415b
SHA256 2d8d51d2405fd3534f5fce5ffea5b9a100ce4aacf35caa7d165c7c6672949b35
SHA512 b895b6f07fefc06695cb521fa923534c8ef99312ab6c27295c86de29fc1bdb09e3ba17cd4aea75f8dd9cf7e1a3c4494a6ef960eadcb209eecb1b623d70c367f0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0ddfe4119425fb309e9b166d9db01086
SHA1 f63effb536386b67ea3323bdd17782148fdc7263
SHA256 a1ed52cf345f679791f5c6037487f2f49c8ba61e160cbe9a923109d29987b9da
SHA512 75b8f8a3da8510055e29222001a7b4046c2f1bb79de65b8cce00adb095b878dea15ea4169d7700742642a9e02548c1da424cb0553d83827c87f40a8d715ce09b

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.BMP

MD5 0b445ace8798426e7185f52b7b7b6d1e
SHA1 7a77b46e0848cc9b32283ccb3f91a18c0934c079
SHA256 2bbf97ccba3f87d469eac909c4ce8a3f13ed29c8f31b611e7d5cf89a0619eda6
SHA512 51523d5b711481293305465a3a3c6a3a50dca984cdc8cca1f4c44f3c21bfa430cd9aac1a8782d9605e6954cbafb307beb6b1a52e9785de1bc3f71067d80c6b6e

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG48.PNG

MD5 9eb36caea38bf80ed9fa40a3f67597b7
SHA1 3c23e2e30119f6dd321d34a82a339d52723bfacc
SHA256 6be2e43a38969226e1cbb00605cdac634d0de3e82ce605b08dcf1cf596f64370
SHA512 22b57fc57d45ec73865e5429210d6016d2bab0cd990877c8272b4fc6ded8effe3bfa0c9b0890d7b0de8296e6bc3c262f29637b8ce7840efba2f963e70a978e53

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG67.PNG

MD5 0bde2ca44cd4e4e31c5c0364c66eb57b
SHA1 8496e4a8dcea6e42af33b503dc200d4a1ef07101
SHA256 38031284395ba7a773a335a861536b487bbf60b81496424b8a9a8a6697a919de
SHA512 4e60f45022b0c6739db94097401f6046e5f95b26dca71e685db834338451b7ea0b3ed3afc128d564c3f79074905b7986714f75925c41f763eda6b901875af555

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG66.PNG

MD5 7aae2de61d5e6296c00fde67046dfaeb
SHA1 87a65e99d520045c39997b53c6a0aa08cec35e57
SHA256 07b11e82a30598438ac4221d6c8796739c42c2a596365464f257481a37fa00c6
SHA512 c5ebaf43ffc19a1a3b2f49e070ea1d5532ae433c3bcd02493e31bd3389b6c3edfb1e04373902fbd252eb7370612dd96c3d36eb3fac8240111f57020ab99fa882

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG45.PNG

MD5 87221bf8c9222a1489e949e4266a2980
SHA1 60c9d850f696e56b53dc3f940f52463d228febf2
SHA256 8d6e1d814dd38525115ee5d77e2d2ae6df8be31562a3c6805012097d6625efc4
SHA512 fa7ba5edb212a0ad70de123b1eabebd8d4cf5e2e3f59841330923c91d6ce6d8a0bbbf0176a8215a183ea860ae5286a4205b73f70df4d032cfd6c03109d1e433c

C:\Users\Admin\AppData\Local\Temp\TarDEAE.tmp

MD5 73b4b714b42fc9a6aaefd0ae59adb009
SHA1 efdaffd5b0ad21913d22001d91bf6c19ecb4ac41
SHA256 c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd
SHA512 73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG109.PNG

MD5 c70b569d43f5e00ee3dd81530899f191
SHA1 38b7f73c29d9d355625bf7dcc611d657c263dbc4
SHA256 778c8b5a8e7422ce84f4113fc1cbd90204f3b3c0b3bb8545b3fe68003525e9e8
SHA512 f0aafa93ffd1edb8764f7e435fa982b0eb596b1962472dcefac26731382c58d44306e876f04675146595a1e7ee6ae8170e2fa01ed0fca075e36a9749709f4df7

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

MD5 1bbf5dd0b6ca80e4c7c77495c3f33083
SHA1 e0520037e60eb641ec04d1e814394c9da0a6a862
SHA256 bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b
SHA512 97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

MD5 da1d0cd400e0b6ad6415fd4d90f69666
SHA1 de9083d2902906cacf57259cf581b1466400b799
SHA256 7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575
SHA512 f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

memory/2564-1411-0x0000000003E50000-0x0000000004388000-memory.dmp

memory/680-1429-0x0000000002CF0000-0x0000000003228000-memory.dmp

memory/2528-1438-0x0000000000E70000-0x00000000013A8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG104.PNG

MD5 f54bbaadafacf2ed607c2b44e76bd5f2
SHA1 e6e313e86b0adb771643dc9aa465652646d83329
SHA256 2dcd3efb7e14a1439973b066c810eb3187cb851a7d01b2a03376d978b6b0d927
SHA512 1d7f940d290c3c7eca12739f7e4753901a1d070ca9f43171b4fe25530ba48b3b376c16b125a32d6e701d63d576ef829824472bcac99e568784543bfc4c50b732

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG85.PNG

MD5 16c0e37cb0c5540fd9f93a8d82d94e52
SHA1 52d5aabf804381b47d13a358d80256c4088eec21
SHA256 2b772e66ebc70c93deb0b9a9e054373ee33d9245809e16174b1f132f786a063f
SHA512 dd54308739f9621f5fe707c69f24657431fd58b46e357a79d25c3d8e96d3b2914ce19d94beeee0bbd32311737670f06b01c364f0c7d70625a4246da64c29b0af

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG86.PNG

MD5 a7a8625948d61d814dbb29225e04f908
SHA1 16bc91a8bb3c22cf78447644a32010ad869eaf99
SHA256 61979f700f77d187c8647cba3bee95ca4a70e187bbb76323f4055385dd8879d5
SHA512 04b0bb58095a6e8f1d29203f21eee99fd837494b74736e91e5e304eb3dc3ccb32796b6959361ede965731b76607a53b0f9d211cb4b3d94b25ea34898e760d295

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

MD5 2b6c09f59f11a052e1a826f0ad9212ec
SHA1 0747c091ca6841904a7049ffd6d1d1d76b792635
SHA256 08c27cbc512b897eaea4a218a46da2ea40bbec30b5f9b9857bcdcba4f9b23fe3
SHA512 aa78953d1488bf7e40b4935d9d8bf71d902f3463b8c086ca84c9772f29c38866f5cc91be5109d0505d6d878d68246960042976ff22c3c72810cf9ff646c1c3d0

memory/680-1420-0x0000000000E70000-0x00000000013A8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CabDEAD.tmp

MD5 fc4666cbca561e864e7fdf883a9e6661
SHA1 2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA256 10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512 c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG42.PNG

MD5 034eab9a50571cbab86294322e639886
SHA1 cae94b8cfe3ecce8e750d6fd34d54e766ea607aa
SHA256 449d678cc9a235d42a5a2f4e685536d9af87c6b5fc022f28dba32b08b4e88ee1
SHA512 b364c0cbb38bfb35e3c2d29705df72a8ce7dc111f04ebc05eceec4294987f18200581a31b78a79b05da890b5358e5463d1640d2230a8af930804efa3d4da42b0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

MD5 f4ce1cd74547c6a1d0ec3dc2bbe51aec
SHA1 a1bd28f325c8f05b0005fa5e3f4ba2370db967d2
SHA256 44b430c052fc92fe5f9161ff41b96091fe806c3276f44ee74757953d89c9ac38
SHA512 8bf1eb4391df0e8e1f678a14428a19a3eae58b87ff02e125cff174e9ff1cd9e78f3f15b703890e8ee3526c29995cd2d6d9a7671164be9cd044665b71a7653cbf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

MD5 e872ae4f19b7d528bd7eea4d96ae77fa
SHA1 c5dd9ff18cec76d71950da578b98751fd4eb4bf1
SHA256 ab9d7b86443595d3d8b5ea14fc81dcd5d9045d594c8d8daa249a1abb2cff6619
SHA512 6424b61af1d4d97733f79edf6d8b400592070a1568306a648b9bc6bad6bbe998a0e0bcae256288664ffdd78e58600ed21b2f5dfac34a4477e7114d82afa6c031

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG22.PNG

MD5 362d3183b2acc152c99ec123611f3297
SHA1 3db69a12917cb11a14fb9294d73c5409fe11a398
SHA256 8ae66727c5c92ca76a131aa104cc126858e8e3ed490ae08482109dfedd9a8cda
SHA512 2c7f40564479d1fe90cb59b4b413e8bf9a5bb7cd2f94193f8759e376549c0269afce030df7d306b4cd814f604ad460d744fb00d961f6d2608a4ecb6b186a4f1f

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

MD5 71ff25e27d25ecd5532271001f1add68
SHA1 dec1d09929573ae1127ba1dbdc33a24bd412feea
SHA256 c54b9e84f6529067ce41e07f835074be408f27d90e91b93f5f21320bc64cd5bf
SHA512 21fbd01814824a800166cb98f9d29b57e86f77558ea40cabdbfc254b5ff6139c53fdff20b3f4c64048c7584792c938ad3b4517057527880b8737c57d9fd39cd0

C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

MD5 545c62b3d98ee4cc02af837a72dd09c4
SHA1 54446a007fd9b7363d9415673b0ac0232d5d70d5
SHA256 738029a4f974128180fa2cd239e873b01e456e8bf53bfdbf34b8ba8b57897be4
SHA512 8bf9c754861ed267efd2055ac09b4ad44df61b989859fccd14190592dca1dab0fa8f57360209eaceabb5137f742c9cea73a1a985ab1955f87a6875d0be95fdcf

C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

MD5 b9cbcd5972abee7566143dd9447f49bd
SHA1 f69711fc65b08f601809daf3754d889b71f4f4ce
SHA256 4557b09c2ddc651c292cd34831bf908b4d27073751c98f835bee5a87cc2ca2e1
SHA512 f76a0ee207b85fcbbc682f12d0fe561a5fb8dc47ff99dd30574fb0d8723be6ae378abb6510e1fa4be790b1df01d23f83823151668ecdc095cd59435ec76c34ee

\Users\Admin\AppData\Local\Temp\Opera_installer_2304091608356532528.dll

MD5 4fa000d2daf4a9a8b30a36de57343e8b
SHA1 4865161c5ec70cce04079a6cbf08795e05bacbf1
SHA256 50df18de18d3cdd5cc21f8fc0dbabbe5a60690027b82af25806f679f492065de
SHA512 a52620ab7ae4e8a6c7379790fc70c5cc611a06432b83ded0a7ea476a647098fcb18797b42ed98293c3e9dd955d784819638597e3b1b419f54eeb9a0084b625ca

\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

MD5 3617161af35ef9d7bd6173b95bec65ef
SHA1 dff674734ccede53efc0fb127cc35f87cd9af689
SHA256 1255d14bc9a60d9f7f05c704cff463e85e20589e4e1f2dea6490a88e70ff9454
SHA512 5c493d158647a882681729d19d5c31f8a4681a9164f2a0edf716b69b5d73a4dfb16d4f6fee86af531658a51f978b26665db67d7f7d0c22b335206c23fea6c875

C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

MD5 3617161af35ef9d7bd6173b95bec65ef
SHA1 dff674734ccede53efc0fb127cc35f87cd9af689
SHA256 1255d14bc9a60d9f7f05c704cff463e85e20589e4e1f2dea6490a88e70ff9454
SHA512 5c493d158647a882681729d19d5c31f8a4681a9164f2a0edf716b69b5d73a4dfb16d4f6fee86af531658a51f978b26665db67d7f7d0c22b335206c23fea6c875

\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

MD5 3617161af35ef9d7bd6173b95bec65ef
SHA1 dff674734ccede53efc0fb127cc35f87cd9af689
SHA256 1255d14bc9a60d9f7f05c704cff463e85e20589e4e1f2dea6490a88e70ff9454
SHA512 5c493d158647a882681729d19d5c31f8a4681a9164f2a0edf716b69b5d73a4dfb16d4f6fee86af531658a51f978b26665db67d7f7d0c22b335206c23fea6c875

memory/2564-679-0x00000000038D0000-0x0000000003E08000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Opera_installer_2304091608350952316.dll

MD5 4fa000d2daf4a9a8b30a36de57343e8b
SHA1 4865161c5ec70cce04079a6cbf08795e05bacbf1
SHA256 50df18de18d3cdd5cc21f8fc0dbabbe5a60690027b82af25806f679f492065de
SHA512 a52620ab7ae4e8a6c7379790fc70c5cc611a06432b83ded0a7ea476a647098fcb18797b42ed98293c3e9dd955d784819638597e3b1b419f54eeb9a0084b625ca

\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe

MD5 3617161af35ef9d7bd6173b95bec65ef
SHA1 dff674734ccede53efc0fb127cc35f87cd9af689
SHA256 1255d14bc9a60d9f7f05c704cff463e85e20589e4e1f2dea6490a88e70ff9454
SHA512 5c493d158647a882681729d19d5c31f8a4681a9164f2a0edf716b69b5d73a4dfb16d4f6fee86af531658a51f978b26665db67d7f7d0c22b335206c23fea6c875

memory/1096-1500-0x0000000001140000-0x0000000001528000-memory.dmp

memory/1096-1502-0x0000000010000000-0x0000000010051000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304091608351\opera_package

MD5 6b7771354e081eb94cdbf7627799da4f
SHA1 199341a750443cc6e9b2b2fa1e657d0dd327711f
SHA256 494d1247e61eebf703a6eb19c14bde88edd2f85515fefa4f0465f43873e69aab
SHA512 33e781a102ba3f5c3b1895540bc9c43b78bf4f19af4b91ae0c765594f39d6569d1bad207b33f808426d8ebdcb00c419b7bb76bb050bae0bb843f96dd84355800

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 e71c8443ae0bc2e282c73faead0a6dd3
SHA1 0c110c1b01e68edfacaeae64781a37b1995fa94b
SHA256 95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72
SHA512 b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

C:\Users\Admin\AppData\Local\Temp\Tar1B6F.tmp

MD5 be2bec6e8c5653136d3e72fe53c98aa3
SHA1 a8182d6db17c14671c3d5766c72e58d87c0810de
SHA256 1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd
SHA512 0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

memory/1096-1669-0x00000000030E0000-0x00000000030F0000-memory.dmp

memory/3028-1670-0x0000000002BD0000-0x0000000002FB8000-memory.dmp

\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304091608351\opera_package

MD5 6b7771354e081eb94cdbf7627799da4f
SHA1 199341a750443cc6e9b2b2fa1e657d0dd327711f
SHA256 494d1247e61eebf703a6eb19c14bde88edd2f85515fefa4f0465f43873e69aab
SHA512 33e781a102ba3f5c3b1895540bc9c43b78bf4f19af4b91ae0c765594f39d6569d1bad207b33f808426d8ebdcb00c419b7bb76bb050bae0bb843f96dd84355800

\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304091608351\opera_package

MD5 6b7771354e081eb94cdbf7627799da4f
SHA1 199341a750443cc6e9b2b2fa1e657d0dd327711f
SHA256 494d1247e61eebf703a6eb19c14bde88edd2f85515fefa4f0465f43873e69aab
SHA512 33e781a102ba3f5c3b1895540bc9c43b78bf4f19af4b91ae0c765594f39d6569d1bad207b33f808426d8ebdcb00c419b7bb76bb050bae0bb843f96dd84355800

memory/2320-1683-0x0000000000B60000-0x0000000000B70000-memory.dmp

memory/2320-1688-0x0000000005800000-0x0000000005D38000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a194faa04a1f7ca81234049c3d5f1e1d
SHA1 dffaced539a9a174877bbbb32b1b8bb12ac63ea1
SHA256 2c03800e4d93d67f0f56a325e83ac91e9005706c207fcdfb5a9f3f3c6e4d01a3
SHA512 3f58d140eaaa95261997fd99429e43d5b04fb4dd022256d09c93c887d97faf3acfda6e4401722bcf556705cd12b6b32b6dd2bc1b68a35ea85c69d7439bdea507

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304091608351\additional_file0.tmp

MD5 b386cdcb413405daa8219af8e4cbd318
SHA1 ce275ff8514fef0629c915a6ee7b5ac481b9043d
SHA256 408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e
SHA512 91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

memory/2564-1716-0x00000000038D0000-0x0000000003E08000-memory.dmp

memory/2564-1728-0x0000000003E50000-0x0000000004388000-memory.dmp

memory/1096-1733-0x0000000001140000-0x0000000001528000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 b6ee3a905330c07db60f69aea9499215
SHA1 68821b31275c9ffeff3750df92bd8a0834e04dcc
SHA256 16998a774d7984bd0091b23362f2bd7cd35d520057b95809b6a57a4afa2b3f64
SHA512 3abb8f4ab01a2d28071fb99fd47599aa002520512746878cc3d2017299081d49c3d8de08d34fdb4af6ccbc7c54c2212ed804d29b51f1cefd53435fcbcf03a74d

memory/1096-1751-0x0000000001140000-0x0000000001528000-memory.dmp

memory/1096-1782-0x0000000001140000-0x0000000001528000-memory.dmp

memory/1096-1783-0x0000000010000000-0x0000000010051000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT~RF6db175.TMP

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 9b8c4edc7b0ad0512e6cf8c7af8f866d
SHA1 ba7749b87b39f49057a473a121f49be35c0d4a71
SHA256 fe356862916fef23de01969914c5c5595cd9cc54e3c63bc93e3eb49f768ce511
SHA512 cf7496976c36fe6bf8f86d309bc0756e2bb03a5ad2d006a2405182367bc57042e56eecad2c3d5de7581bfd3796f842c96a5db3cbfff369b5e9576a8d9cd2bd24

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG106.PNG

MD5 f785bd0f38d4132c404ab3233bb1766b
SHA1 7c8f01921d026646289d92d4e08529482f2dd881
SHA256 4ddf6c789a700dbbca5c405f6b9625e2dee8d6e279f8629eb1e451e5040fbd0e
SHA512 45f806a91993918177e838ac21bf59f37e2000aeefa191d0b538e156165eac82309cc0c67b5379bdaa7f7bbbc97ae25ffd741a6c35c07377a893721442811573

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000002.dbtmp

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 ae1bccd6831ebfe5ad03b482ee266e4f
SHA1 01f4179f48f1af383b275d7ee338dd160b6f558a
SHA256 1b11047e738f76c94c9d15ee981ec46b286a54def1a7852ca1ade7f908988649
SHA512 baf7ff6747f30e542c254f46a9678b9dbf42312933962c391b79eca6fcb615e4ba9283c00f554d6021e594f18c087899bc9b5362c41c0d6f862bba7fb9f83038

memory/1096-1935-0x0000000001140000-0x0000000001528000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\jusched.log

MD5 6446585249c8c70ca3be5c0836cd821c
SHA1 ccecb90745bd569fa90b968252219bd85a325d28
SHA256 334b799933822c08442ee7ba1ee2cdfef379b8ae0edfa1d625389ff629c69d19
SHA512 078279a9ac94a172ff874be6c55854a3387a0e18bcfb92cecf4b234bee5bb3f717d1920f9efe7f55159a7839c0e23a3bfefa56cbcd099d70e72aa6047cfdf002

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 50378b0a5d6191ed08bc4d522210527d
SHA1 b708d06e305895b2a9dc2206f261d533c873416a
SHA256 2f1de3a5adca09fa47acaa4a94409eda74dccce74e1e9167f157a4be10d6343e
SHA512 0e7e7a561a96ad5198c9180b53b6d628cc4d8c829cf94305f75aa7b6b77ed7f61426907d3b17facc20f2c9fda5ded169d918f3bd3c4220a520058a11ef344c66

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 cfe581cf13c4e572ba88ae5c01042b95
SHA1 d38d6bf71e57c4dcf2bcfdba49532c7d95f77ec0
SHA256 2555fa8efaf255c13f073de0af74e7d38d4b7f798e21a10b4429cf43bb35fc06
SHA512 753eca5e362f22e90623689f4d270c95812e79d242cfe58bca08172cfa8dc4d20894026112f970f2d1e415bf9fc54633e02d9c111c8bc4d26b72094aab6cb2dd

C:\Windows\Installer\MSI2256.tmp

MD5 62cfeb86f117ad91b8bb52f1dda6f473
SHA1 c753b488938b3e08f7f47df209359c7b78764448
SHA256 f06cba20bd40e9d841add1877cf8d3b406f0acfa4800b80ae041ed3cc374eb7e
SHA512 c1b0e76cee4e2c3ca604dcc8f5665e72e70008acc824e20d89404f139d7e7e789e99dff131dafd76409f6ea0a813aa136f96089fbdadcf90d6485b1807762e4e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 a986199a6e58ccad97f4229030c6083a
SHA1 227dca21525814ba3d4b44fa2819fbd81704d656
SHA256 7d4751add4e47f180fc1eaed6470c0e7fde6ac0f3b7dc7ebe826f2acfaa6f825
SHA512 50a40a4036effbec87f2ac86a51db31073afda580080baa9d9ffd47d8bd6b90550cdf8be7a15f31d0c2ea1af53fbdb9d4a03f99b6cdaac319dbb1cb87dc710af

C:\Windows\Installer\6e0f4d.msi

MD5 1794aaa17d114a315a95473c9780fc8b
SHA1 7f250c022b916b88e22254985e7552bc3ac8db04
SHA256 7682233d155e6d19f30cf61b185a02055be0dbcacd2c9accf90a99de21547eb4
SHA512 fb9defdf73786528e82ffc7e1ccfa03cfb687365ec740e9620993da785414306f03a7e1fa523192a9d690a882b012d1e426afd1757639f3ef5f1e612c01e6516

Analysis: behavioral2

Detonation Overview

Submitted

2023-04-09 14:07

Reported

2023-04-09 14:10

Platform

win10v2004-20230220-en

Max time kernel

144s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.0.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.0.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks installed software on the system

discovery

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.0.exe

"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.0.exe"

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.0.exe" "__IRCT:3" "__IRTSS:23652861" "__IRSID:S-1-5-21-2275444769-3691835758-4097679484-1000"

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 assets.msn.com udp
GB 95.101.143.129:443 assets.msn.com tcp
US 8.8.8.8:53 129.143.101.95.in-addr.arpa udp
US 8.8.8.8:53 dl2.tlauncher.org udp
US 104.20.234.70:443 dl2.tlauncher.org tcp
US 8.8.8.8:53 70.234.20.104.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 52.152.108.96:443 tcp
US 20.189.173.3:443 tcp
US 93.184.220.29:80 tcp
US 93.184.221.240:80 tcp
US 8.8.8.8:53 44.8.109.52.in-addr.arpa udp
US 8.8.8.8:53 151.122.125.40.in-addr.arpa udp
US 8.8.8.8:53 2.36.159.162.in-addr.arpa udp
US 93.184.221.240:80 tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 api.msn.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 f8da4bc14cb40b7ff8cd2c798ca0f7b9
SHA1 1264c77f79f7a328d60dfd752e721a463fc3e247
SHA256 3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1
SHA512 0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 f8da4bc14cb40b7ff8cd2c798ca0f7b9
SHA1 1264c77f79f7a328d60dfd752e721a463fc3e247
SHA256 3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1
SHA512 0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 f8da4bc14cb40b7ff8cd2c798ca0f7b9
SHA1 1264c77f79f7a328d60dfd752e721a463fc3e247
SHA256 3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1
SHA512 0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

MD5 80d93d38badecdd2b134fe4699721223
SHA1 e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256 c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA512 9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

MD5 80d93d38badecdd2b134fe4699721223
SHA1 e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256 c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA512 9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

memory/4460-147-0x0000000000150000-0x0000000000538000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico

MD5 e043a9cb014d641a56f50f9d9ac9a1b9
SHA1 61dc6aed3d0d1f3b8afe3d161410848c565247ed
SHA256 9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946
SHA512 4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

MD5 da1d0cd400e0b6ad6415fd4d90f69666
SHA1 de9083d2902906cacf57259cf581b1466400b799
SHA256 7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575
SHA512 f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

MD5 da1d0cd400e0b6ad6415fd4d90f69666
SHA1 de9083d2902906cacf57259cf581b1466400b799
SHA256 7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575
SHA512 f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

MD5 1bbf5dd0b6ca80e4c7c77495c3f33083
SHA1 e0520037e60eb641ec04d1e814394c9da0a6a862
SHA256 bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b
SHA512 97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

MD5 1bbf5dd0b6ca80e4c7c77495c3f33083
SHA1 e0520037e60eb641ec04d1e814394c9da0a6a862
SHA256 bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b
SHA512 97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

memory/4460-440-0x0000000010000000-0x0000000010051000-memory.dmp

memory/4460-441-0x0000000006400000-0x0000000006403000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe

MD5 8d26aecef0a7bdac2b104454d3ba1a87
SHA1 50c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256 e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA512 0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

memory/4460-461-0x0000000000150000-0x0000000000538000-memory.dmp

memory/4460-462-0x0000000010000000-0x0000000010051000-memory.dmp

memory/4460-486-0x0000000010000000-0x0000000010051000-memory.dmp

memory/4460-488-0x0000000010000000-0x0000000010051000-memory.dmp