Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    34s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/04/2023, 16:38

General

  • Target

    TLauncher-2.879-Installer-1.1.0.exe

  • Size

    22.6MB

  • MD5

    601b94e3b018e39e0da90881fe89156d

  • SHA1

    dc5340d6e1cb98c6ae2fa6882a4c7284e990705b

  • SHA256

    845b0953c143daf9382b38c8ac7faeef62d5298bb0191f1be60865f78a942bac

  • SHA512

    493c283aa3e201501843e59d593d82b3c98d2628639c95c977c9f22c268d89f7b072907d7b5d244fb7f122348277a97f7d68ce0ebdb36d7fc479c5f3c5bd33db

  • SSDEEP

    393216:+Xj4yibrRbGPfs/dQETVlOBbpFEjdGphRqV56Hpkf+V4scTKAjENq+:+zCrRsHExi73qqHpg+Vvc+AmX

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 9 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 29 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.0.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.0.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3128
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.0.exe" "__IRCT:3" "__IRTSS:23652861" "__IRSID:S-1-5-21-1013461898-3711306144-4198452673-1000"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2320
      • C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
        "C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1432
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816850 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:1841947" "__IRSID:S-1-5-21-1013461898-3711306144-4198452673-1000"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:388
          • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
            "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Enumerates connected drives
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2508
            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=97.0.4719.63 --initial-client-data=0x340,0x344,0x348,0x31c,0x34c,0x6f6833e0,0x6f6833f0,0x6f6833fc
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:2924
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe" --version
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:3852
            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=2508 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20230415183905" --session-guid=d63bc819-405b-41d3-953b-a4aa906e7f8f --server-tracking-blob="ZDE0YTRkODgzNTBiYjYxYjg3YWJmYjAzYjM1YTVkMjk2ODllYzhjNTZiZjJjMTY5NDVmYTI0YjM2NWJjYzRmZjp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTY4MTU3Njc0NS43NDQ0IiwidXNlcmFnZW50IjoiU2V0dXAgRmFjdG9yeSA5LjAiLCJ1dG0iOnsiY2FtcGFpZ24iOiJPcGVyYURlc2t0b3AiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJNU1RMIn0sInV1aWQiOiJhZmYzZjIxYy0xODY2LTQ3MzktYTliYy0zMWI4NzIyZTUwZWEifQ== " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=A805000000000000
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Enumerates connected drives
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4968
              • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=97.0.4719.63 --initial-client-data=0x34c,0x350,0x354,0x31c,0x358,0x6eb633e0,0x6eb633f0,0x6eb633fc
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:4416
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304151839051\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304151839051\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe"
              6⤵
                PID:1876
              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304151839051\assistant\assistant_installer.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304151839051\assistant\assistant_installer.exe" --version
                6⤵
                  PID:4164
                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304151839051\assistant\assistant_installer.exe
                    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304151839051\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=96.0.4693.50 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x2fc,0xff6c28,0xff6c38,0xff6c44
                    7⤵
                      PID:1184
            • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
              "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
              3⤵
                PID:4704
                • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
                  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
                  4⤵
                    PID:4684
            • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
              "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
              1⤵
                PID:4736
                • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
                  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
                  2⤵
                    PID:3040

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

                  Filesize

                  50B

                  MD5

                  33333399e6fea549d2582f715eae5193

                  SHA1

                  b19f29cd14d20ba95c3f6e4109625aa6ff9a8ecf

                  SHA256

                  78363ffc005f240272b7eb5fb01fbdea6f55a5a6ababdf0accc26ac245e25240

                  SHA512

                  5447d74c623dd41b6a8310315a11ef199828c0106771c026d610e4c076d1f93112ce39aca4e19b4cfa3fd384c251d75f529f6329e6f4c6de480db7aaf7fd0b09

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

                  Filesize

                  471B

                  MD5

                  01cb3a21f691d1dc131dd189ecfca45c

                  SHA1

                  3368e839745be86b82ed13818723d138507fd30d

                  SHA256

                  d520c174e07224d5752ca75ad2a822e73c93fbe4528b78ee590a1a7f921e7a26

                  SHA512

                  15e8f10f11ef12331cb948840517140d39d1ea7b20bb36a465b030a3faca6cef2701ae7ef51f3c5919c37d12babcbbc34cacb198ae464bc7dd3219e4960f09c6

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

                  Filesize

                  404B

                  MD5

                  4e7fc135621a79d503d05a642a11b097

                  SHA1

                  a91316f2495fa4f5d94feaff52a80db5037de07f

                  SHA256

                  3e8a339d57bd84f75c6e30d03534cda62a9be8c14a12a3096d3b0151d96acd8f

                  SHA512

                  bfc6d124b9fce31d7f63d14e213254bfead3ca09bd5e3eea92fdb4f40e0e66c44145bf509cc6c8c2299b8820d7df14d1f1f76ad10cdf79fce1950b77b9544857

                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe

                  Filesize

                  2.7MB

                  MD5

                  838b154df03c5a9a074dc88ee98cecf9

                  SHA1

                  d92560ae6d31598cb96825b3ec461518d638c9a8

                  SHA256

                  f73b4d2dbbe3343f2bfb9e6664e5e6f5f7c38b1f2bb9cfb8ee73a80f6c92b38f

                  SHA512

                  b2c6d3afc6af488b40d9cbb0bbb60a70eaa4abe6999ba4f8dc7c96cae4dc14e2876e06d25d602b5cfb05bafda805f6d2647d24dace74363f3790cf5dc0b5302b

                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe

                  Filesize

                  2.7MB

                  MD5

                  838b154df03c5a9a074dc88ee98cecf9

                  SHA1

                  d92560ae6d31598cb96825b3ec461518d638c9a8

                  SHA256

                  f73b4d2dbbe3343f2bfb9e6664e5e6f5f7c38b1f2bb9cfb8ee73a80f6c92b38f

                  SHA512

                  b2c6d3afc6af488b40d9cbb0bbb60a70eaa4abe6999ba4f8dc7c96cae4dc14e2876e06d25d602b5cfb05bafda805f6d2647d24dace74363f3790cf5dc0b5302b

                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304151839051\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe

                  Filesize

                  1.7MB

                  MD5

                  b386cdcb413405daa8219af8e4cbd318

                  SHA1

                  ce275ff8514fef0629c915a6ee7b5ac481b9043d

                  SHA256

                  408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e

                  SHA512

                  91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304151839051\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe

                  Filesize

                  1.7MB

                  MD5

                  b386cdcb413405daa8219af8e4cbd318

                  SHA1

                  ce275ff8514fef0629c915a6ee7b5ac481b9043d

                  SHA256

                  408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e

                  SHA512

                  91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304151839051\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe

                  Filesize

                  1.7MB

                  MD5

                  b386cdcb413405daa8219af8e4cbd318

                  SHA1

                  ce275ff8514fef0629c915a6ee7b5ac481b9043d

                  SHA256

                  408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e

                  SHA512

                  91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304151839051\assistant\assistant_installer.exe

                  Filesize

                  2.1MB

                  MD5

                  2f3d9e21e232b9bfea064d3b2264db06

                  SHA1

                  bafddc657d8d1bb531683b29b0342cc065ee51d2

                  SHA256

                  25528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d

                  SHA512

                  94e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5

                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304151839051\assistant\assistant_installer.exe

                  Filesize

                  2.1MB

                  MD5

                  2f3d9e21e232b9bfea064d3b2264db06

                  SHA1

                  bafddc657d8d1bb531683b29b0342cc065ee51d2

                  SHA256

                  25528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d

                  SHA512

                  94e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5

                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304151839051\assistant\assistant_installer.exe

                  Filesize

                  2.1MB

                  MD5

                  2f3d9e21e232b9bfea064d3b2264db06

                  SHA1

                  bafddc657d8d1bb531683b29b0342cc065ee51d2

                  SHA256

                  25528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d

                  SHA512

                  94e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5

                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304151839051\opera_package

                  Filesize

                  89.4MB

                  MD5

                  c6735cc32afff2727b6ea386243b7c4a

                  SHA1

                  2745341cb2da9194e8db834d98aa58e9121df7d8

                  SHA256

                  05f443431f03df5610953680aed2e08b888879d6c3e79ed969b2ebb89380b94b

                  SHA512

                  f83a092dc9d598044e6cbbc9fec5a09540ee3d049441c33d66c0122494a93a0ea2a8a28777fd0fb8897665ecc306b5d76fdc14b0fb9e879f48ca1c4f68ded7b2

                • C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

                  Filesize

                  1.8MB

                  MD5

                  8d26aecef0a7bdac2b104454d3ba1a87

                  SHA1

                  50c29c58dfece62d94ed01cb5b3d070e593dc9cf

                  SHA256

                  e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

                  SHA512

                  0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

                • C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

                  Filesize

                  1.8MB

                  MD5

                  8d26aecef0a7bdac2b104454d3ba1a87

                  SHA1

                  50c29c58dfece62d94ed01cb5b3d070e593dc9cf

                  SHA256

                  e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

                  SHA512

                  0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

                • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2304151839049222508.dll

                  Filesize

                  4.6MB

                  MD5

                  4fa000d2daf4a9a8b30a36de57343e8b

                  SHA1

                  4865161c5ec70cce04079a6cbf08795e05bacbf1

                  SHA256

                  50df18de18d3cdd5cc21f8fc0dbabbe5a60690027b82af25806f679f492065de

                  SHA512

                  a52620ab7ae4e8a6c7379790fc70c5cc611a06432b83ded0a7ea476a647098fcb18797b42ed98293c3e9dd955d784819638597e3b1b419f54eeb9a0084b625ca

                • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2304151839052342924.dll

                  Filesize

                  4.6MB

                  MD5

                  4fa000d2daf4a9a8b30a36de57343e8b

                  SHA1

                  4865161c5ec70cce04079a6cbf08795e05bacbf1

                  SHA256

                  50df18de18d3cdd5cc21f8fc0dbabbe5a60690027b82af25806f679f492065de

                  SHA512

                  a52620ab7ae4e8a6c7379790fc70c5cc611a06432b83ded0a7ea476a647098fcb18797b42ed98293c3e9dd955d784819638597e3b1b419f54eeb9a0084b625ca

                • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2304151839052342924.dll

                  Filesize

                  4.6MB

                  MD5

                  4fa000d2daf4a9a8b30a36de57343e8b

                  SHA1

                  4865161c5ec70cce04079a6cbf08795e05bacbf1

                  SHA256

                  50df18de18d3cdd5cc21f8fc0dbabbe5a60690027b82af25806f679f492065de

                  SHA512

                  a52620ab7ae4e8a6c7379790fc70c5cc611a06432b83ded0a7ea476a647098fcb18797b42ed98293c3e9dd955d784819638597e3b1b419f54eeb9a0084b625ca

                • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2304151839054523852.dll

                  Filesize

                  4.6MB

                  MD5

                  4fa000d2daf4a9a8b30a36de57343e8b

                  SHA1

                  4865161c5ec70cce04079a6cbf08795e05bacbf1

                  SHA256

                  50df18de18d3cdd5cc21f8fc0dbabbe5a60690027b82af25806f679f492065de

                  SHA512

                  a52620ab7ae4e8a6c7379790fc70c5cc611a06432b83ded0a7ea476a647098fcb18797b42ed98293c3e9dd955d784819638597e3b1b419f54eeb9a0084b625ca

                • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2304151839057964968.dll

                  Filesize

                  4.6MB

                  MD5

                  4fa000d2daf4a9a8b30a36de57343e8b

                  SHA1

                  4865161c5ec70cce04079a6cbf08795e05bacbf1

                  SHA256

                  50df18de18d3cdd5cc21f8fc0dbabbe5a60690027b82af25806f679f492065de

                  SHA512

                  a52620ab7ae4e8a6c7379790fc70c5cc611a06432b83ded0a7ea476a647098fcb18797b42ed98293c3e9dd955d784819638597e3b1b419f54eeb9a0084b625ca

                • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2304151839059994416.dll

                  Filesize

                  4.6MB

                  MD5

                  4fa000d2daf4a9a8b30a36de57343e8b

                  SHA1

                  4865161c5ec70cce04079a6cbf08795e05bacbf1

                  SHA256

                  50df18de18d3cdd5cc21f8fc0dbabbe5a60690027b82af25806f679f492065de

                  SHA512

                  a52620ab7ae4e8a6c7379790fc70c5cc611a06432b83ded0a7ea476a647098fcb18797b42ed98293c3e9dd955d784819638597e3b1b419f54eeb9a0084b625ca

                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico

                  Filesize

                  116KB

                  MD5

                  e043a9cb014d641a56f50f9d9ac9a1b9

                  SHA1

                  61dc6aed3d0d1f3b8afe3d161410848c565247ed

                  SHA256

                  9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946

                  SHA512

                  4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe

                  Filesize

                  1.8MB

                  MD5

                  8d26aecef0a7bdac2b104454d3ba1a87

                  SHA1

                  50c29c58dfece62d94ed01cb5b3d070e593dc9cf

                  SHA256

                  e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

                  SHA512

                  0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.PNG

                  Filesize

                  339B

                  MD5

                  a45137507477ea159a4c0481fadbdde8

                  SHA1

                  772e535525cd41abb781167334f923f1127f6d24

                  SHA256

                  fcc6693f94f87dbb9f03bd664f029db87257c79ac9a974d2caadc790f20ea67a

                  SHA512

                  393a8d9387b388524fbf7bc8387d521c830e7d384aabe278251cb4fa1291d32e2875c464a01f93670259bc2009d69507b632a692d43244f3eb7551414c9d635a

                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG104.PNG

                  Filesize

                  644B

                  MD5

                  f54bbaadafacf2ed607c2b44e76bd5f2

                  SHA1

                  e6e313e86b0adb771643dc9aa465652646d83329

                  SHA256

                  2dcd3efb7e14a1439973b066c810eb3187cb851a7d01b2a03376d978b6b0d927

                  SHA512

                  1d7f940d290c3c7eca12739f7e4753901a1d070ca9f43171b4fe25530ba48b3b376c16b125a32d6e701d63d576ef829824472bcac99e568784543bfc4c50b732

                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG106.PNG

                  Filesize

                  1KB

                  MD5

                  f785bd0f38d4132c404ab3233bb1766b

                  SHA1

                  7c8f01921d026646289d92d4e08529482f2dd881

                  SHA256

                  4ddf6c789a700dbbca5c405f6b9625e2dee8d6e279f8629eb1e451e5040fbd0e

                  SHA512

                  45f806a91993918177e838ac21bf59f37e2000aeefa191d0b538e156165eac82309cc0c67b5379bdaa7f7bbbc97ae25ffd741a6c35c07377a893721442811573

                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG108.PNG

                  Filesize

                  2KB

                  MD5

                  c70b569d43f5e00ee3dd81530899f191

                  SHA1

                  38b7f73c29d9d355625bf7dcc611d657c263dbc4

                  SHA256

                  778c8b5a8e7422ce84f4113fc1cbd90204f3b3c0b3bb8545b3fe68003525e9e8

                  SHA512

                  f0aafa93ffd1edb8764f7e435fa982b0eb596b1962472dcefac26731382c58d44306e876f04675146595a1e7ee6ae8170e2fa01ed0fca075e36a9749709f4df7

                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG19.PNG

                  Filesize

                  1KB

                  MD5

                  362d3183b2acc152c99ec123611f3297

                  SHA1

                  3db69a12917cb11a14fb9294d73c5409fe11a398

                  SHA256

                  8ae66727c5c92ca76a131aa104cc126858e8e3ed490ae08482109dfedd9a8cda

                  SHA512

                  2c7f40564479d1fe90cb59b4b413e8bf9a5bb7cd2f94193f8759e376549c0269afce030df7d306b4cd814f604ad460d744fb00d961f6d2608a4ecb6b186a4f1f

                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.PNG

                  Filesize

                  280B

                  MD5

                  01e097a324673878a3cb5e8e0f3cf152

                  SHA1

                  35ef5c438eca9672c7ee19bcde3952f83dc77928

                  SHA256

                  d8d0719a20d267a73d298d2ec1fbc050fe2ce25447c7441058ea3966acfbbb22

                  SHA512

                  e873763e96b3a52fe73f3fc9b3bcfd764c807c0206b5984d5f7dddd7debec4e6f0b6705ca6a7c6379b83c2fea792d7a16880ea109469ac1af41cc7bdb5f96e27

                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.PNG

                  Filesize

                  281B

                  MD5

                  d88e18e2a020a756a8de999b76e7b1fd

                  SHA1

                  150f801600b9427039197847aaac784f8ba15258

                  SHA256

                  38b8f2202a5e48a8f528708922f504379896ef52b3882ce82efc3481c51804bb

                  SHA512

                  d048a569d155aa4636f25ed2963fd5e2234643735ad461df3ad3201cbe152b646c2893557a236fa9683aa3cb07351fa79b9e5788f631442e5142cab0bc98654a

                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG85.PNG

                  Filesize

                  43KB

                  MD5

                  16c0e37cb0c5540fd9f93a8d82d94e52

                  SHA1

                  52d5aabf804381b47d13a358d80256c4088eec21

                  SHA256

                  2b772e66ebc70c93deb0b9a9e054373ee33d9245809e16174b1f132f786a063f

                  SHA512

                  dd54308739f9621f5fe707c69f24657431fd58b46e357a79d25c3d8e96d3b2914ce19d94beeee0bbd32311737670f06b01c364f0c7d70625a4246da64c29b0af

                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG86.PNG

                  Filesize

                  1KB

                  MD5

                  a7a8625948d61d814dbb29225e04f908

                  SHA1

                  16bc91a8bb3c22cf78447644a32010ad869eaf99

                  SHA256

                  61979f700f77d187c8647cba3bee95ca4a70e187bbb76323f4055385dd8879d5

                  SHA512

                  04b0bb58095a6e8f1d29203f21eee99fd837494b74736e91e5e304eb3dc3ccb32796b6959361ede965731b76607a53b0f9d211cb4b3d94b25ea34898e760d295

                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

                  Filesize

                  1.7MB

                  MD5

                  1bbf5dd0b6ca80e4c7c77495c3f33083

                  SHA1

                  e0520037e60eb641ec04d1e814394c9da0a6a862

                  SHA256

                  bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

                  SHA512

                  97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

                  Filesize

                  1.7MB

                  MD5

                  1bbf5dd0b6ca80e4c7c77495c3f33083

                  SHA1

                  e0520037e60eb641ec04d1e814394c9da0a6a862

                  SHA256

                  bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

                  SHA512

                  97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

                  Filesize

                  97KB

                  MD5

                  da1d0cd400e0b6ad6415fd4d90f69666

                  SHA1

                  de9083d2902906cacf57259cf581b1466400b799

                  SHA256

                  7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

                  SHA512

                  f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

                  Filesize

                  97KB

                  MD5

                  da1d0cd400e0b6ad6415fd4d90f69666

                  SHA1

                  de9083d2902906cacf57259cf581b1466400b799

                  SHA256

                  7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

                  SHA512

                  f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

                  Filesize

                  1.3MB

                  MD5

                  f8da4bc14cb40b7ff8cd2c798ca0f7b9

                  SHA1

                  1264c77f79f7a328d60dfd752e721a463fc3e247

                  SHA256

                  3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1

                  SHA512

                  0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

                  Filesize

                  1.3MB

                  MD5

                  f8da4bc14cb40b7ff8cd2c798ca0f7b9

                  SHA1

                  1264c77f79f7a328d60dfd752e721a463fc3e247

                  SHA256

                  3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1

                  SHA512

                  0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

                  Filesize

                  1.3MB

                  MD5

                  f8da4bc14cb40b7ff8cd2c798ca0f7b9

                  SHA1

                  1264c77f79f7a328d60dfd752e721a463fc3e247

                  SHA256

                  3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1

                  SHA512

                  0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

                  Filesize

                  326KB

                  MD5

                  80d93d38badecdd2b134fe4699721223

                  SHA1

                  e829e58091bae93bc64e0c6f9f0bac999cfda23d

                  SHA256

                  c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                  SHA512

                  9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

                  Filesize

                  326KB

                  MD5

                  80d93d38badecdd2b134fe4699721223

                  SHA1

                  e829e58091bae93bc64e0c6f9f0bac999cfda23d

                  SHA256

                  c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                  SHA512

                  9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat

                  Filesize

                  114KB

                  MD5

                  bd5626a0237933e0f1dccf10e7c9fbd6

                  SHA1

                  10c47d382d4f44d8d44efaa203501749e42c6d50

                  SHA256

                  7dfc1176d8a507135140b23a0c014093b7e2673f0f3e5727c3d85df4e7323762

                  SHA512

                  1fd864a5386580cf8bbafbacb12a043ef51948b729b9aedfe6dc81e6c2948a100526c7c600069f22454d550f7f736ad3045a930cc2ef97458dc1d6c782928087

                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

                  Filesize

                  1.3MB

                  MD5

                  018c68cdf5ba005b4a380c20b13fee4c

                  SHA1

                  bf6043fbd31288e8667fcfc37cd74414bee1805f

                  SHA256

                  3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

                  SHA512

                  506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

                  Filesize

                  1.3MB

                  MD5

                  018c68cdf5ba005b4a380c20b13fee4c

                  SHA1

                  bf6043fbd31288e8667fcfc37cd74414bee1805f

                  SHA256

                  3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

                  SHA512

                  506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

                  Filesize

                  1.3MB

                  MD5

                  018c68cdf5ba005b4a380c20b13fee4c

                  SHA1

                  bf6043fbd31288e8667fcfc37cd74414bee1805f

                  SHA256

                  3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

                  SHA512

                  506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

                  Filesize

                  326KB

                  MD5

                  80d93d38badecdd2b134fe4699721223

                  SHA1

                  e829e58091bae93bc64e0c6f9f0bac999cfda23d

                  SHA256

                  c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                  SHA512

                  9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

                  Filesize

                  326KB

                  MD5

                  80d93d38badecdd2b134fe4699721223

                  SHA1

                  e829e58091bae93bc64e0c6f9f0bac999cfda23d

                  SHA256

                  c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

                  SHA512

                  9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

                • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

                  Filesize

                  2.7MB

                  MD5

                  838b154df03c5a9a074dc88ee98cecf9

                  SHA1

                  d92560ae6d31598cb96825b3ec461518d638c9a8

                  SHA256

                  f73b4d2dbbe3343f2bfb9e6664e5e6f5f7c38b1f2bb9cfb8ee73a80f6c92b38f

                  SHA512

                  b2c6d3afc6af488b40d9cbb0bbb60a70eaa4abe6999ba4f8dc7c96cae4dc14e2876e06d25d602b5cfb05bafda805f6d2647d24dace74363f3790cf5dc0b5302b

                • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

                  Filesize

                  2.7MB

                  MD5

                  838b154df03c5a9a074dc88ee98cecf9

                  SHA1

                  d92560ae6d31598cb96825b3ec461518d638c9a8

                  SHA256

                  f73b4d2dbbe3343f2bfb9e6664e5e6f5f7c38b1f2bb9cfb8ee73a80f6c92b38f

                  SHA512

                  b2c6d3afc6af488b40d9cbb0bbb60a70eaa4abe6999ba4f8dc7c96cae4dc14e2876e06d25d602b5cfb05bafda805f6d2647d24dace74363f3790cf5dc0b5302b

                • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

                  Filesize

                  2.7MB

                  MD5

                  838b154df03c5a9a074dc88ee98cecf9

                  SHA1

                  d92560ae6d31598cb96825b3ec461518d638c9a8

                  SHA256

                  f73b4d2dbbe3343f2bfb9e6664e5e6f5f7c38b1f2bb9cfb8ee73a80f6c92b38f

                  SHA512

                  b2c6d3afc6af488b40d9cbb0bbb60a70eaa4abe6999ba4f8dc7c96cae4dc14e2876e06d25d602b5cfb05bafda805f6d2647d24dace74363f3790cf5dc0b5302b

                • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

                  Filesize

                  2.7MB

                  MD5

                  838b154df03c5a9a074dc88ee98cecf9

                  SHA1

                  d92560ae6d31598cb96825b3ec461518d638c9a8

                  SHA256

                  f73b4d2dbbe3343f2bfb9e6664e5e6f5f7c38b1f2bb9cfb8ee73a80f6c92b38f

                  SHA512

                  b2c6d3afc6af488b40d9cbb0bbb60a70eaa4abe6999ba4f8dc7c96cae4dc14e2876e06d25d602b5cfb05bafda805f6d2647d24dace74363f3790cf5dc0b5302b

                • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

                  Filesize

                  2.7MB

                  MD5

                  838b154df03c5a9a074dc88ee98cecf9

                  SHA1

                  d92560ae6d31598cb96825b3ec461518d638c9a8

                  SHA256

                  f73b4d2dbbe3343f2bfb9e6664e5e6f5f7c38b1f2bb9cfb8ee73a80f6c92b38f

                  SHA512

                  b2c6d3afc6af488b40d9cbb0bbb60a70eaa4abe6999ba4f8dc7c96cae4dc14e2876e06d25d602b5cfb05bafda805f6d2647d24dace74363f3790cf5dc0b5302b

                • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

                  Filesize

                  2.7MB

                  MD5

                  838b154df03c5a9a074dc88ee98cecf9

                  SHA1

                  d92560ae6d31598cb96825b3ec461518d638c9a8

                  SHA256

                  f73b4d2dbbe3343f2bfb9e6664e5e6f5f7c38b1f2bb9cfb8ee73a80f6c92b38f

                  SHA512

                  b2c6d3afc6af488b40d9cbb0bbb60a70eaa4abe6999ba4f8dc7c96cae4dc14e2876e06d25d602b5cfb05bafda805f6d2647d24dace74363f3790cf5dc0b5302b

                • C:\Users\Admin\AppData\Local\Temp\setuparguments.ini

                  Filesize

                  636B

                  MD5

                  b497bf809b3efe783f7a98020d98b16c

                  SHA1

                  d37ab087b719d695aeb7c655b826987447d8f31d

                  SHA256

                  41c908076186b22ad76790c5d6014e88744e3d7f7f549f7a4623905455d10d89

                  SHA512

                  890a80b5ede44435a1c3c3877d66198cf7d9ae3bad4b8d34b3e800501311fb0f51d5aa2d6406fc24e0de7b3352906ecf68633adbc9f509aacc261caaa7cf6f31

                • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

                  Filesize

                  6.3MB

                  MD5

                  545c62b3d98ee4cc02af837a72dd09c4

                  SHA1

                  54446a007fd9b7363d9415673b0ac0232d5d70d5

                  SHA256

                  738029a4f974128180fa2cd239e873b01e456e8bf53bfdbf34b8ba8b57897be4

                  SHA512

                  8bf9c754861ed267efd2055ac09b4ad44df61b989859fccd14190592dca1dab0fa8f57360209eaceabb5137f742c9cea73a1a985ab1955f87a6875d0be95fdcf

                • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

                  Filesize

                  6.3MB

                  MD5

                  545c62b3d98ee4cc02af837a72dd09c4

                  SHA1

                  54446a007fd9b7363d9415673b0ac0232d5d70d5

                  SHA256

                  738029a4f974128180fa2cd239e873b01e456e8bf53bfdbf34b8ba8b57897be4

                  SHA512

                  8bf9c754861ed267efd2055ac09b4ad44df61b989859fccd14190592dca1dab0fa8f57360209eaceabb5137f742c9cea73a1a985ab1955f87a6875d0be95fdcf

                • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

                  Filesize

                  6.3MB

                  MD5

                  545c62b3d98ee4cc02af837a72dd09c4

                  SHA1

                  54446a007fd9b7363d9415673b0ac0232d5d70d5

                  SHA256

                  738029a4f974128180fa2cd239e873b01e456e8bf53bfdbf34b8ba8b57897be4

                  SHA512

                  8bf9c754861ed267efd2055ac09b4ad44df61b989859fccd14190592dca1dab0fa8f57360209eaceabb5137f742c9cea73a1a985ab1955f87a6875d0be95fdcf

                • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

                  Filesize

                  6.3MB

                  MD5

                  545c62b3d98ee4cc02af837a72dd09c4

                  SHA1

                  54446a007fd9b7363d9415673b0ac0232d5d70d5

                  SHA256

                  738029a4f974128180fa2cd239e873b01e456e8bf53bfdbf34b8ba8b57897be4

                  SHA512

                  8bf9c754861ed267efd2055ac09b4ad44df61b989859fccd14190592dca1dab0fa8f57360209eaceabb5137f742c9cea73a1a985ab1955f87a6875d0be95fdcf

                • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.BMP

                  Filesize

                  451KB

                  MD5

                  0b445ace8798426e7185f52b7b7b6d1e

                  SHA1

                  7a77b46e0848cc9b32283ccb3f91a18c0934c079

                  SHA256

                  2bbf97ccba3f87d469eac909c4ce8a3f13ed29c8f31b611e7d5cf89a0619eda6

                  SHA512

                  51523d5b711481293305465a3a3c6a3a50dca984cdc8cca1f4c44f3c21bfa430cd9aac1a8782d9605e6954cbafb307beb6b1a52e9785de1bc3f71067d80c6b6e

                • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG23.PNG

                  Filesize

                  1KB

                  MD5

                  58c10711ee61290c5e53d6c235d14c7f

                  SHA1

                  6cd433f1d5224b7441efecfef8e0982bbda4415b

                  SHA256

                  2d8d51d2405fd3534f5fce5ffea5b9a100ce4aacf35caa7d165c7c6672949b35

                  SHA512

                  b895b6f07fefc06695cb521fa923534c8ef99312ab6c27295c86de29fc1bdb09e3ba17cd4aea75f8dd9cf7e1a3c4494a6ef960eadcb209eecb1b623d70c367f0

                • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNG

                  Filesize

                  45KB

                  MD5

                  32b9a83f00af4123b811eb6a85ee7971

                  SHA1

                  a1e6bdfe76e6103aca76bd21ce60c0b48e4de570

                  SHA256

                  a39a8cb1d54a2036257211b6364f84caf033fccf3394e9f890434563770e594d

                  SHA512

                  eb272c6dbaa3e59887cfdfd21dba5e2abc56a12beeda55ba091aa9b02da71af5ce11c0f7af4fb34f58da9836f91d787e26ab9f898b8669c861e9bacee973ca9f

                • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG42.PNG

                  Filesize

                  352B

                  MD5

                  034eab9a50571cbab86294322e639886

                  SHA1

                  cae94b8cfe3ecce8e750d6fd34d54e766ea607aa

                  SHA256

                  449d678cc9a235d42a5a2f4e685536d9af87c6b5fc022f28dba32b08b4e88ee1

                  SHA512

                  b364c0cbb38bfb35e3c2d29705df72a8ce7dc111f04ebc05eceec4294987f18200581a31b78a79b05da890b5358e5463d1640d2230a8af930804efa3d4da42b0

                • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG45.PNG

                  Filesize

                  438B

                  MD5

                  87221bf8c9222a1489e949e4266a2980

                  SHA1

                  60c9d850f696e56b53dc3f940f52463d228febf2

                  SHA256

                  8d6e1d814dd38525115ee5d77e2d2ae6df8be31562a3c6805012097d6625efc4

                  SHA512

                  fa7ba5edb212a0ad70de123b1eabebd8d4cf5e2e3f59841330923c91d6ce6d8a0bbbf0176a8215a183ea860ae5286a4205b73f70df4d032cfd6c03109d1e433c

                • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG46.PNG

                  Filesize

                  206B

                  MD5

                  bc193c9f3fd0730341d2ba951f734652

                  SHA1

                  ebe3f410cf0bf5f30fe36b1c1df96fa27e73b01f

                  SHA256

                  e9137bc2fefbd9a3c4506708f283fe52c40b00b35c2677fc31e196b305b00e67

                  SHA512

                  355cb9a7ba6e2a77a51339bfa732537bc77d36da372fe926f1e4bf25de865b09c98122d9559f5ec234b41a83cb97de4fd49427a9476169653ac6058912261c1e

                • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG48.PNG

                  Filesize

                  1KB

                  MD5

                  9eb36caea38bf80ed9fa40a3f67597b7

                  SHA1

                  3c23e2e30119f6dd321d34a82a339d52723bfacc

                  SHA256

                  6be2e43a38969226e1cbb00605cdac634d0de3e82ce605b08dcf1cf596f64370

                  SHA512

                  22b57fc57d45ec73865e5429210d6016d2bab0cd990877c8272b4fc6ded8effe3bfa0c9b0890d7b0de8296e6bc3c262f29637b8ce7840efba2f963e70a978e53

                • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG5.PNG

                  Filesize

                  1KB

                  MD5

                  23e26969753c07af68f232cdd684c003

                  SHA1

                  f14666db750cc2f89ccdd8852b4259fcfa663271

                  SHA256

                  17f138eea95423738d2c9b75834b607c671cb2ac4d71c9aecf100a8b847003d2

                  SHA512

                  7c57a6309da9ae381073e005d374b9c8a82c7b4e92322b91433009d41f8f34655ed9d45958ab1743023faa9e7aa0c82a05d9292b078efccb64c19992b7e4d4d2

                • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG66.PNG

                  Filesize

                  41KB

                  MD5

                  7aae2de61d5e6296c00fde67046dfaeb

                  SHA1

                  87a65e99d520045c39997b53c6a0aa08cec35e57

                  SHA256

                  07b11e82a30598438ac4221d6c8796739c42c2a596365464f257481a37fa00c6

                  SHA512

                  c5ebaf43ffc19a1a3b2f49e070ea1d5532ae433c3bcd02493e31bd3389b6c3edfb1e04373902fbd252eb7370612dd96c3d36eb3fac8240111f57020ab99fa882

                • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG67.PNG

                  Filesize

                  1KB

                  MD5

                  0bde2ca44cd4e4e31c5c0364c66eb57b

                  SHA1

                  8496e4a8dcea6e42af33b503dc200d4a1ef07101

                  SHA256

                  38031284395ba7a773a335a861536b487bbf60b81496424b8a9a8a6697a919de

                  SHA512

                  4e60f45022b0c6739db94097401f6046e5f95b26dca71e685db834338451b7ea0b3ed3afc128d564c3f79074905b7986714f75925c41f763eda6b901875af555

                • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

                  Filesize

                  33KB

                  MD5

                  4e556563c22db6923fc9853bd3fd9afe

                  SHA1

                  5906158cae9dc1930d124f0fb54baaf98ba77d5b

                  SHA256

                  833e9f2fb4e0c91762f711104b9ed51f8a36257a30857a123795c40e2281cb08

                  SHA512

                  de3a27d7d808a0a70355ec0356928eaf2944912df6b8809f5861701c2bfbc0d373f3ac7cb01b41698fe0b394f40cf7d221bad52ec26e8c1331f24eaeb93333fb

                • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

                  Filesize

                  10KB

                  MD5

                  277a3a2e563af45a1de2ce4fd9954a71

                  SHA1

                  0d80ca2f43a792978732c39273b8a9b146443e05

                  SHA256

                  705db65ec95dc5f757893b82b33c9b5f21965060ccc453b310fc362c4621138c

                  SHA512

                  d6dcc14214d3fb1b31309491639d4ffde4111f58adb2b29694a0e65fc38c2bc3587c7c5f2a3bccf65cd8852af393626be73873524ede65a11fb931cc8a6dce49

                • C:\Users\Admin\AppData\Roaming\.tlauncher\tlauncher-2.0.properties

                  Filesize

                  51B

                  MD5

                  306359ce91e2b42d6678bfbe3606b8d7

                  SHA1

                  0641fd04c6f3aa806bddfd41ade533be6da40be8

                  SHA256

                  9fa89c480a1efe7b5da92af76db7ed754691ecf31e92e87577337bcb416aa6cc

                  SHA512

                  2de92453c4475d3b2d646cdc5b7dd5a10c0d287b3cd3f34b20141ff1993d50f3ae4ce03f14d9099e434e11c050d1956f8cdb8b5b52c937b118a33753c92df70b

                • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

                  Filesize

                  40B

                  MD5

                  0e84755668bd8e7c5d03c5f0139b9a31

                  SHA1

                  8b22de37e7fe26303254d4f9cd822018b5e32e8e

                  SHA256

                  fb07b6087888a47dfd92d171167ad0356428e40cb4f645af30523d6de02b4eb0

                  SHA512

                  aac9f54128dde0704660e45c56fa83d6882299d6fc92755017daea9e552e72870b7cca149e134071f9adc242940a604be7ea30101a2eb80952564ec277a3dbac

                • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

                  Filesize

                  40B

                  MD5

                  0e84755668bd8e7c5d03c5f0139b9a31

                  SHA1

                  8b22de37e7fe26303254d4f9cd822018b5e32e8e

                  SHA256

                  fb07b6087888a47dfd92d171167ad0356428e40cb4f645af30523d6de02b4eb0

                  SHA512

                  aac9f54128dde0704660e45c56fa83d6882299d6fc92755017daea9e552e72870b7cca149e134071f9adc242940a604be7ea30101a2eb80952564ec277a3dbac

                • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

                  Filesize

                  40B

                  MD5

                  0e84755668bd8e7c5d03c5f0139b9a31

                  SHA1

                  8b22de37e7fe26303254d4f9cd822018b5e32e8e

                  SHA256

                  fb07b6087888a47dfd92d171167ad0356428e40cb4f645af30523d6de02b4eb0

                  SHA512

                  aac9f54128dde0704660e45c56fa83d6882299d6fc92755017daea9e552e72870b7cca149e134071f9adc242940a604be7ea30101a2eb80952564ec277a3dbac

                • memory/388-1939-0x00000000005C0000-0x00000000009A8000-memory.dmp

                  Filesize

                  3.9MB

                • memory/388-522-0x00000000005C0000-0x00000000009A8000-memory.dmp

                  Filesize

                  3.9MB

                • memory/388-620-0x00000000005C0000-0x00000000009A8000-memory.dmp

                  Filesize

                  3.9MB

                • memory/2320-441-0x0000000006600000-0x0000000006603000-memory.dmp

                  Filesize

                  12KB

                • memory/2320-1938-0x0000000000650000-0x0000000000A38000-memory.dmp

                  Filesize

                  3.9MB

                • memory/2320-462-0x0000000010000000-0x0000000010051000-memory.dmp

                  Filesize

                  324KB

                • memory/2320-461-0x0000000000650000-0x0000000000A38000-memory.dmp

                  Filesize

                  3.9MB

                • memory/2320-440-0x0000000010000000-0x0000000010051000-memory.dmp

                  Filesize

                  324KB

                • memory/2320-619-0x0000000010000000-0x0000000010051000-memory.dmp

                  Filesize

                  324KB

                • memory/2320-1637-0x0000000000650000-0x0000000000A38000-memory.dmp

                  Filesize

                  3.9MB

                • memory/2320-612-0x0000000000650000-0x0000000000A38000-memory.dmp

                  Filesize

                  3.9MB

                • memory/2320-147-0x0000000000650000-0x0000000000A38000-memory.dmp

                  Filesize

                  3.9MB

                • memory/2320-640-0x0000000000650000-0x0000000000A38000-memory.dmp

                  Filesize

                  3.9MB

                • memory/2320-463-0x0000000000650000-0x0000000000A38000-memory.dmp

                  Filesize

                  3.9MB

                • memory/2508-562-0x0000000000810000-0x0000000000D48000-memory.dmp

                  Filesize

                  5.2MB

                • memory/2924-630-0x0000000000810000-0x0000000000D48000-memory.dmp

                  Filesize

                  5.2MB

                • memory/3040-2002-0x00000000017E0000-0x00000000017E1000-memory.dmp

                  Filesize

                  4KB

                • memory/3040-1986-0x00000000017E0000-0x00000000017E1000-memory.dmp

                  Filesize

                  4KB

                • memory/3040-2017-0x00000000017E0000-0x00000000017E1000-memory.dmp

                  Filesize

                  4KB

                • memory/3040-2016-0x00000000017E0000-0x00000000017E1000-memory.dmp

                  Filesize

                  4KB

                • memory/3040-1991-0x00000000017E0000-0x00000000017E1000-memory.dmp

                  Filesize

                  4KB

                • memory/3852-580-0x0000000000680000-0x0000000000BB8000-memory.dmp

                  Filesize

                  5.2MB

                • memory/4416-639-0x0000000000810000-0x0000000000D48000-memory.dmp

                  Filesize

                  5.2MB

                • memory/4684-1946-0x0000000000F30000-0x0000000000F31000-memory.dmp

                  Filesize

                  4KB

                • memory/4684-1958-0x0000000000F30000-0x0000000000F31000-memory.dmp

                  Filesize

                  4KB

                • memory/4684-1950-0x0000000000F30000-0x0000000000F31000-memory.dmp

                  Filesize

                  4KB

                • memory/4684-2018-0x0000000000F30000-0x0000000000F31000-memory.dmp

                  Filesize

                  4KB

                • memory/4704-1719-0x0000000000400000-0x0000000000417000-memory.dmp

                  Filesize

                  92KB

                • memory/4736-1961-0x0000000000400000-0x0000000000417000-memory.dmp

                  Filesize

                  92KB

                • memory/4968-631-0x0000000000810000-0x0000000000D48000-memory.dmp

                  Filesize

                  5.2MB