Overview

overview

10

Static

static

1

TLauncher-....0.exe

windows7-x64

10

TLauncher-....0.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    178s
  • max time network
    334s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    14-04-2023 16:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    TLauncher-2.879-Installer-1.1.0.exe

  • Size

    22.6MB

  • MD5

    601b94e3b018e39e0da90881fe89156d

  • SHA1

    dc5340d6e1cb98c6ae2fa6882a4c7284e990705b

  • SHA256

    845b0953c143daf9382b38c8ac7faeef62d5298bb0191f1be60865f78a942bac

  • SHA512

    493c283aa3e201501843e59d593d82b3c98d2628639c95c977c9f22c268d89f7b072907d7b5d244fb7f122348277a97f7d68ce0ebdb36d7fc479c5f3c5bd33db

  • SSDEEP

    393216:+Xj4yibrRbGPfs/dQETVlOBbpFEjdGphRqV56Hpkf+V4scTKAjENq+:+zCrRsHExi73qqHpg+Vvc+AmX

Score
10/10
bazarbackdooradwarebackdoordiscoverypersistencespywarestealerupx

Malware Config

Signatures

  • BazarBackdoor

    Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

    backdoorbazarbackdoor
  • Bazar/Team9 Backdoor payload 3 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 25 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Registers COM server for autorun 1 TTPs 64 IoCs
    persistence
  • UPX packed file 53 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 26 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 6 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.0.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.0.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:912
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.0.exe" "__IRCT:3" "__IRTSS:23652861" "__IRSID:S-1-5-21-3430344531-3702557399-3004411149-1000"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2036
      • C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
        "C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1612
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816850 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:1841947" "__IRSID:S-1-5-21-3430344531-3702557399-3004411149-1000"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies system certificate store
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1084
          • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
            "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Enumerates connected drives
            • Modifies system certificate store
            • Suspicious use of WriteProcessMemory
            PID:1592
            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=97.0.4719.63 --initial-client-data=0x1a4,0x1a8,0x1ac,0x178,0x1b0,0x716a33e0,0x716a33f0,0x716a33fc
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:2956
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe" --version
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:2448
            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=1592 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20230414180400" --session-guid=8861b7c2-35c5-4b1f-a59c-aa28f357d56b --server-tracking-blob=ZGY3MDE2NzY0OWFiZDMyOGQ0ZGVlMGUxYmU1ZTI5NDljMzQyZDUwMDI2M2I4MjAzZDdiNmIxYmQ1MDE2MmM2Mzp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjciLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNjgxNDg4MjMzLjEyMjkiLCJ1c2VyYWdlbnQiOiJTZXR1cCBGYWN0b3J5IDkuMCIsInV0bSI6eyJjYW1wYWlnbiI6Ik9wZXJhRGVza3RvcCIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Ik1TVEwifSwidXVpZCI6IjM5MjZmOTFlLWMwYWMtNDFmZi1iYTFjLTZiNDE5MWFmMGZlMyJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=3403000000000000
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Enumerates connected drives
              • Suspicious use of WriteProcessMemory
              PID:2736
              • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=97.0.4719.63 --initial-client-data=0x1b0,0x1b4,0x1b8,0x178,0x1bc,0x70c233e0,0x70c233f0,0x70c233fc
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:2648
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304141804001\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304141804001\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe"
              6⤵
              • Executes dropped EXE
              PID:2948
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304141804001\assistant\assistant_installer.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304141804001\assistant\assistant_installer.exe" --version
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:2932
              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304141804001\assistant\assistant_installer.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304141804001\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=96.0.4693.50 --initial-client-data=0x148,0x14c,0x150,0x11c,0x154,0x256c28,0x256c38,0x256c44
                7⤵
                • Executes dropped EXE
                PID:3000
      • C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
        "C:\Users\Admin\AppData\Local\Temp\jre-windows.exe" STATIC=1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2952
        • C:\Users\Admin\AppData\Local\Temp\jds7163643.tmp\jre-windows.exe
          "C:\Users\Admin\AppData\Local\Temp\jds7163643.tmp\jre-windows.exe" "STATIC=1"
          4⤵
          • Executes dropped EXE
          • Modifies Internet Explorer settings
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:968
  • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
    "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
    1⤵
    • Executes dropped EXE
    PID:2972
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://java-for-minecraft.com/
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:2632
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2632 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2748
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops file in Windows directory
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:2060
    • C:\Windows\system32\MsiExec.exe
      C:\Windows\system32\MsiExec.exe -Embedding CEA3564EA17D2796A4D085B7B291D45C
      2⤵
      • Loads dropped DLL
      PID:2028
    • C:\Program Files\Java\jre1.8.0_351\installer.exe
      "C:\Program Files\Java\jre1.8.0_351\installer.exe" /s INSTALLDIR="C:\Program Files\Java\jre1.8.0_351\\" STATIC=1 INSTALL_SILENT=1 REPAIRMODE=0 ProductCode={26A24AE4-039D-4CA4-87B4-2F64180351F0}
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Registers COM server for autorun
      • Installs/modifies Browser Helper Object
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Modifies data under HKEY_USERS
      • Modifies registry class
      PID:2672
      • C:\ProgramData\Oracle\Java\installcache_x64\7200226.tmp\bspatch.exe
        "bspatch.exe" baseimagefam8 newimage diff
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2560
      • C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
        "C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/plugin.pack" "C:\Program Files\Java\jre1.8.0_351\lib/plugin.jar"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2768
      • C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
        "C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/javaws.pack" "C:\Program Files\Java\jre1.8.0_351\lib/javaws.jar"
        3⤵
        • Executes dropped EXE
        PID:2476
      • C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
        "C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/deploy.pack" "C:\Program Files\Java\jre1.8.0_351\lib/deploy.jar"
        3⤵
        • Executes dropped EXE
        PID:2852
      • C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
        "C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/rt.pack" "C:\Program Files\Java\jre1.8.0_351\lib/rt.jar"
        3⤵
        • Executes dropped EXE
        PID:2864
      • C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
        "C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/jsse.pack" "C:\Program Files\Java\jre1.8.0_351\lib/jsse.jar"
        3⤵
        • Executes dropped EXE
        PID:2356
      • C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
        "C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/charsets.pack" "C:\Program Files\Java\jre1.8.0_351\lib/charsets.jar"
        3⤵
        • Executes dropped EXE
        PID:2596
      • C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
        "C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/ext/localedata.pack" "C:\Program Files\Java\jre1.8.0_351\lib/ext/localedata.jar"
        3⤵
        • Executes dropped EXE
        PID:3044
      • C:\Program Files\Java\jre1.8.0_351\bin\javaw.exe
        "C:\Program Files\Java\jre1.8.0_351\bin\javaw.exe" -Xshare:dump -Djdk.disableLastUsageTracking
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        PID:1552
      • C:\Program Files\Java\jre1.8.0_351\bin\ssvagent.exe
        "C:\Program Files\Java\jre1.8.0_351\bin\ssvagent.exe" -doHKCUSSVSetup
        3⤵
        • Executes dropped EXE
        • Registers COM server for autorun
        • Modifies registry class
        PID:2764
      • C:\Program Files\Java\jre1.8.0_351\bin\javaws.exe
        "C:\Program Files\Java\jre1.8.0_351\bin\javaws.exe" -wait -fix -permissions -silent
        3⤵
          PID:2144
          • C:\Program Files\Java\jre1.8.0_351\bin\jp2launcher.exe
            "C:\Program Files\Java\jre1.8.0_351\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre1.8.0_351" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzM1MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF8zNTFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzM1MVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==
            4⤵
              PID:2140
          • C:\Program Files\Java\jre1.8.0_351\bin\javaws.exe
            "C:\Program Files\Java\jre1.8.0_351\bin\javaws.exe" -wait -fix -shortcut -silent
            3⤵
              PID:1920
              • C:\Program Files\Java\jre1.8.0_351\bin\jp2launcher.exe
                "C:\Program Files\Java\jre1.8.0_351\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre1.8.0_351" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzM1MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF8zNTFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzM1MVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtc2hvcnRjdXQALXNpbGVudAAtbm90V2ViSmF2YQ==
                4⤵
                  PID:2304
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe"
            1⤵
              PID:1088
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef41b9758,0x7fef41b9768,0x7fef41b9778
                2⤵
                  PID:1012
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe"
                1⤵
                  PID:268
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xbc,0xc0,0xc4,0x90,0xc8,0x7fef41b9758,0x7fef41b9768,0x7fef41b9778
                    2⤵
                      PID:2700
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe"
                    1⤵
                      PID:2832
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xbc,0xc0,0xc4,0x90,0xc8,0x7fef41b9758,0x7fef41b9768,0x7fef41b9778
                        2⤵
                          PID:2452
                      • C:\Windows\system32\NOTEPAD.EXE
                        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\CheckpointRead.css
                        1⤵
                        • Opens file in notepad (likely ransom note)
                        PID:2328

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Program Files\Java\jre1.8.0_351\bin\dtplugin\npdeployJava1.dll
                        Filesize

                        1.8MB

                        MD5

                        ff91ac355dc6b1df63795886125bccf8

                        SHA1

                        90979fc6ea3a89031598d2146bf5cdbbb6db6b77

                        SHA256

                        14b30467cfea0071dffc658dd31b8a25b7b4e79608933f171911c2cba6aa9a0a

                        SHA512

                        77aa8c7930730004bdb8d49a82712e1042db978102f6eca0d38317b6fd98ef03e52279130eadc7a0da1148e759db6589f7f8334d4c2eccfb2613e8f19542e197

                        Download Submit

                      • C:\Program Files\Java\jre1.8.0_351\bin\javacpl.exe
                        Filesize

                        103KB

                        MD5

                        7a9d69862a2021508931a197cd6501ec

                        SHA1

                        a0f7d313a874552f4972784d15042b564e4067fc

                        SHA256

                        51ff63cbac78bd133333e98d91b02b652c88cd57cedd0052519051a17be77856

                        SHA512

                        5c331e6deefc8256ea203d63770484f6b485d4c3832a60ecf4a540dff3cb75a76dbde37980fe1763ca487401b68126f58f8d1a4c72ee610f5144c624c4736850

                        Download Submit

                      • C:\Program Files\Java\jre1.8.0_351\bin\javaws.exe
                        Filesize

                        446KB

                        MD5

                        24ccb37646e1f52ce4f47164cccf2b91

                        SHA1

                        bc265e26417026286d6ed951904305086c4f693c

                        SHA256

                        adf2d659c2b2a4afff1ca58f3a742d27d767d27eabeca6a8b6ee243e9c913a39

                        SHA512

                        cb174e7a219f6ffae3715e37beb428979bc1462202729c05a25fa7b8da90e2dd6faa92c03cd9ca21567d354dce7acc1852669f4071298e953d6a286243794e32

                        Download Submit

                      • C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
                        Filesize

                        216KB

                        MD5

                        691f68efcd902bfdfb60b556a3e11c2c

                        SHA1

                        c279fa09293185bddfd73d1170b6a73bd266cf07

                        SHA256

                        471d70ebf91bdc762dcacbea9f6ca883f97921938e83269fef911dbf83598a70

                        SHA512

                        a4816ae0654f41bd130d56e44839d9f29ab48bd2f99c3d6db38ce3358ac46c1cef09da09184c6291dd378018a49f9e56173c35d780d3eaefcce459592c75de3f

                        Download Submit

                      • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit\Reference Documentation.lnk
                        Filesize

                        197B

                        MD5

                        b5e1de7d05841796c6d96dfe5b8b338c

                        SHA1

                        c7c64e5b35d0cca1a5c98a1c68e1e5d4c8b72547

                        SHA256

                        062cb9dec2b2ce02c633fc442d1a23e910e602548a54a54c8310b0dde9ae074d

                        SHA512

                        963a89b04f34bc00fea5b8e0f9648596c428beac2db30d8b0932974b15c0eb90b7c801ba6fa1082ea9d133258f393ae27e61f27fd3b3951f5c2e4b8c6a212c2d

                        Download Submit

                      • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Get Help.url
                        Filesize

                        182B

                        MD5

                        7fadb9e200dbbd992058cefa41212796

                        SHA1

                        e2525d7ba66bb07bc1cd5ba93f88c54e7e2042b4

                        SHA256

                        b05abacd15117b1ffcd2a288308f50c0542214d264b852eddfa9025307ac401b

                        SHA512

                        94b7bf1f1f5cea2a74f8c326113dd25652cb14e5fa356ac83d16b6ac5a5cac26c9d2b20259f5c2cf8ebc1e022490511e2996335a5d8dd7f5b64dce429fb6dfb1

                        Download Submit

                      • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Visit Java.com.url
                        Filesize

                        178B

                        MD5

                        3b1c6b5701ef2829986a6bdc3f6fbf94

                        SHA1

                        1a2fe685aba9430625cba281d1a8f7ba9d392af0

                        SHA256

                        6a2cdce88637830202e1031bc8c11f083103a6bbb8c1ce16fb805671a46633c8

                        SHA512

                        f3391d790bb6acb1c25b82253b19c334e7cd73648e9821b7050fefbd5b0bc4b48a0cedd97e425a83c788f9b798337d33dee2e989771604c4f886da46d2debea0

                        Download Submit

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                        Filesize

                        61KB

                        MD5

                        e71c8443ae0bc2e282c73faead0a6dd3

                        SHA1

                        0c110c1b01e68edfacaeae64781a37b1995fa94b

                        SHA256

                        95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

                        SHA512

                        b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

                        Download Submit

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
                        Filesize

                        471B

                        MD5

                        9ecdd2bd32ddac630615f0ad501989a7

                        SHA1

                        5f3bbb1f781caed9e8a8a0853c1710a0c296e447

                        SHA256

                        d3b7633c85f6528ad5896842177eae86da9f3efd64d78c0fbe89611dfcf57c31

                        SHA512

                        b9d01b0236e4cf5abcdb2a8f3940a1a7ef54e1b6dfbd1adfbf30d1ef8e774da3e30e1c401dce5ae25b8629ccf4d6f1799990879f4e8ebc87ea18a5a1d650cc25

                        Download Submit

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
                        Filesize

                        1KB

                        MD5

                        a266bb7dcc38a562631361bbf61dd11b

                        SHA1

                        3b1efd3a66ea28b16697394703a72ca340a05bd5

                        SHA256

                        df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

                        SHA512

                        0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

                        Download Submit

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                        Filesize

                        342B

                        MD5

                        cca06a9ecb8b38281a026cfa1bbf4b10

                        SHA1

                        c605780bb67adcfb3765727a87484bf3b87fd723

                        SHA256

                        31ce75b562cb78e90b43cde727dbd3102b688873a7e1da00a2bf49cb575f8933

                        SHA512

                        2a8d42ee248dcf70ef8598a6285cab4766a58c8c8da69eb18b5576ad0e60327741b4b3078afd9517fb730f5d685d1dc264c22110eac470f7d7609abb2947bb2c

                        Download Submit

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
                        Filesize

                        404B

                        MD5

                        087bbf39016bb8a85b4284d3b7de396d

                        SHA1

                        baa2c5b0a7728c7fc3e317dc554b8305313ad8ad

                        SHA256

                        cab82897a522867295e00d46eeded8f3b3a21d0528493278301f276775c51de8

                        SHA512

                        0bcd6a9563a3a1d518d1ebcafa48a3f7958bb1f2fc627345e6a4b5374cfbd824ce8762591ab3180ecce7fdb5ea3f2c84223731a0503c93fedb381ce5ca353baf

                        Download Submit

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
                        Filesize

                        242B

                        MD5

                        453a7c187043ebf34bc9d9033d42a3a1

                        SHA1

                        75306a9c7c009a2a3ec7c71ab5217fbaa69df461

                        SHA256

                        09fd78ce1483272677f14165fe01e1f90105dccf90ac9e1989d89e5d2f784118

                        SHA512

                        ced26cc80319e5d02728cad7dd599765bccb9475babb3e1915c18dfb7e7ab88ce2bf45cab10546f3f741c0c6cec8c35bbe7706aa84f3e2d4f0e46d3b525ed91c

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
                        Filesize

                        2.7MB

                        MD5

                        77bf134f64f4545603f1150b819e3074

                        SHA1

                        8bbc23f285df4a4ea5f0f8704df28b16014ed057

                        SHA256

                        b1c8e2ca1bfb882ae6df705a33e9c3032830362d41cf7c055c74c5b1df70c58e

                        SHA512

                        bf630a064532cd97c000098e11a541c8e084fe9a940533515f34476f1dba243014e81b8ce1b07f378dcc8ebe9b7fbf14771ba4d4055626b560ec3cfec6b19618

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304141804001\additional_file0.tmp
                        Filesize

                        1.7MB

                        MD5

                        b386cdcb413405daa8219af8e4cbd318

                        SHA1

                        ce275ff8514fef0629c915a6ee7b5ac481b9043d

                        SHA256

                        408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e

                        SHA512

                        91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304141804001\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe
                        Filesize

                        1.7MB

                        MD5

                        b386cdcb413405daa8219af8e4cbd318

                        SHA1

                        ce275ff8514fef0629c915a6ee7b5ac481b9043d

                        SHA256

                        408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e

                        SHA512

                        91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304141804001\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe
                        Filesize

                        1.7MB

                        MD5

                        b386cdcb413405daa8219af8e4cbd318

                        SHA1

                        ce275ff8514fef0629c915a6ee7b5ac481b9043d

                        SHA256

                        408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e

                        SHA512

                        91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304141804001\assistant\assistant_installer.exe
                        Filesize

                        2.1MB

                        MD5

                        2f3d9e21e232b9bfea064d3b2264db06

                        SHA1

                        bafddc657d8d1bb531683b29b0342cc065ee51d2

                        SHA256

                        25528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d

                        SHA512

                        94e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304141804001\assistant\assistant_installer.exe
                        Filesize

                        2.1MB

                        MD5

                        2f3d9e21e232b9bfea064d3b2264db06

                        SHA1

                        bafddc657d8d1bb531683b29b0342cc065ee51d2

                        SHA256

                        25528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d

                        SHA512

                        94e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304141804001\opera_package
                        Filesize

                        86.9MB

                        MD5

                        6b7771354e081eb94cdbf7627799da4f

                        SHA1

                        199341a750443cc6e9b2b2fa1e657d0dd327711f

                        SHA256

                        494d1247e61eebf703a6eb19c14bde88edd2f85515fefa4f0465f43873e69aab

                        SHA512

                        33e781a102ba3f5c3b1895540bc9c43b78bf4f19af4b91ae0c765594f39d6569d1bad207b33f808426d8ebdcb00c419b7bb76bb050bae0bb843f96dd84355800

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
                        Filesize

                        1.8MB

                        MD5

                        8d26aecef0a7bdac2b104454d3ba1a87

                        SHA1

                        50c29c58dfece62d94ed01cb5b3d070e593dc9cf

                        SHA256

                        e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

                        SHA512

                        0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
                        Filesize

                        1.8MB

                        MD5

                        8d26aecef0a7bdac2b104454d3ba1a87

                        SHA1

                        50c29c58dfece62d94ed01cb5b3d070e593dc9cf

                        SHA256

                        e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

                        SHA512

                        0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\CabD210.tmp
                        Filesize

                        61KB

                        MD5

                        fc4666cbca561e864e7fdf883a9e6661

                        SHA1

                        2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

                        SHA256

                        10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

                        SHA512

                        c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2304141804003992448.dll
                        Filesize

                        4.6MB

                        MD5

                        4fa000d2daf4a9a8b30a36de57343e8b

                        SHA1

                        4865161c5ec70cce04079a6cbf08795e05bacbf1

                        SHA256

                        50df18de18d3cdd5cc21f8fc0dbabbe5a60690027b82af25806f679f492065de

                        SHA512

                        a52620ab7ae4e8a6c7379790fc70c5cc611a06432b83ded0a7ea476a647098fcb18797b42ed98293c3e9dd955d784819638597e3b1b419f54eeb9a0084b625ca

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\Tar2A9C.tmp
                        Filesize

                        161KB

                        MD5

                        be2bec6e8c5653136d3e72fe53c98aa3

                        SHA1

                        a8182d6db17c14671c3d5766c72e58d87c0810de

                        SHA256

                        1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

                        SHA512

                        0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\TarD251.tmp
                        Filesize

                        161KB

                        MD5

                        73b4b714b42fc9a6aaefd0ae59adb009

                        SHA1

                        efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

                        SHA256

                        c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

                        SHA512

                        73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico
                        Filesize

                        116KB

                        MD5

                        e043a9cb014d641a56f50f9d9ac9a1b9

                        SHA1

                        61dc6aed3d0d1f3b8afe3d161410848c565247ed

                        SHA256

                        9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946

                        SHA512

                        4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe
                        Filesize

                        1.8MB

                        MD5

                        8d26aecef0a7bdac2b104454d3ba1a87

                        SHA1

                        50c29c58dfece62d94ed01cb5b3d070e593dc9cf

                        SHA256

                        e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

                        SHA512

                        0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.PNG
                        Filesize

                        339B

                        MD5

                        a45137507477ea159a4c0481fadbdde8

                        SHA1

                        772e535525cd41abb781167334f923f1127f6d24

                        SHA256

                        fcc6693f94f87dbb9f03bd664f029db87257c79ac9a974d2caadc790f20ea67a

                        SHA512

                        393a8d9387b388524fbf7bc8387d521c830e7d384aabe278251cb4fa1291d32e2875c464a01f93670259bc2009d69507b632a692d43244f3eb7551414c9d635a

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG104.PNG
                        Filesize

                        644B

                        MD5

                        f54bbaadafacf2ed607c2b44e76bd5f2

                        SHA1

                        e6e313e86b0adb771643dc9aa465652646d83329

                        SHA256

                        2dcd3efb7e14a1439973b066c810eb3187cb851a7d01b2a03376d978b6b0d927

                        SHA512

                        1d7f940d290c3c7eca12739f7e4753901a1d070ca9f43171b4fe25530ba48b3b376c16b125a32d6e701d63d576ef829824472bcac99e568784543bfc4c50b732

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG105.PNG
                        Filesize

                        40KB

                        MD5

                        4f71465fa9fcc2f321a1e934f214ac33

                        SHA1

                        38c9f15f23e4e5158b04c2eee54d0fcc8104405a

                        SHA256

                        ea29ba222b5c2c2f13a71314ae449fca748e96343a6d1520140a9534df57cda0

                        SHA512

                        6f151ae73b3ef807a3397cdb57820a839f77923320951bfef09c0efcab84e3fbfbe02dfe71e912b7d1b36ea78bf70c254a0015227fa5dbf861f40551fd0e1645

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG106.PNG
                        Filesize

                        1KB

                        MD5

                        f785bd0f38d4132c404ab3233bb1766b

                        SHA1

                        7c8f01921d026646289d92d4e08529482f2dd881

                        SHA256

                        4ddf6c789a700dbbca5c405f6b9625e2dee8d6e279f8629eb1e451e5040fbd0e

                        SHA512

                        45f806a91993918177e838ac21bf59f37e2000aeefa191d0b538e156165eac82309cc0c67b5379bdaa7f7bbbc97ae25ffd741a6c35c07377a893721442811573

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG109.PNG
                        Filesize

                        2KB

                        MD5

                        c70b569d43f5e00ee3dd81530899f191

                        SHA1

                        38b7f73c29d9d355625bf7dcc611d657c263dbc4

                        SHA256

                        778c8b5a8e7422ce84f4113fc1cbd90204f3b3c0b3bb8545b3fe68003525e9e8

                        SHA512

                        f0aafa93ffd1edb8764f7e435fa982b0eb596b1962472dcefac26731382c58d44306e876f04675146595a1e7ee6ae8170e2fa01ed0fca075e36a9749709f4df7

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.PNG
                        Filesize

                        280B

                        MD5

                        01e097a324673878a3cb5e8e0f3cf152

                        SHA1

                        35ef5c438eca9672c7ee19bcde3952f83dc77928

                        SHA256

                        d8d0719a20d267a73d298d2ec1fbc050fe2ce25447c7441058ea3966acfbbb22

                        SHA512

                        e873763e96b3a52fe73f3fc9b3bcfd764c807c0206b5984d5f7dddd7debec4e6f0b6705ca6a7c6379b83c2fea792d7a16880ea109469ac1af41cc7bdb5f96e27

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG22.PNG
                        Filesize

                        1KB

                        MD5

                        362d3183b2acc152c99ec123611f3297

                        SHA1

                        3db69a12917cb11a14fb9294d73c5409fe11a398

                        SHA256

                        8ae66727c5c92ca76a131aa104cc126858e8e3ed490ae08482109dfedd9a8cda

                        SHA512

                        2c7f40564479d1fe90cb59b4b413e8bf9a5bb7cd2f94193f8759e376549c0269afce030df7d306b4cd814f604ad460d744fb00d961f6d2608a4ecb6b186a4f1f

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.PNG
                        Filesize

                        281B

                        MD5

                        d88e18e2a020a756a8de999b76e7b1fd

                        SHA1

                        150f801600b9427039197847aaac784f8ba15258

                        SHA256

                        38b8f2202a5e48a8f528708922f504379896ef52b3882ce82efc3481c51804bb

                        SHA512

                        d048a569d155aa4636f25ed2963fd5e2234643735ad461df3ad3201cbe152b646c2893557a236fa9683aa3cb07351fa79b9e5788f631442e5142cab0bc98654a

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG85.PNG
                        Filesize

                        43KB

                        MD5

                        16c0e37cb0c5540fd9f93a8d82d94e52

                        SHA1

                        52d5aabf804381b47d13a358d80256c4088eec21

                        SHA256

                        2b772e66ebc70c93deb0b9a9e054373ee33d9245809e16174b1f132f786a063f

                        SHA512

                        dd54308739f9621f5fe707c69f24657431fd58b46e357a79d25c3d8e96d3b2914ce19d94beeee0bbd32311737670f06b01c364f0c7d70625a4246da64c29b0af

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG86.PNG
                        Filesize

                        1KB

                        MD5

                        a7a8625948d61d814dbb29225e04f908

                        SHA1

                        16bc91a8bb3c22cf78447644a32010ad869eaf99

                        SHA256

                        61979f700f77d187c8647cba3bee95ca4a70e187bbb76323f4055385dd8879d5

                        SHA512

                        04b0bb58095a6e8f1d29203f21eee99fd837494b74736e91e5e304eb3dc3ccb32796b6959361ede965731b76607a53b0f9d211cb4b3d94b25ea34898e760d295

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
                        Filesize

                        1.7MB

                        MD5

                        1bbf5dd0b6ca80e4c7c77495c3f33083

                        SHA1

                        e0520037e60eb641ec04d1e814394c9da0a6a862

                        SHA256

                        bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

                        SHA512

                        97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
                        Filesize

                        97KB

                        MD5

                        da1d0cd400e0b6ad6415fd4d90f69666

                        SHA1

                        de9083d2902906cacf57259cf581b1466400b799

                        SHA256

                        7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

                        SHA512

                        f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                        Filesize

                        1.3MB

                        MD5

                        f8da4bc14cb40b7ff8cd2c798ca0f7b9

                        SHA1

                        1264c77f79f7a328d60dfd752e721a463fc3e247

                        SHA256

                        3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1

                        SHA512

                        0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                        Filesize

                        1.3MB

                        MD5

                        f8da4bc14cb40b7ff8cd2c798ca0f7b9

                        SHA1

                        1264c77f79f7a328d60dfd752e721a463fc3e247

                        SHA256

                        3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1

                        SHA512

                        0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                        Filesize

                        1.3MB

                        MD5

                        f8da4bc14cb40b7ff8cd2c798ca0f7b9

                        SHA1

                        1264c77f79f7a328d60dfd752e721a463fc3e247

                        SHA256

                        3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1

                        SHA512

                        0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
                        Filesize

                        326KB

                        MD5

                        80d93d38badecdd2b134fe4699721223

                        SHA1

                        e829e58091bae93bc64e0c6f9f0bac999cfda23d

                        SHA256

                        c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                        SHA512

                        9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat
                        Filesize

                        114KB

                        MD5

                        bd5626a0237933e0f1dccf10e7c9fbd6

                        SHA1

                        10c47d382d4f44d8d44efaa203501749e42c6d50

                        SHA256

                        7dfc1176d8a507135140b23a0c014093b7e2673f0f3e5727c3d85df4e7323762

                        SHA512

                        1fd864a5386580cf8bbafbacb12a043ef51948b729b9aedfe6dc81e6c2948a100526c7c600069f22454d550f7f736ad3045a930cc2ef97458dc1d6c782928087

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                        Filesize

                        1.3MB

                        MD5

                        018c68cdf5ba005b4a380c20b13fee4c

                        SHA1

                        bf6043fbd31288e8667fcfc37cd74414bee1805f

                        SHA256

                        3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

                        SHA512

                        506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                        Filesize

                        1.3MB

                        MD5

                        018c68cdf5ba005b4a380c20b13fee4c

                        SHA1

                        bf6043fbd31288e8667fcfc37cd74414bee1805f

                        SHA256

                        3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

                        SHA512

                        506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                        Filesize

                        1.3MB

                        MD5

                        018c68cdf5ba005b4a380c20b13fee4c

                        SHA1

                        bf6043fbd31288e8667fcfc37cd74414bee1805f

                        SHA256

                        3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

                        SHA512

                        506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
                        Filesize

                        326KB

                        MD5

                        80d93d38badecdd2b134fe4699721223

                        SHA1

                        e829e58091bae93bc64e0c6f9f0bac999cfda23d

                        SHA256

                        c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                        SHA512

                        9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
                        Filesize

                        84.5MB

                        MD5

                        7542ec421a2f6e90751e8b64c22e0542

                        SHA1

                        d207d221a28ede5c2c8415f82c555989aa7068ba

                        SHA256

                        188ca8ecc44de1b7f602e883c3054dc392792c3631bf362b1bc4f3e1dba323e6

                        SHA512

                        8987bf8aa1b401815fa9850e56954db6015bdd06ce78b65ba435724582ffa615dee4e1452fa237c53257dca8ee97b469d01c27757a5f070ce6f807a4f81094bc

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\jusched.log
                        Filesize

                        4KB

                        MD5

                        0b1f40d83bef42fbb1287ab5c6147974

                        SHA1

                        a69c32604c28f2b9e2e9758905eed6ff3f820677

                        SHA256

                        20ca40256c352c8835982bc00b2e7d00d7d39cb636c3261020efb1f172d5a251

                        SHA512

                        97df3503082644bbb53d648f7786dcd09b5d61ac7f7978918e964eacde3edacb84ea7d3405ab4100282d374273c262ba27dbeeeedb10132599b05afa1566782b

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\jusched.log
                        Filesize

                        14KB

                        MD5

                        1397c9dca1497e6bbd061e5ece3373a1

                        SHA1

                        7cf6eb0051ff3cda2640044a9a6cb3cc25e6a3b4

                        SHA256

                        f641899a4f3668b5c2c24004b0a1fb0651b792477160a715a2c6528e98b6947a

                        SHA512

                        7ee9778ebdbf62aaf05f054d3ab0c9c2de039b9ae7c6ad808049700ef9c85e761892f05b715b8f863a68a719d287fa8f5824a49bdc7ea7c380161db52a06b5d7

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                        Filesize

                        2.7MB

                        MD5

                        77bf134f64f4545603f1150b819e3074

                        SHA1

                        8bbc23f285df4a4ea5f0f8704df28b16014ed057

                        SHA256

                        b1c8e2ca1bfb882ae6df705a33e9c3032830362d41cf7c055c74c5b1df70c58e

                        SHA512

                        bf630a064532cd97c000098e11a541c8e084fe9a940533515f34476f1dba243014e81b8ce1b07f378dcc8ebe9b7fbf14771ba4d4055626b560ec3cfec6b19618

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                        Filesize

                        2.7MB

                        MD5

                        77bf134f64f4545603f1150b819e3074

                        SHA1

                        8bbc23f285df4a4ea5f0f8704df28b16014ed057

                        SHA256

                        b1c8e2ca1bfb882ae6df705a33e9c3032830362d41cf7c055c74c5b1df70c58e

                        SHA512

                        bf630a064532cd97c000098e11a541c8e084fe9a940533515f34476f1dba243014e81b8ce1b07f378dcc8ebe9b7fbf14771ba4d4055626b560ec3cfec6b19618

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                        Filesize

                        2.7MB

                        MD5

                        77bf134f64f4545603f1150b819e3074

                        SHA1

                        8bbc23f285df4a4ea5f0f8704df28b16014ed057

                        SHA256

                        b1c8e2ca1bfb882ae6df705a33e9c3032830362d41cf7c055c74c5b1df70c58e

                        SHA512

                        bf630a064532cd97c000098e11a541c8e084fe9a940533515f34476f1dba243014e81b8ce1b07f378dcc8ebe9b7fbf14771ba4d4055626b560ec3cfec6b19618

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                        Filesize

                        2.7MB

                        MD5

                        77bf134f64f4545603f1150b819e3074

                        SHA1

                        8bbc23f285df4a4ea5f0f8704df28b16014ed057

                        SHA256

                        b1c8e2ca1bfb882ae6df705a33e9c3032830362d41cf7c055c74c5b1df70c58e

                        SHA512

                        bf630a064532cd97c000098e11a541c8e084fe9a940533515f34476f1dba243014e81b8ce1b07f378dcc8ebe9b7fbf14771ba4d4055626b560ec3cfec6b19618

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                        Filesize

                        2.7MB

                        MD5

                        77bf134f64f4545603f1150b819e3074

                        SHA1

                        8bbc23f285df4a4ea5f0f8704df28b16014ed057

                        SHA256

                        b1c8e2ca1bfb882ae6df705a33e9c3032830362d41cf7c055c74c5b1df70c58e

                        SHA512

                        bf630a064532cd97c000098e11a541c8e084fe9a940533515f34476f1dba243014e81b8ce1b07f378dcc8ebe9b7fbf14771ba4d4055626b560ec3cfec6b19618

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                        Filesize

                        2.7MB

                        MD5

                        77bf134f64f4545603f1150b819e3074

                        SHA1

                        8bbc23f285df4a4ea5f0f8704df28b16014ed057

                        SHA256

                        b1c8e2ca1bfb882ae6df705a33e9c3032830362d41cf7c055c74c5b1df70c58e

                        SHA512

                        bf630a064532cd97c000098e11a541c8e084fe9a940533515f34476f1dba243014e81b8ce1b07f378dcc8ebe9b7fbf14771ba4d4055626b560ec3cfec6b19618

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
                        Filesize

                        590B

                        MD5

                        2b79e7bdbba1c6f22e63c6092a096df4

                        SHA1

                        9988d39e13c762d66b12331f5d04f4b35e484f02

                        SHA256

                        0b231a74e9bd68cac5191b1ec2a25d6324301487be7ff34401d1e10181c63fc5

                        SHA512

                        cf32e990563ae8da6e2abd3bb714a6d101d26961a8a6d91e5af04e73b860f6f79808d8d608cc81ff1efe9772664795ebf1bcf9794e50eeefc3656209fdecb5bd

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
                        Filesize

                        6.3MB

                        MD5

                        545c62b3d98ee4cc02af837a72dd09c4

                        SHA1

                        54446a007fd9b7363d9415673b0ac0232d5d70d5

                        SHA256

                        738029a4f974128180fa2cd239e873b01e456e8bf53bfdbf34b8ba8b57897be4

                        SHA512

                        8bf9c754861ed267efd2055ac09b4ad44df61b989859fccd14190592dca1dab0fa8f57360209eaceabb5137f742c9cea73a1a985ab1955f87a6875d0be95fdcf

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
                        Filesize

                        6.3MB

                        MD5

                        545c62b3d98ee4cc02af837a72dd09c4

                        SHA1

                        54446a007fd9b7363d9415673b0ac0232d5d70d5

                        SHA256

                        738029a4f974128180fa2cd239e873b01e456e8bf53bfdbf34b8ba8b57897be4

                        SHA512

                        8bf9c754861ed267efd2055ac09b4ad44df61b989859fccd14190592dca1dab0fa8f57360209eaceabb5137f742c9cea73a1a985ab1955f87a6875d0be95fdcf

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
                        Filesize

                        6.3MB

                        MD5

                        545c62b3d98ee4cc02af837a72dd09c4

                        SHA1

                        54446a007fd9b7363d9415673b0ac0232d5d70d5

                        SHA256

                        738029a4f974128180fa2cd239e873b01e456e8bf53bfdbf34b8ba8b57897be4

                        SHA512

                        8bf9c754861ed267efd2055ac09b4ad44df61b989859fccd14190592dca1dab0fa8f57360209eaceabb5137f742c9cea73a1a985ab1955f87a6875d0be95fdcf

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.BMP
                        Filesize

                        451KB

                        MD5

                        0b445ace8798426e7185f52b7b7b6d1e

                        SHA1

                        7a77b46e0848cc9b32283ccb3f91a18c0934c079

                        SHA256

                        2bbf97ccba3f87d469eac909c4ce8a3f13ed29c8f31b611e7d5cf89a0619eda6

                        SHA512

                        51523d5b711481293305465a3a3c6a3a50dca984cdc8cca1f4c44f3c21bfa430cd9aac1a8782d9605e6954cbafb307beb6b1a52e9785de1bc3f71067d80c6b6e

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG23.PNG
                        Filesize

                        1KB

                        MD5

                        58c10711ee61290c5e53d6c235d14c7f

                        SHA1

                        6cd433f1d5224b7441efecfef8e0982bbda4415b

                        SHA256

                        2d8d51d2405fd3534f5fce5ffea5b9a100ce4aacf35caa7d165c7c6672949b35

                        SHA512

                        b895b6f07fefc06695cb521fa923534c8ef99312ab6c27295c86de29fc1bdb09e3ba17cd4aea75f8dd9cf7e1a3c4494a6ef960eadcb209eecb1b623d70c367f0

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNG
                        Filesize

                        45KB

                        MD5

                        32b9a83f00af4123b811eb6a85ee7971

                        SHA1

                        a1e6bdfe76e6103aca76bd21ce60c0b48e4de570

                        SHA256

                        a39a8cb1d54a2036257211b6364f84caf033fccf3394e9f890434563770e594d

                        SHA512

                        eb272c6dbaa3e59887cfdfd21dba5e2abc56a12beeda55ba091aa9b02da71af5ce11c0f7af4fb34f58da9836f91d787e26ab9f898b8669c861e9bacee973ca9f

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG41.PNG
                        Filesize

                        457B

                        MD5

                        19678bec078614865a71ade211a305f2

                        SHA1

                        9da7f2ff66044138863ed5d1dcf2fc7e90ffedf4

                        SHA256

                        d80c15c79946fbe8b3a6a5280f2509eed654338e53096fa6f22d280ad2f6263d

                        SHA512

                        b2894b6bbdb5ab639fcc615ff0d2b414fb517d9e1ea8062c61d23182056a0de02e118b9e43824b4765a8617dc4fd330c7f4187e3b395ee92c6ac5e893f242602

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG42.PNG
                        Filesize

                        352B

                        MD5

                        034eab9a50571cbab86294322e639886

                        SHA1

                        cae94b8cfe3ecce8e750d6fd34d54e766ea607aa

                        SHA256

                        449d678cc9a235d42a5a2f4e685536d9af87c6b5fc022f28dba32b08b4e88ee1

                        SHA512

                        b364c0cbb38bfb35e3c2d29705df72a8ce7dc111f04ebc05eceec4294987f18200581a31b78a79b05da890b5358e5463d1640d2230a8af930804efa3d4da42b0

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG45.PNG
                        Filesize

                        438B

                        MD5

                        87221bf8c9222a1489e949e4266a2980

                        SHA1

                        60c9d850f696e56b53dc3f940f52463d228febf2

                        SHA256

                        8d6e1d814dd38525115ee5d77e2d2ae6df8be31562a3c6805012097d6625efc4

                        SHA512

                        fa7ba5edb212a0ad70de123b1eabebd8d4cf5e2e3f59841330923c91d6ce6d8a0bbbf0176a8215a183ea860ae5286a4205b73f70df4d032cfd6c03109d1e433c

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG46.PNG
                        Filesize

                        206B

                        MD5

                        bc193c9f3fd0730341d2ba951f734652

                        SHA1

                        ebe3f410cf0bf5f30fe36b1c1df96fa27e73b01f

                        SHA256

                        e9137bc2fefbd9a3c4506708f283fe52c40b00b35c2677fc31e196b305b00e67

                        SHA512

                        355cb9a7ba6e2a77a51339bfa732537bc77d36da372fe926f1e4bf25de865b09c98122d9559f5ec234b41a83cb97de4fd49427a9476169653ac6058912261c1e

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG48.PNG
                        Filesize

                        1KB

                        MD5

                        9eb36caea38bf80ed9fa40a3f67597b7

                        SHA1

                        3c23e2e30119f6dd321d34a82a339d52723bfacc

                        SHA256

                        6be2e43a38969226e1cbb00605cdac634d0de3e82ce605b08dcf1cf596f64370

                        SHA512

                        22b57fc57d45ec73865e5429210d6016d2bab0cd990877c8272b4fc6ded8effe3bfa0c9b0890d7b0de8296e6bc3c262f29637b8ce7840efba2f963e70a978e53

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG5.PNG
                        Filesize

                        1KB

                        MD5

                        23e26969753c07af68f232cdd684c003

                        SHA1

                        f14666db750cc2f89ccdd8852b4259fcfa663271

                        SHA256

                        17f138eea95423738d2c9b75834b607c671cb2ac4d71c9aecf100a8b847003d2

                        SHA512

                        7c57a6309da9ae381073e005d374b9c8a82c7b4e92322b91433009d41f8f34655ed9d45958ab1743023faa9e7aa0c82a05d9292b078efccb64c19992b7e4d4d2

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG66.PNG
                        Filesize

                        41KB

                        MD5

                        7aae2de61d5e6296c00fde67046dfaeb

                        SHA1

                        87a65e99d520045c39997b53c6a0aa08cec35e57

                        SHA256

                        07b11e82a30598438ac4221d6c8796739c42c2a596365464f257481a37fa00c6

                        SHA512

                        c5ebaf43ffc19a1a3b2f49e070ea1d5532ae433c3bcd02493e31bd3389b6c3edfb1e04373902fbd252eb7370612dd96c3d36eb3fac8240111f57020ab99fa882

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG67.PNG
                        Filesize

                        1KB

                        MD5

                        0bde2ca44cd4e4e31c5c0364c66eb57b

                        SHA1

                        8496e4a8dcea6e42af33b503dc200d4a1ef07101

                        SHA256

                        38031284395ba7a773a335a861536b487bbf60b81496424b8a9a8a6697a919de

                        SHA512

                        4e60f45022b0c6739db94097401f6046e5f95b26dca71e685db834338451b7ea0b3ed3afc128d564c3f79074905b7986714f75925c41f763eda6b901875af555

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
                        Filesize

                        33KB

                        MD5

                        a89996e9fcdfb65825ae2757426c2f31

                        SHA1

                        e76d5dd08077237c71d3faf416929e443eef055a

                        SHA256

                        5c89af3dca4c2f52733afbdd2c6b86f7cf564ace3effde4994cd3467f28fd635

                        SHA512

                        cfea4bb518bcca00b43b0fc7cf9be57b2211b9676ef9df34b8e0322916185cb587eb4591327ac19cbd2be3eabacbbde3031615d649b93e81faeaf4abae355025

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
                        Filesize

                        7KB

                        MD5

                        f0bf0d81c150a6ddbbd7a90647c86a29

                        SHA1

                        3fb09dacfc01783636a3e9cbb470952ed2b1361d

                        SHA256

                        6e85cb185b8981361c6dca2cce34804d69a925fc3db036b4b26bca1847a416f8

                        SHA512

                        e669459d88e03e97a8d193e2582edce669920aadbdb8c55b1f9bf4467959bbca0eb7fbfccd12964820720062bb4a66e2e1657f2878b1f4df889f808ca58a5010

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
                        Filesize

                        40B

                        MD5

                        edb528311089399ab539bb679cc683b9

                        SHA1

                        cb5b65b635e340805d43132d14374a79d9dd2bda

                        SHA256

                        1f7d4770ae7bd532d593e6c50879590be5385b8979dbfb1e8d410e19e7b8b329

                        SHA512

                        e3cb52205dd45663c3126446e819937567d12f9a497b2f63ffbd8d6ff7f87605c6a8a93179e8b65cfa4bf16ae68998adede3a568e0151da11477350f7fee8915

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
                        Filesize

                        40B

                        MD5

                        edb528311089399ab539bb679cc683b9

                        SHA1

                        cb5b65b635e340805d43132d14374a79d9dd2bda

                        SHA256

                        1f7d4770ae7bd532d593e6c50879590be5385b8979dbfb1e8d410e19e7b8b329

                        SHA512

                        e3cb52205dd45663c3126446e819937567d12f9a497b2f63ffbd8d6ff7f87605c6a8a93179e8b65cfa4bf16ae68998adede3a568e0151da11477350f7fee8915

                        Download Submit

                      • C:\Windows\Installer\6dba5b.msi
                        Filesize

                        81.0MB

                        MD5

                        1794aaa17d114a315a95473c9780fc8b

                        SHA1

                        7f250c022b916b88e22254985e7552bc3ac8db04

                        SHA256

                        7682233d155e6d19f30cf61b185a02055be0dbcacd2c9accf90a99de21547eb4

                        SHA512

                        fb9defdf73786528e82ffc7e1ccfa03cfb687365ec740e9620993da785414306f03a7e1fa523192a9d690a882b012d1e426afd1757639f3ef5f1e612c01e6516

                        Download Submit

                      • C:\Windows\Installer\MSID0FB.tmp
                        Filesize

                        757KB

                        MD5

                        62cfeb86f117ad91b8bb52f1dda6f473

                        SHA1

                        c753b488938b3e08f7f47df209359c7b78764448

                        SHA256

                        f06cba20bd40e9d841add1877cf8d3b406f0acfa4800b80ae041ed3cc374eb7e

                        SHA512

                        c1b0e76cee4e2c3ca604dcc8f5665e72e70008acc824e20d89404f139d7e7e789e99dff131dafd76409f6ea0a813aa136f96089fbdadcf90d6485b1807762e4e

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
                        Filesize

                        2.7MB

                        MD5

                        77bf134f64f4545603f1150b819e3074

                        SHA1

                        8bbc23f285df4a4ea5f0f8704df28b16014ed057

                        SHA256

                        b1c8e2ca1bfb882ae6df705a33e9c3032830362d41cf7c055c74c5b1df70c58e

                        SHA512

                        bf630a064532cd97c000098e11a541c8e084fe9a940533515f34476f1dba243014e81b8ce1b07f378dcc8ebe9b7fbf14771ba4d4055626b560ec3cfec6b19618

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304141804001\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe
                        Filesize

                        1.7MB

                        MD5

                        b386cdcb413405daa8219af8e4cbd318

                        SHA1

                        ce275ff8514fef0629c915a6ee7b5ac481b9043d

                        SHA256

                        408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e

                        SHA512

                        91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304141804001\assistant\assistant_installer.exe
                        Filesize

                        2.1MB

                        MD5

                        2f3d9e21e232b9bfea064d3b2264db06

                        SHA1

                        bafddc657d8d1bb531683b29b0342cc065ee51d2

                        SHA256

                        25528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d

                        SHA512

                        94e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304141804001\opera_package
                        Filesize

                        86.9MB

                        MD5

                        6b7771354e081eb94cdbf7627799da4f

                        SHA1

                        199341a750443cc6e9b2b2fa1e657d0dd327711f

                        SHA256

                        494d1247e61eebf703a6eb19c14bde88edd2f85515fefa4f0465f43873e69aab

                        SHA512

                        33e781a102ba3f5c3b1895540bc9c43b78bf4f19af4b91ae0c765594f39d6569d1bad207b33f808426d8ebdcb00c419b7bb76bb050bae0bb843f96dd84355800

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304141804001\opera_package
                        Filesize

                        86.9MB

                        MD5

                        6b7771354e081eb94cdbf7627799da4f

                        SHA1

                        199341a750443cc6e9b2b2fa1e657d0dd327711f

                        SHA256

                        494d1247e61eebf703a6eb19c14bde88edd2f85515fefa4f0465f43873e69aab

                        SHA512

                        33e781a102ba3f5c3b1895540bc9c43b78bf4f19af4b91ae0c765594f39d6569d1bad207b33f808426d8ebdcb00c419b7bb76bb050bae0bb843f96dd84355800

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
                        Filesize

                        1.8MB

                        MD5

                        8d26aecef0a7bdac2b104454d3ba1a87

                        SHA1

                        50c29c58dfece62d94ed01cb5b3d070e593dc9cf

                        SHA256

                        e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

                        SHA512

                        0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
                        Filesize

                        1.8MB

                        MD5

                        8d26aecef0a7bdac2b104454d3ba1a87

                        SHA1

                        50c29c58dfece62d94ed01cb5b3d070e593dc9cf

                        SHA256

                        e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

                        SHA512

                        0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
                        Filesize

                        1.8MB

                        MD5

                        8d26aecef0a7bdac2b104454d3ba1a87

                        SHA1

                        50c29c58dfece62d94ed01cb5b3d070e593dc9cf

                        SHA256

                        e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

                        SHA512

                        0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
                        Filesize

                        1.8MB

                        MD5

                        8d26aecef0a7bdac2b104454d3ba1a87

                        SHA1

                        50c29c58dfece62d94ed01cb5b3d070e593dc9cf

                        SHA256

                        e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

                        SHA512

                        0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
                        Filesize

                        1.8MB

                        MD5

                        8d26aecef0a7bdac2b104454d3ba1a87

                        SHA1

                        50c29c58dfece62d94ed01cb5b3d070e593dc9cf

                        SHA256

                        e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

                        SHA512

                        0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
                        Filesize

                        1.8MB

                        MD5

                        8d26aecef0a7bdac2b104454d3ba1a87

                        SHA1

                        50c29c58dfece62d94ed01cb5b3d070e593dc9cf

                        SHA256

                        e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

                        SHA512

                        0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\Opera_installer_2304141803548611592.dll
                        Filesize

                        4.6MB

                        MD5

                        4fa000d2daf4a9a8b30a36de57343e8b

                        SHA1

                        4865161c5ec70cce04079a6cbf08795e05bacbf1

                        SHA256

                        50df18de18d3cdd5cc21f8fc0dbabbe5a60690027b82af25806f679f492065de

                        SHA512

                        a52620ab7ae4e8a6c7379790fc70c5cc611a06432b83ded0a7ea476a647098fcb18797b42ed98293c3e9dd955d784819638597e3b1b419f54eeb9a0084b625ca

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\Opera_installer_2304141803552512956.dll
                        Filesize

                        4.6MB

                        MD5

                        4fa000d2daf4a9a8b30a36de57343e8b

                        SHA1

                        4865161c5ec70cce04079a6cbf08795e05bacbf1

                        SHA256

                        50df18de18d3cdd5cc21f8fc0dbabbe5a60690027b82af25806f679f492065de

                        SHA512

                        a52620ab7ae4e8a6c7379790fc70c5cc611a06432b83ded0a7ea476a647098fcb18797b42ed98293c3e9dd955d784819638597e3b1b419f54eeb9a0084b625ca

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\Opera_installer_2304141804003992448.dll
                        Filesize

                        4.6MB

                        MD5

                        4fa000d2daf4a9a8b30a36de57343e8b

                        SHA1

                        4865161c5ec70cce04079a6cbf08795e05bacbf1

                        SHA256

                        50df18de18d3cdd5cc21f8fc0dbabbe5a60690027b82af25806f679f492065de

                        SHA512

                        a52620ab7ae4e8a6c7379790fc70c5cc611a06432b83ded0a7ea476a647098fcb18797b42ed98293c3e9dd955d784819638597e3b1b419f54eeb9a0084b625ca

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\Opera_installer_2304141804007422736.dll
                        Filesize

                        4.6MB

                        MD5

                        4fa000d2daf4a9a8b30a36de57343e8b

                        SHA1

                        4865161c5ec70cce04079a6cbf08795e05bacbf1

                        SHA256

                        50df18de18d3cdd5cc21f8fc0dbabbe5a60690027b82af25806f679f492065de

                        SHA512

                        a52620ab7ae4e8a6c7379790fc70c5cc611a06432b83ded0a7ea476a647098fcb18797b42ed98293c3e9dd955d784819638597e3b1b419f54eeb9a0084b625ca

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\Opera_installer_2304141804009452648.dll
                        Filesize

                        4.6MB

                        MD5

                        4fa000d2daf4a9a8b30a36de57343e8b

                        SHA1

                        4865161c5ec70cce04079a6cbf08795e05bacbf1

                        SHA256

                        50df18de18d3cdd5cc21f8fc0dbabbe5a60690027b82af25806f679f492065de

                        SHA512

                        a52620ab7ae4e8a6c7379790fc70c5cc611a06432b83ded0a7ea476a647098fcb18797b42ed98293c3e9dd955d784819638597e3b1b419f54eeb9a0084b625ca

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
                        Filesize

                        1.7MB

                        MD5

                        1bbf5dd0b6ca80e4c7c77495c3f33083

                        SHA1

                        e0520037e60eb641ec04d1e814394c9da0a6a862

                        SHA256

                        bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

                        SHA512

                        97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
                        Filesize

                        97KB

                        MD5

                        da1d0cd400e0b6ad6415fd4d90f69666

                        SHA1

                        de9083d2902906cacf57259cf581b1466400b799

                        SHA256

                        7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

                        SHA512

                        f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                        Filesize

                        1.3MB

                        MD5

                        f8da4bc14cb40b7ff8cd2c798ca0f7b9

                        SHA1

                        1264c77f79f7a328d60dfd752e721a463fc3e247

                        SHA256

                        3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1

                        SHA512

                        0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                        Filesize

                        1.3MB

                        MD5

                        f8da4bc14cb40b7ff8cd2c798ca0f7b9

                        SHA1

                        1264c77f79f7a328d60dfd752e721a463fc3e247

                        SHA256

                        3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1

                        SHA512

                        0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                        Filesize

                        1.3MB

                        MD5

                        f8da4bc14cb40b7ff8cd2c798ca0f7b9

                        SHA1

                        1264c77f79f7a328d60dfd752e721a463fc3e247

                        SHA256

                        3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1

                        SHA512

                        0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                        Filesize

                        1.3MB

                        MD5

                        f8da4bc14cb40b7ff8cd2c798ca0f7b9

                        SHA1

                        1264c77f79f7a328d60dfd752e721a463fc3e247

                        SHA256

                        3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1

                        SHA512

                        0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                        Filesize

                        1.3MB

                        MD5

                        f8da4bc14cb40b7ff8cd2c798ca0f7b9

                        SHA1

                        1264c77f79f7a328d60dfd752e721a463fc3e247

                        SHA256

                        3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1

                        SHA512

                        0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
                        Filesize

                        326KB

                        MD5

                        80d93d38badecdd2b134fe4699721223

                        SHA1

                        e829e58091bae93bc64e0c6f9f0bac999cfda23d

                        SHA256

                        c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                        SHA512

                        9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                        Filesize

                        1.3MB

                        MD5

                        018c68cdf5ba005b4a380c20b13fee4c

                        SHA1

                        bf6043fbd31288e8667fcfc37cd74414bee1805f

                        SHA256

                        3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

                        SHA512

                        506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                        Filesize

                        1.3MB

                        MD5

                        018c68cdf5ba005b4a380c20b13fee4c

                        SHA1

                        bf6043fbd31288e8667fcfc37cd74414bee1805f

                        SHA256

                        3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

                        SHA512

                        506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                        Filesize

                        1.3MB

                        MD5

                        018c68cdf5ba005b4a380c20b13fee4c

                        SHA1

                        bf6043fbd31288e8667fcfc37cd74414bee1805f

                        SHA256

                        3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

                        SHA512

                        506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                        Filesize

                        1.3MB

                        MD5

                        018c68cdf5ba005b4a380c20b13fee4c

                        SHA1

                        bf6043fbd31288e8667fcfc37cd74414bee1805f

                        SHA256

                        3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

                        SHA512

                        506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                        Filesize

                        1.3MB

                        MD5

                        018c68cdf5ba005b4a380c20b13fee4c

                        SHA1

                        bf6043fbd31288e8667fcfc37cd74414bee1805f

                        SHA256

                        3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

                        SHA512

                        506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
                        Filesize

                        326KB

                        MD5

                        80d93d38badecdd2b134fe4699721223

                        SHA1

                        e829e58091bae93bc64e0c6f9f0bac999cfda23d

                        SHA256

                        c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                        SHA512

                        9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\jre-windows.exe
                        Filesize

                        84.5MB

                        MD5

                        7542ec421a2f6e90751e8b64c22e0542

                        SHA1

                        d207d221a28ede5c2c8415f82c555989aa7068ba

                        SHA256

                        188ca8ecc44de1b7f602e883c3054dc392792c3631bf362b1bc4f3e1dba323e6

                        SHA512

                        8987bf8aa1b401815fa9850e56954db6015bdd06ce78b65ba435724582ffa615dee4e1452fa237c53257dca8ee97b469d01c27757a5f070ce6f807a4f81094bc

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                        Filesize

                        2.7MB

                        MD5

                        77bf134f64f4545603f1150b819e3074

                        SHA1

                        8bbc23f285df4a4ea5f0f8704df28b16014ed057

                        SHA256

                        b1c8e2ca1bfb882ae6df705a33e9c3032830362d41cf7c055c74c5b1df70c58e

                        SHA512

                        bf630a064532cd97c000098e11a541c8e084fe9a940533515f34476f1dba243014e81b8ce1b07f378dcc8ebe9b7fbf14771ba4d4055626b560ec3cfec6b19618

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                        Filesize

                        2.7MB

                        MD5

                        77bf134f64f4545603f1150b819e3074

                        SHA1

                        8bbc23f285df4a4ea5f0f8704df28b16014ed057

                        SHA256

                        b1c8e2ca1bfb882ae6df705a33e9c3032830362d41cf7c055c74c5b1df70c58e

                        SHA512

                        bf630a064532cd97c000098e11a541c8e084fe9a940533515f34476f1dba243014e81b8ce1b07f378dcc8ebe9b7fbf14771ba4d4055626b560ec3cfec6b19618

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                        Filesize

                        2.7MB

                        MD5

                        77bf134f64f4545603f1150b819e3074

                        SHA1

                        8bbc23f285df4a4ea5f0f8704df28b16014ed057

                        SHA256

                        b1c8e2ca1bfb882ae6df705a33e9c3032830362d41cf7c055c74c5b1df70c58e

                        SHA512

                        bf630a064532cd97c000098e11a541c8e084fe9a940533515f34476f1dba243014e81b8ce1b07f378dcc8ebe9b7fbf14771ba4d4055626b560ec3cfec6b19618

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                        Filesize

                        2.7MB

                        MD5

                        77bf134f64f4545603f1150b819e3074

                        SHA1

                        8bbc23f285df4a4ea5f0f8704df28b16014ed057

                        SHA256

                        b1c8e2ca1bfb882ae6df705a33e9c3032830362d41cf7c055c74c5b1df70c58e

                        SHA512

                        bf630a064532cd97c000098e11a541c8e084fe9a940533515f34476f1dba243014e81b8ce1b07f378dcc8ebe9b7fbf14771ba4d4055626b560ec3cfec6b19618

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                        Filesize

                        2.7MB

                        MD5

                        77bf134f64f4545603f1150b819e3074

                        SHA1

                        8bbc23f285df4a4ea5f0f8704df28b16014ed057

                        SHA256

                        b1c8e2ca1bfb882ae6df705a33e9c3032830362d41cf7c055c74c5b1df70c58e

                        SHA512

                        bf630a064532cd97c000098e11a541c8e084fe9a940533515f34476f1dba243014e81b8ce1b07f378dcc8ebe9b7fbf14771ba4d4055626b560ec3cfec6b19618

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                        Filesize

                        2.7MB

                        MD5

                        77bf134f64f4545603f1150b819e3074

                        SHA1

                        8bbc23f285df4a4ea5f0f8704df28b16014ed057

                        SHA256

                        b1c8e2ca1bfb882ae6df705a33e9c3032830362d41cf7c055c74c5b1df70c58e

                        SHA512

                        bf630a064532cd97c000098e11a541c8e084fe9a940533515f34476f1dba243014e81b8ce1b07f378dcc8ebe9b7fbf14771ba4d4055626b560ec3cfec6b19618

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                        Filesize

                        2.7MB

                        MD5

                        77bf134f64f4545603f1150b819e3074

                        SHA1

                        8bbc23f285df4a4ea5f0f8704df28b16014ed057

                        SHA256

                        b1c8e2ca1bfb882ae6df705a33e9c3032830362d41cf7c055c74c5b1df70c58e

                        SHA512

                        bf630a064532cd97c000098e11a541c8e084fe9a940533515f34476f1dba243014e81b8ce1b07f378dcc8ebe9b7fbf14771ba4d4055626b560ec3cfec6b19618

                        Download Submit

                      • memory/912-72-0x0000000002D70000-0x0000000003158000-memory.dmp

                        Filesize

                        3.9MB

                        Download

                      • memory/912-71-0x0000000002D70000-0x0000000003158000-memory.dmp

                        Filesize

                        3.9MB

                        Download

                      • memory/1084-686-0x00000000054E0000-0x0000000005A18000-memory.dmp

                        Filesize

                        5.2MB

                        Download

                      • memory/1084-1348-0x00000000054E0000-0x0000000005A18000-memory.dmp

                        Filesize

                        5.2MB

                        Download

                      • memory/1084-1355-0x0000000001240000-0x0000000001628000-memory.dmp

                        Filesize

                        3.9MB

                        Download

                      • memory/1084-1649-0x0000000001240000-0x0000000001628000-memory.dmp

                        Filesize

                        3.9MB

                        Download

                      • memory/1084-1442-0x0000000000CE0000-0x0000000000CF0000-memory.dmp

                        Filesize

                        64KB

                        Download

                      • memory/1084-575-0x0000000000CE0000-0x0000000000CF0000-memory.dmp

                        Filesize

                        64KB

                        Download

                      • memory/1084-1349-0x00000000054E0000-0x0000000005A18000-memory.dmp

                        Filesize

                        5.2MB

                        Download

                      • memory/1084-683-0x00000000054E0000-0x0000000005A18000-memory.dmp

                        Filesize

                        5.2MB

                        Download

                      • memory/1084-483-0x0000000001240000-0x0000000001628000-memory.dmp

                        Filesize

                        3.9MB

                        Download

                      • memory/1592-1350-0x00000000008E0000-0x0000000000E18000-memory.dmp

                        Filesize

                        5.2MB

                        Download

                      • memory/1592-1418-0x0000000003CA0000-0x00000000041D8000-memory.dmp

                        Filesize

                        5.2MB

                        Download

                      • memory/1592-1354-0x0000000002B70000-0x00000000030A8000-memory.dmp

                        Filesize

                        5.2MB

                        Download

                      • memory/1612-480-0x0000000002CB0000-0x0000000003098000-memory.dmp

                        Filesize

                        3.9MB

                        Download

                      • memory/1612-482-0x0000000002CB0000-0x0000000003098000-memory.dmp

                        Filesize

                        3.9MB

                        Download

                      • memory/1612-1439-0x0000000002CB0000-0x0000000003098000-memory.dmp

                        Filesize

                        3.9MB

                        Download

                      • memory/1612-481-0x0000000002CB0000-0x0000000003098000-memory.dmp

                        Filesize

                        3.9MB

                        Download

                      • memory/2036-391-0x0000000010000000-0x0000000010051000-memory.dmp

                        Filesize

                        324KB

                        Download

                      • memory/2036-1828-0x0000000000190000-0x0000000000578000-memory.dmp

                        Filesize

                        3.9MB

                        Download

                      • memory/2036-1515-0x0000000010000000-0x0000000010051000-memory.dmp

                        Filesize

                        324KB

                        Download

                      • memory/2036-1503-0x0000000000190000-0x0000000000578000-memory.dmp

                        Filesize

                        3.9MB

                        Download

                      • memory/2036-1437-0x0000000000190000-0x0000000000578000-memory.dmp

                        Filesize

                        3.9MB

                        Download

                      • memory/2036-368-0x0000000010000000-0x0000000010051000-memory.dmp

                        Filesize

                        324KB

                        Download

                      • memory/2036-367-0x0000000000190000-0x0000000000578000-memory.dmp

                        Filesize

                        3.9MB

                        Download

                      • memory/2036-74-0x0000000000190000-0x0000000000578000-memory.dmp

                        Filesize

                        3.9MB

                        Download

                      • memory/2036-1417-0x0000000010000000-0x0000000010051000-memory.dmp

                        Filesize

                        324KB

                        Download

                      • memory/2036-1416-0x0000000000190000-0x0000000000578000-memory.dmp

                        Filesize

                        3.9MB

                        Download

                      • memory/2036-440-0x0000000003260000-0x0000000003270000-memory.dmp

                        Filesize

                        64KB

                        Download

                      • memory/2036-424-0x0000000010000000-0x0000000010051000-memory.dmp

                        Filesize

                        324KB

                        Download

                      • memory/2036-365-0x0000000010000000-0x0000000010051000-memory.dmp

                        Filesize

                        324KB

                        Download

                      • memory/2036-423-0x0000000000190000-0x0000000000578000-memory.dmp

                        Filesize

                        3.9MB

                        Download

                      • memory/2036-1799-0x0000000000190000-0x0000000000578000-memory.dmp

                        Filesize

                        3.9MB

                        Download

                      • memory/2036-366-0x0000000000E60000-0x0000000000E63000-memory.dmp

                        Filesize

                        12KB

                        Download

                      • memory/2036-567-0x0000000000190000-0x0000000000578000-memory.dmp

                        Filesize

                        3.9MB

                        Download

                      • memory/2036-390-0x0000000000190000-0x0000000000578000-memory.dmp

                        Filesize

                        3.9MB

                        Download

                      • memory/2036-389-0x0000000000190000-0x0000000000578000-memory.dmp

                        Filesize

                        3.9MB

                        Download

                      • memory/2448-1366-0x0000000000AC0000-0x0000000000FF8000-memory.dmp

                        Filesize

                        5.2MB

                        Download

                      • memory/2448-1365-0x0000000000AC0000-0x0000000000FF8000-memory.dmp

                        Filesize

                        5.2MB

                        Download

                      • memory/2560-2061-0x0000000000230000-0x0000000000247000-memory.dmp

                        Filesize

                        92KB

                        Download

                      • memory/2560-2060-0x0000000000230000-0x0000000000247000-memory.dmp

                        Filesize

                        92KB

                        Download

                      • memory/2560-2072-0x0000000000400000-0x0000000000417000-memory.dmp

                        Filesize

                        92KB

                        Download

                      • memory/2560-2059-0x0000000000230000-0x0000000000247000-memory.dmp

                        Filesize

                        92KB

                        Download

                      • memory/2560-2056-0x0000000000400000-0x0000000000417000-memory.dmp

                        Filesize

                        92KB

                        Download

                      • memory/2648-1421-0x00000000008E0000-0x0000000000E18000-memory.dmp

                        Filesize

                        5.2MB

                        Download

                      • memory/2736-1419-0x00000000008E0000-0x0000000000E18000-memory.dmp

                        Filesize

                        5.2MB

                        Download

                      • memory/2736-1420-0x0000000002C00000-0x0000000003138000-memory.dmp

                        Filesize

                        5.2MB

                        Download

                      • memory/2956-1357-0x00000000008E0000-0x0000000000E18000-memory.dmp

                        Filesize

                        5.2MB

                        Download

                      • memory/2972-1796-0x0000000000400000-0x0000000000417000-memory.dmp

                        Filesize

                        92KB

                        Download