Analysis

  • max time kernel
    125s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-05-2023 05:54

General

  • Target

    TLauncher-2.879-Installer-1.1.1.exe

  • Size

    22.6MB

  • MD5

    c4ceda8c435298d23cc40a842f426d61

  • SHA1

    c7337094f09852b00a815950e96f3292295e9e15

  • SHA256

    e132be19bc7ae8a96d3d620710fa26b614e022abecccc161ad733eff732afcd6

  • SHA512

    25e74422d3b7adeb0cc805bbe41298d4e0fcf984b038c63a3a4faeea16e10a18f113c9a7d946e16f377ad9e3a5ca0a6425d7650b62c1e5db9ee2299e9921f52b

  • SSDEEP

    393216:LXfgqusAgbGPfs/dQETVlOBbpFEjdGphRqV56Hpkf+V4scTKAjENq3:LvtDpsHExi73qqHpg+Vvc+Amc

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 13 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 30 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 10 IoCs
  • Suspicious use of SetWindowsHookEx 23 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.1.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.1.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3280
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.1.exe" "__IRCT:3" "__IRTSS:23652314" "__IRSID:S-1-5-21-4238149048-355649189-894321705-1000"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:432
      • C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
        "C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1980
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816850 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:1841947" "__IRSID:S-1-5-21-4238149048-355649189-894321705-1000"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4904
          • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
            "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Enumerates connected drives
            • Modifies system certificate store
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4844
            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=98.0.4759.15 --initial-client-data=0x340,0x344,0x348,0x31c,0x34c,0x6f77c398,0x6f77c3a8,0x6f77c3b4
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:2272
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe" --version
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:4620
            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=4844 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20230502075446" --session-guid=a2ee9cda-b726-4b8b-b342-33727ee38dd0 --server-tracking-blob="OTM4OGM0NzRlN2U4YjQwN2NjMTFhYzZkMzAxNWY0MGIyYTJlZWQ3NzAxMzYzNDVhZGE5YjFiN2Y2OGUzYmVkMDp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTY4MzAwNjg4NS45NDY2IiwidXNlcmFnZW50IjoiU2V0dXAgRmFjdG9yeSA5LjAiLCJ1dG0iOnsiY2FtcGFpZ24iOiJPcGVyYURlc2t0b3AiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJNU1RMIn0sInV1aWQiOiI5N2FkNmNkZS0yMTBhLTQ2MTUtOWRkNS0wYjZjYjk1MWYwZDEifQ== " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=AC05000000000000
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Enumerates connected drives
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3764
              • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=98.0.4759.15 --initial-client-data=0x34c,0x350,0x354,0x31c,0x358,0x6ecbc398,0x6ecbc3a8,0x6ecbc3b4
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:392
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305020754461\assistant\Assistant_98.0.4759.6_Setup.exe_sfx.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305020754461\assistant\Assistant_98.0.4759.6_Setup.exe_sfx.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:4136
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305020754461\assistant\assistant_installer.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305020754461\assistant\assistant_installer.exe" --version
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4892
              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305020754461\assistant\assistant_installer.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305020754461\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=98.0.4759.6 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x2fc,0xf09b08,0xf09b18,0xf09b24
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:3124
      • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
        "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2076
        • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
          "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
          4⤵
          • Suspicious use of SetWindowsHookEx
          PID:1168
  • C:\Windows\System32\GameBarPresenceWriter.exe
    "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
    1⤵
      PID:4856
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
        PID:4272
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
        1⤵
          PID:1364

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

          Filesize

          471B

          MD5

          36dfdb286b0c70b070b50a5975b9c0b0

          SHA1

          07d0ebc1bfd992586d25ff2ed3d9393314010d3b

          SHA256

          258e35882c097847327776af90c8a2db35b93e335952e24171c202529937896c

          SHA512

          4f7311644b5de6f3df9b1469c395b17c833f67be1d9db6aa38057756086c3b2e97b0270a3ece04c7c590acc33838cc7da0d5cc6364b54c08223e423b94ad061f

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

          Filesize

          434B

          MD5

          b5dc79a9bae6bb1f0ab44a7f5658618c

          SHA1

          09f374a1f00ee51ab73802dec5ef088a1abab180

          SHA256

          f8d243000ab490495486b4efb193bfb143c5fd30a9b0ba42a22c8f8a8c552edd

          SHA512

          47d3504f434345e719de799b01aa39970d7c2ea763aec95f7a19e135d0c4d0ff82341975ef9a6b71be6488a4fb85838240c596b4008de9b2233c367dc67b3b40

        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe

          Filesize

          2.6MB

          MD5

          656ef2f8d3c10b8dccd2e04a5b8718df

          SHA1

          e6d2aab6fa1d5b3cf6a437a9b8304844eb23f22f

          SHA256

          5ed92cec9b81dd8ff3ac85ed080eb136335e0c89fd53ec5f72a7bbfb5f454d2a

          SHA512

          5caae63191d1e335e99b68bc5771e0d678c393eada6cdb0780573d9fc4937bfa17c52353a52e71c203b128e1b1ed1c6e9d7841496b11be7a90a1be9aaaf6101d

        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe

          Filesize

          2.6MB

          MD5

          656ef2f8d3c10b8dccd2e04a5b8718df

          SHA1

          e6d2aab6fa1d5b3cf6a437a9b8304844eb23f22f

          SHA256

          5ed92cec9b81dd8ff3ac85ed080eb136335e0c89fd53ec5f72a7bbfb5f454d2a

          SHA512

          5caae63191d1e335e99b68bc5771e0d678c393eada6cdb0780573d9fc4937bfa17c52353a52e71c203b128e1b1ed1c6e9d7841496b11be7a90a1be9aaaf6101d

        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305020754461\assistant\Assistant_98.0.4759.6_Setup.exe_sfx.exe

          Filesize

          2.4MB

          MD5

          090de281df0aff70c6bab2e004321dbb

          SHA1

          25746cf9a368636c35d552b0c08f74b455c7c44b

          SHA256

          9b829a0ac23000a77a4455c46b49f23e27e99251d56c99edf9a5b3163d0a5be1

          SHA512

          263945666f7a077368ad20025eb71098b604a3a7af04d08ee5fcad81e12be3fe39d9dd415cf26d194cf645c534d3056e8385824889dceea82657993e6c47d61b

        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305020754461\assistant\Assistant_98.0.4759.6_Setup.exe_sfx.exe

          Filesize

          2.4MB

          MD5

          090de281df0aff70c6bab2e004321dbb

          SHA1

          25746cf9a368636c35d552b0c08f74b455c7c44b

          SHA256

          9b829a0ac23000a77a4455c46b49f23e27e99251d56c99edf9a5b3163d0a5be1

          SHA512

          263945666f7a077368ad20025eb71098b604a3a7af04d08ee5fcad81e12be3fe39d9dd415cf26d194cf645c534d3056e8385824889dceea82657993e6c47d61b

        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305020754461\assistant\Assistant_98.0.4759.6_Setup.exe_sfx.exe

          Filesize

          2.4MB

          MD5

          090de281df0aff70c6bab2e004321dbb

          SHA1

          25746cf9a368636c35d552b0c08f74b455c7c44b

          SHA256

          9b829a0ac23000a77a4455c46b49f23e27e99251d56c99edf9a5b3163d0a5be1

          SHA512

          263945666f7a077368ad20025eb71098b604a3a7af04d08ee5fcad81e12be3fe39d9dd415cf26d194cf645c534d3056e8385824889dceea82657993e6c47d61b

        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305020754461\assistant\assistant_installer.exe

          Filesize

          2.0MB

          MD5

          3c942ff0d46769c4ebebaf8af7cecd09

          SHA1

          22edc54535ca0d310f078741e5a384032dff4dda

          SHA256

          6411b8efde988c3c5e24c1555ee0b910985a5e037b3beb887b38754aceb7f533

          SHA512

          4138e8d6c21510451d47b7ad7f3d4954eccdf8fa04b2a676082c710e79110da8ff21e96337c93bd5903442740d2cf4b249974248571a05bcc0fd5a25018d8da7

        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305020754461\assistant\assistant_installer.exe

          Filesize

          2.0MB

          MD5

          3c942ff0d46769c4ebebaf8af7cecd09

          SHA1

          22edc54535ca0d310f078741e5a384032dff4dda

          SHA256

          6411b8efde988c3c5e24c1555ee0b910985a5e037b3beb887b38754aceb7f533

          SHA512

          4138e8d6c21510451d47b7ad7f3d4954eccdf8fa04b2a676082c710e79110da8ff21e96337c93bd5903442740d2cf4b249974248571a05bcc0fd5a25018d8da7

        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305020754461\assistant\assistant_installer.exe

          Filesize

          2.0MB

          MD5

          3c942ff0d46769c4ebebaf8af7cecd09

          SHA1

          22edc54535ca0d310f078741e5a384032dff4dda

          SHA256

          6411b8efde988c3c5e24c1555ee0b910985a5e037b3beb887b38754aceb7f533

          SHA512

          4138e8d6c21510451d47b7ad7f3d4954eccdf8fa04b2a676082c710e79110da8ff21e96337c93bd5903442740d2cf4b249974248571a05bcc0fd5a25018d8da7

        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305020754461\assistant\dbgcore.DLL

          Filesize

          166KB

          MD5

          8e7190bf9a51e2951b140642511c00fe

          SHA1

          8ac4ad95c91cca1f5a048a97f63619b2babd7348

          SHA256

          775c3e3c76780e8a61db42a4520b81a663eac224e7ec33dc252a1276e47613b5

          SHA512

          d5dc33882b2a211a997cb178aefdda7013f30efd626722dc56cbbb1b85855a5eb7b77c70bf7fe6b605e93658498ae086f590b1b53346df01891fa0071c5cf4e7

        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305020754461\assistant\dbgcore.dll

          Filesize

          166KB

          MD5

          8e7190bf9a51e2951b140642511c00fe

          SHA1

          8ac4ad95c91cca1f5a048a97f63619b2babd7348

          SHA256

          775c3e3c76780e8a61db42a4520b81a663eac224e7ec33dc252a1276e47613b5

          SHA512

          d5dc33882b2a211a997cb178aefdda7013f30efd626722dc56cbbb1b85855a5eb7b77c70bf7fe6b605e93658498ae086f590b1b53346df01891fa0071c5cf4e7

        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305020754461\assistant\dbgcore.dll

          Filesize

          166KB

          MD5

          8e7190bf9a51e2951b140642511c00fe

          SHA1

          8ac4ad95c91cca1f5a048a97f63619b2babd7348

          SHA256

          775c3e3c76780e8a61db42a4520b81a663eac224e7ec33dc252a1276e47613b5

          SHA512

          d5dc33882b2a211a997cb178aefdda7013f30efd626722dc56cbbb1b85855a5eb7b77c70bf7fe6b605e93658498ae086f590b1b53346df01891fa0071c5cf4e7

        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305020754461\assistant\dbghelp.dll

          Filesize

          1.7MB

          MD5

          bcc596c2460244066b3c40a6559b88d9

          SHA1

          6ee955c1efd65eba6eb6020467bc4d26aaa82793

          SHA256

          e7ba778244de4144318b6946e2f9aa382ee6c8e93849f49ed54bbb9a9625f34f

          SHA512

          016468a0188239a5e9eb93dd3842eed5bde60b1e5fc69ea822099ebc2a7d2094d307ce4abfe98a222fa684d3538cd3df1b63bbf5dd694d020020543f41f328be

        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305020754461\assistant\dbghelp.dll

          Filesize

          1.7MB

          MD5

          bcc596c2460244066b3c40a6559b88d9

          SHA1

          6ee955c1efd65eba6eb6020467bc4d26aaa82793

          SHA256

          e7ba778244de4144318b6946e2f9aa382ee6c8e93849f49ed54bbb9a9625f34f

          SHA512

          016468a0188239a5e9eb93dd3842eed5bde60b1e5fc69ea822099ebc2a7d2094d307ce4abfe98a222fa684d3538cd3df1b63bbf5dd694d020020543f41f328be

        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305020754461\assistant\dbghelp.dll

          Filesize

          1.7MB

          MD5

          bcc596c2460244066b3c40a6559b88d9

          SHA1

          6ee955c1efd65eba6eb6020467bc4d26aaa82793

          SHA256

          e7ba778244de4144318b6946e2f9aa382ee6c8e93849f49ed54bbb9a9625f34f

          SHA512

          016468a0188239a5e9eb93dd3842eed5bde60b1e5fc69ea822099ebc2a7d2094d307ce4abfe98a222fa684d3538cd3df1b63bbf5dd694d020020543f41f328be

        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305020754461\opera_package

          Filesize

          90.2MB

          MD5

          3ce6bb9794ce05f50f253600e2ca63e1

          SHA1

          5cead37e99d2c1060bd75f9a61ac3e77ad1aedcb

          SHA256

          85896658a743ecf1f32b0141fdb0be56cd6e44ecea0398ef9f85dc8319262fce

          SHA512

          8721a13da9fad220429fca32ac96d372d5913c2d5815bb4a583f4d7ba6f8717e17641ef207698c26aef31f875909418ce41f7c69ad820bce30314266bbca2507

        • C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

          Filesize

          1.8MB

          MD5

          8d26aecef0a7bdac2b104454d3ba1a87

          SHA1

          50c29c58dfece62d94ed01cb5b3d070e593dc9cf

          SHA256

          e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

          SHA512

          0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

        • C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

          Filesize

          1.8MB

          MD5

          8d26aecef0a7bdac2b104454d3ba1a87

          SHA1

          50c29c58dfece62d94ed01cb5b3d070e593dc9cf

          SHA256

          e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

          SHA512

          0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

        • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2305020754437824844.dll

          Filesize

          4.4MB

          MD5

          8037ea118e22eb387adf20c36375e367

          SHA1

          ae646806a29ec7745840da4c699a6d9f7ceba1f4

          SHA256

          d3a1505843d55048bf01686e74aa16ef76e78bdacc62fda20a4266ff0abd7ed8

          SHA512

          f7adf71035ff3a1208d3dfa1a8828ce5acf5883f45d8722d07be2ec8f78f269a5e607bbcf5199d4ba3e7ee6d976709dd993b7035559abd0dfcbb0e00eb993b50

        • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2305020754448762272.dll

          Filesize

          4.4MB

          MD5

          8037ea118e22eb387adf20c36375e367

          SHA1

          ae646806a29ec7745840da4c699a6d9f7ceba1f4

          SHA256

          d3a1505843d55048bf01686e74aa16ef76e78bdacc62fda20a4266ff0abd7ed8

          SHA512

          f7adf71035ff3a1208d3dfa1a8828ce5acf5883f45d8722d07be2ec8f78f269a5e607bbcf5199d4ba3e7ee6d976709dd993b7035559abd0dfcbb0e00eb993b50

        • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2305020754448762272.dll

          Filesize

          4.4MB

          MD5

          8037ea118e22eb387adf20c36375e367

          SHA1

          ae646806a29ec7745840da4c699a6d9f7ceba1f4

          SHA256

          d3a1505843d55048bf01686e74aa16ef76e78bdacc62fda20a4266ff0abd7ed8

          SHA512

          f7adf71035ff3a1208d3dfa1a8828ce5acf5883f45d8722d07be2ec8f78f269a5e607bbcf5199d4ba3e7ee6d976709dd993b7035559abd0dfcbb0e00eb993b50

        • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2305020754461104620.dll

          Filesize

          4.4MB

          MD5

          8037ea118e22eb387adf20c36375e367

          SHA1

          ae646806a29ec7745840da4c699a6d9f7ceba1f4

          SHA256

          d3a1505843d55048bf01686e74aa16ef76e78bdacc62fda20a4266ff0abd7ed8

          SHA512

          f7adf71035ff3a1208d3dfa1a8828ce5acf5883f45d8722d07be2ec8f78f269a5e607bbcf5199d4ba3e7ee6d976709dd993b7035559abd0dfcbb0e00eb993b50

        • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2305020754550163764.dll

          Filesize

          4.4MB

          MD5

          8037ea118e22eb387adf20c36375e367

          SHA1

          ae646806a29ec7745840da4c699a6d9f7ceba1f4

          SHA256

          d3a1505843d55048bf01686e74aa16ef76e78bdacc62fda20a4266ff0abd7ed8

          SHA512

          f7adf71035ff3a1208d3dfa1a8828ce5acf5883f45d8722d07be2ec8f78f269a5e607bbcf5199d4ba3e7ee6d976709dd993b7035559abd0dfcbb0e00eb993b50

        • C:\Users\Admin\AppData\Local\Temp\Opera_installer_230502075456191392.dll

          Filesize

          4.4MB

          MD5

          8037ea118e22eb387adf20c36375e367

          SHA1

          ae646806a29ec7745840da4c699a6d9f7ceba1f4

          SHA256

          d3a1505843d55048bf01686e74aa16ef76e78bdacc62fda20a4266ff0abd7ed8

          SHA512

          f7adf71035ff3a1208d3dfa1a8828ce5acf5883f45d8722d07be2ec8f78f269a5e607bbcf5199d4ba3e7ee6d976709dd993b7035559abd0dfcbb0e00eb993b50

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico

          Filesize

          116KB

          MD5

          e043a9cb014d641a56f50f9d9ac9a1b9

          SHA1

          61dc6aed3d0d1f3b8afe3d161410848c565247ed

          SHA256

          9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946

          SHA512

          4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe

          Filesize

          1.8MB

          MD5

          8d26aecef0a7bdac2b104454d3ba1a87

          SHA1

          50c29c58dfece62d94ed01cb5b3d070e593dc9cf

          SHA256

          e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

          SHA512

          0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.PNG

          Filesize

          339B

          MD5

          6beb106fcdb10fdd1af8f408dbfad7c0

          SHA1

          47e5cc259f9b7f0aacaf61f51a2b8835135925e4

          SHA256

          adb0b0e1c35dc71b2796d71009d610a086a1b2a46cd78495ca6c1e414e424d52

          SHA512

          b5ecf7fc5f4d2378c8d069a2e40dad3dab6b1b954257abab41b35f3e460df959d02d9f2bb04d5f66a0c8067021eab4d85507613f641ca7eb7af86c3a9a6d7e63

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG104.PNG

          Filesize

          644B

          MD5

          9756710c8ffbd55efcc8cceb7ae36978

          SHA1

          1cfa830268061cd6988cd04c69dbd260eff20906

          SHA256

          0ef03e7257d6d31a1d37adfdbc733ed9fb41259bb0d44c0b3424d1dddfe91646

          SHA512

          67a8317c199349e9142821bbc204ebc31a5091560f257d8ae8f498bba1c35b3e1f666faae1fc70803e8781903bb3386dfb7b09d796c0a61211ae7df6cfe1eeb3

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG105.PNG

          Filesize

          40KB

          MD5

          ed056469c2f0a7adce3e80404bff316a

          SHA1

          48e8a5e0dbe66bb8ad044b39f2161583a10cf24e

          SHA256

          ee5e42eee432320ac80b75b45d4d254d2880c31092579680bd6a585beabddf0e

          SHA512

          34322e5654902227bb67e43e5a6ffcca5895bb634a2c3f795ea68fd57125b693d656eab4fa412f1d4f64c79aa02e0de8b36b9b04eae5bae7134062a9a5adeed5

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG106.PNG

          Filesize

          1KB

          MD5

          9652f5f05bdb53b417e7071ce15aebbc

          SHA1

          ad2e987f95cfb7ff5690b395dac47b066e919fa7

          SHA256

          708a0ea0632e0c82429425778557a6fedecaf63c591316423c71f3c5db210416

          SHA512

          60a71ef4ee4d85ad9284eddbd4443bc11e67fd2a9d5d3a4bd41364fd3c7e64be1d522437124f77fb2fa9ccd8c559e34123bd9eb5037ebee5f85c68ab069dbee3

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG108.PNG

          Filesize

          2KB

          MD5

          177a9e913e7039e698bea8b073ed46a0

          SHA1

          6aa8cb4efce1443a604dae67653cbc29727353dc

          SHA256

          10ece4579c86f299612f85a4dc21a6906cd522bba801d9b357abfbd2b5a21ebb

          SHA512

          5380f57569a5e44ecd66e6a996cb8949e01f7e2f15337a21133bb9bebd3893fb6a887b69b2bd56edbfc4872aca6f59e37b305ace774ee175955fa911b2a39a00

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.PNG

          Filesize

          280B

          MD5

          ac819dc416a9c3d7cd218247a505f4e4

          SHA1

          65184cf901d16f1f18dd82bd0673250d5422799c

          SHA256

          a1639ff730514d3ef9d8e5363e6848069462845a9c9c0bc4ca355b60cb9dfca3

          SHA512

          4ab1351fd036b4187660bf42b19a5f1b5a2ad51369c5e056bbbc765051905e3f1b5716557f113cf2e14678481101897698c3fc746814189da75693d3fec8fab3

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.PNG

          Filesize

          281B

          MD5

          179d7efdf2a2909c5cce33a2fa7b29cf

          SHA1

          e6ee30a67170e74491069edba50c950909bea4dc

          SHA256

          cc4db69be2bcdf373a7615df5a274a7e08c1dc7c3106fd835272dea973b9e049

          SHA512

          1ffba7773a15d7b53a4fa7f1b2099b565baf1d550c801a065bd03a613b5a408429c038b51a05293868525ac9cf3976615030b5cb72931a54e1a1045a1c3bdc74

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG45.PNG

          Filesize

          438B

          MD5

          677ed3c0ef77f1d3d09d888f82d22089

          SHA1

          6fdddf5102cba85694b2212a058e7b061fe49fa4

          SHA256

          87db8c352230acedd0b49189c6cdf8cb168e68cd48548724c2186db978240d05

          SHA512

          24ea7cce29a2d968f7cce44178d91651fa6f35a17dea23aa00ac1913bc14e6ae2263bd2e93233efd387370abb7c3512fba92635e3bf6631fce2e12221fe6c1d6

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG85.PNG

          Filesize

          43KB

          MD5

          97a2aaca50914badb17e343b6f592171

          SHA1

          991b22e59ad4482395b288ae5074268ee93a55b3

          SHA256

          c121b4caefaea329d596596773c39f8a35beb5fcc4bc1a09bdd47d41382364df

          SHA512

          c8cc5b507a97a6c3ef62a27c7cf1b3f67b81cccf99fdf158948827911d477507d3c4a3326c3bbee4296c1001dc1d745ba1779fd91886dd50d6a89c51879efe8a

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG86.PNG

          Filesize

          1KB

          MD5

          382fa04ae6fdcc6b1713b9ef02e9675a

          SHA1

          310b638c0bb8ec49b208a1f8982a63f6c34fd6f3

          SHA256

          8775ed30c651649b1e693cc9bfd8ed3093c91011691fa50bc64dc8058113614f

          SHA512

          11a91ee803c99a71ae956ede7d8778157456ed53ca0af8d3c72621650cc84ef1df5e3c0fc8c225e22903f0c7a57d867723777655c1f8606242b8369943ff9d74

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

          Filesize

          1.7MB

          MD5

          1bbf5dd0b6ca80e4c7c77495c3f33083

          SHA1

          e0520037e60eb641ec04d1e814394c9da0a6a862

          SHA256

          bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

          SHA512

          97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

          Filesize

          1.7MB

          MD5

          1bbf5dd0b6ca80e4c7c77495c3f33083

          SHA1

          e0520037e60eb641ec04d1e814394c9da0a6a862

          SHA256

          bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

          SHA512

          97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

          Filesize

          97KB

          MD5

          da1d0cd400e0b6ad6415fd4d90f69666

          SHA1

          de9083d2902906cacf57259cf581b1466400b799

          SHA256

          7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

          SHA512

          f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

          Filesize

          97KB

          MD5

          da1d0cd400e0b6ad6415fd4d90f69666

          SHA1

          de9083d2902906cacf57259cf581b1466400b799

          SHA256

          7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

          SHA512

          f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

          Filesize

          1.3MB

          MD5

          0913b4c43b4a1c301353197c30e01f4f

          SHA1

          245c343a7bb339d402ff8e9d442389a4f3dfc3a8

          SHA256

          238d15cbb1a929fe19f4558c44fbc67d5d6b9a3176fd9d880345ae0174a8d87c

          SHA512

          9d2da27264af71d7d1b9a3eac36e9b413041836de2559899d384a76b888cd495703a306c384752047bc9e1da3f8ee908da7218a58cfd9af1f81b51be4b27321f

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

          Filesize

          1.3MB

          MD5

          0913b4c43b4a1c301353197c30e01f4f

          SHA1

          245c343a7bb339d402ff8e9d442389a4f3dfc3a8

          SHA256

          238d15cbb1a929fe19f4558c44fbc67d5d6b9a3176fd9d880345ae0174a8d87c

          SHA512

          9d2da27264af71d7d1b9a3eac36e9b413041836de2559899d384a76b888cd495703a306c384752047bc9e1da3f8ee908da7218a58cfd9af1f81b51be4b27321f

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

          Filesize

          1.3MB

          MD5

          0913b4c43b4a1c301353197c30e01f4f

          SHA1

          245c343a7bb339d402ff8e9d442389a4f3dfc3a8

          SHA256

          238d15cbb1a929fe19f4558c44fbc67d5d6b9a3176fd9d880345ae0174a8d87c

          SHA512

          9d2da27264af71d7d1b9a3eac36e9b413041836de2559899d384a76b888cd495703a306c384752047bc9e1da3f8ee908da7218a58cfd9af1f81b51be4b27321f

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

          Filesize

          326KB

          MD5

          80d93d38badecdd2b134fe4699721223

          SHA1

          e829e58091bae93bc64e0c6f9f0bac999cfda23d

          SHA256

          c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

          SHA512

          9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

          Filesize

          326KB

          MD5

          80d93d38badecdd2b134fe4699721223

          SHA1

          e829e58091bae93bc64e0c6f9f0bac999cfda23d

          SHA256

          c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

          SHA512

          9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat

          Filesize

          114KB

          MD5

          bd5626a0237933e0f1dccf10e7c9fbd6

          SHA1

          10c47d382d4f44d8d44efaa203501749e42c6d50

          SHA256

          7dfc1176d8a507135140b23a0c014093b7e2673f0f3e5727c3d85df4e7323762

          SHA512

          1fd864a5386580cf8bbafbacb12a043ef51948b729b9aedfe6dc81e6c2948a100526c7c600069f22454d550f7f736ad3045a930cc2ef97458dc1d6c782928087

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

          Filesize

          1.3MB

          MD5

          018c68cdf5ba005b4a380c20b13fee4c

          SHA1

          bf6043fbd31288e8667fcfc37cd74414bee1805f

          SHA256

          3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

          SHA512

          506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

          Filesize

          1.3MB

          MD5

          018c68cdf5ba005b4a380c20b13fee4c

          SHA1

          bf6043fbd31288e8667fcfc37cd74414bee1805f

          SHA256

          3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

          SHA512

          506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

          Filesize

          1.3MB

          MD5

          018c68cdf5ba005b4a380c20b13fee4c

          SHA1

          bf6043fbd31288e8667fcfc37cd74414bee1805f

          SHA256

          3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

          SHA512

          506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

          Filesize

          326KB

          MD5

          80d93d38badecdd2b134fe4699721223

          SHA1

          e829e58091bae93bc64e0c6f9f0bac999cfda23d

          SHA256

          c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

          SHA512

          9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

          Filesize

          326KB

          MD5

          80d93d38badecdd2b134fe4699721223

          SHA1

          e829e58091bae93bc64e0c6f9f0bac999cfda23d

          SHA256

          c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

          SHA512

          9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

        • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

          Filesize

          2.6MB

          MD5

          656ef2f8d3c10b8dccd2e04a5b8718df

          SHA1

          e6d2aab6fa1d5b3cf6a437a9b8304844eb23f22f

          SHA256

          5ed92cec9b81dd8ff3ac85ed080eb136335e0c89fd53ec5f72a7bbfb5f454d2a

          SHA512

          5caae63191d1e335e99b68bc5771e0d678c393eada6cdb0780573d9fc4937bfa17c52353a52e71c203b128e1b1ed1c6e9d7841496b11be7a90a1be9aaaf6101d

        • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

          Filesize

          2.6MB

          MD5

          656ef2f8d3c10b8dccd2e04a5b8718df

          SHA1

          e6d2aab6fa1d5b3cf6a437a9b8304844eb23f22f

          SHA256

          5ed92cec9b81dd8ff3ac85ed080eb136335e0c89fd53ec5f72a7bbfb5f454d2a

          SHA512

          5caae63191d1e335e99b68bc5771e0d678c393eada6cdb0780573d9fc4937bfa17c52353a52e71c203b128e1b1ed1c6e9d7841496b11be7a90a1be9aaaf6101d

        • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

          Filesize

          2.6MB

          MD5

          656ef2f8d3c10b8dccd2e04a5b8718df

          SHA1

          e6d2aab6fa1d5b3cf6a437a9b8304844eb23f22f

          SHA256

          5ed92cec9b81dd8ff3ac85ed080eb136335e0c89fd53ec5f72a7bbfb5f454d2a

          SHA512

          5caae63191d1e335e99b68bc5771e0d678c393eada6cdb0780573d9fc4937bfa17c52353a52e71c203b128e1b1ed1c6e9d7841496b11be7a90a1be9aaaf6101d

        • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

          Filesize

          2.6MB

          MD5

          656ef2f8d3c10b8dccd2e04a5b8718df

          SHA1

          e6d2aab6fa1d5b3cf6a437a9b8304844eb23f22f

          SHA256

          5ed92cec9b81dd8ff3ac85ed080eb136335e0c89fd53ec5f72a7bbfb5f454d2a

          SHA512

          5caae63191d1e335e99b68bc5771e0d678c393eada6cdb0780573d9fc4937bfa17c52353a52e71c203b128e1b1ed1c6e9d7841496b11be7a90a1be9aaaf6101d

        • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

          Filesize

          2.6MB

          MD5

          656ef2f8d3c10b8dccd2e04a5b8718df

          SHA1

          e6d2aab6fa1d5b3cf6a437a9b8304844eb23f22f

          SHA256

          5ed92cec9b81dd8ff3ac85ed080eb136335e0c89fd53ec5f72a7bbfb5f454d2a

          SHA512

          5caae63191d1e335e99b68bc5771e0d678c393eada6cdb0780573d9fc4937bfa17c52353a52e71c203b128e1b1ed1c6e9d7841496b11be7a90a1be9aaaf6101d

        • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

          Filesize

          2.6MB

          MD5

          656ef2f8d3c10b8dccd2e04a5b8718df

          SHA1

          e6d2aab6fa1d5b3cf6a437a9b8304844eb23f22f

          SHA256

          5ed92cec9b81dd8ff3ac85ed080eb136335e0c89fd53ec5f72a7bbfb5f454d2a

          SHA512

          5caae63191d1e335e99b68bc5771e0d678c393eada6cdb0780573d9fc4937bfa17c52353a52e71c203b128e1b1ed1c6e9d7841496b11be7a90a1be9aaaf6101d

        • C:\Users\Admin\AppData\Local\Temp\setuparguments.ini

          Filesize

          634B

          MD5

          69f85e1d71e9c2b4b6ad8b1ec6b956ed

          SHA1

          fe42632654fd24fa4ff85667b09341f922ed79c2

          SHA256

          b07c34d75a7c8f6caaad4808e422fe0e473481c9ae1a011bc30089eb6d8f6911

          SHA512

          b4401493e2824d115e373acdfe2d3d632695b638e517289eba66af2c7dcd4ed76e2f929ef7d02b018dc3481bb4fe18d516d891bd36174308979bedec926da17a

        • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

          Filesize

          6.3MB

          MD5

          545c62b3d98ee4cc02af837a72dd09c4

          SHA1

          54446a007fd9b7363d9415673b0ac0232d5d70d5

          SHA256

          738029a4f974128180fa2cd239e873b01e456e8bf53bfdbf34b8ba8b57897be4

          SHA512

          8bf9c754861ed267efd2055ac09b4ad44df61b989859fccd14190592dca1dab0fa8f57360209eaceabb5137f742c9cea73a1a985ab1955f87a6875d0be95fdcf

        • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

          Filesize

          6.3MB

          MD5

          545c62b3d98ee4cc02af837a72dd09c4

          SHA1

          54446a007fd9b7363d9415673b0ac0232d5d70d5

          SHA256

          738029a4f974128180fa2cd239e873b01e456e8bf53bfdbf34b8ba8b57897be4

          SHA512

          8bf9c754861ed267efd2055ac09b4ad44df61b989859fccd14190592dca1dab0fa8f57360209eaceabb5137f742c9cea73a1a985ab1955f87a6875d0be95fdcf

        • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

          Filesize

          6.3MB

          MD5

          545c62b3d98ee4cc02af837a72dd09c4

          SHA1

          54446a007fd9b7363d9415673b0ac0232d5d70d5

          SHA256

          738029a4f974128180fa2cd239e873b01e456e8bf53bfdbf34b8ba8b57897be4

          SHA512

          8bf9c754861ed267efd2055ac09b4ad44df61b989859fccd14190592dca1dab0fa8f57360209eaceabb5137f742c9cea73a1a985ab1955f87a6875d0be95fdcf

        • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\aopalliance\aopalliance\1.0\aopalliance-1.0.jar

          Filesize

          4KB

          MD5

          04177054e180d09e3998808efa0401c7

          SHA1

          0235ba8b489512805ac13a8f9ea77a1ca5ebe3e8

          SHA256

          0addec670fedcd3f113c5c8091d783280d23f75e3acb841b61a9cdb079376a08

          SHA512

          3f44a932d8c00cfeee2eb057bcd7c301a2d029063e0a916e1e20b3aec4877d19d67a2fd8aaf58fa2d5a00133d1602128a7f50912ffb6cabc7b0fdc7fbda3f8a1

        • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\com\github\junrar\junrar\0.7\junrar-0.7.jar

          Filesize

          151KB

          MD5

          75a215b9e921044cd2c88e73f6cb9745

          SHA1

          18cc717b85af0b12ba922abf415c2ff4716f8219

          SHA256

          7c764fa1af319b98ff452189ab31bb722ea74ed7a52b17b0c6282249c10a61fc

          SHA512

          1a44af2f3f8dbfbf38ad5f71ef11b32d5822d734f77af2cdea419fb6af845e894acb60bffbcebb4533068d86b55a22a8b0f74be20b204c2343bdb165d9c787f9

        • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\com\google\guava\guava\19.0\guava-19.0.jar

          Filesize

          2.2MB

          MD5

          43bfc49bdc7324f6daaa60c1ee9f3972

          SHA1

          6ce200f6b23222af3d8abb6b6459e6c44f4bb0e9

          SHA256

          58d4cc2e05ebb012bbac568b032f75623be1cb6fb096f3c60c72a86f7f057de4

          SHA512

          834f2bf4a5b35edffde0263409649aeaf34ca9a742ba511a06bb9b01626f9e774d2d3c8ba91a7905929dc8cd5e6471de29f7d0ab10260ece2af709b7fdbe4bc3

        • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\com\google\inject\extentions\guice-assistedinject\4.1.0\guice-assistedinject-4.1.0.jar

          Filesize

          41KB

          MD5

          65912196b6e91f2ceb933001c1fb5c94

          SHA1

          af799dd7e23e6fe8c988da12314582072b07edcb

          SHA256

          663728123fb9a6b79ea39ae289e5d56b4113e1b8e9413eb792f91e53a6dd5868

          SHA512

          60b15182130ddfd801dd0438058d641dd5ba9122f2d1e081eb63f5e2c12fff0271d9d47c58925be0be8267ed22ae893ea9d1b251faba17dc1d2552b5d93056de

        • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\com\google\inject\guice\4.1.0\guice-4.1.0.jar

          Filesize

          658KB

          MD5

          41f66d1d4d250efebde3bbf8b2d55dfa

          SHA1

          eeb69005da379a10071aa4948c48d89250febb07

          SHA256

          9b9df27a5b8c7864112b4137fd92b36c3f1395bfe57be42fedf2f520ead1a93e

          SHA512

          109a1595668293b32376e885ad59e0e4c0e088ea00f58119f0f7d0d2055f03eb93a9f92d974b6dbd56ef721792ac03c889d9add3a2850aa7ccd732c2682d17ef

        • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\dnsjava\dnsjava\2.1.8\dnsjava-2.1.8.jar

          Filesize

          307KB

          MD5

          540f330717bca9d29c8762cf6daca443

          SHA1

          eed8a2cbf56cc60d07a189a429ead3067564193c

          SHA256

          52de1ff2a7556ac2cc4284abd7123bc3d6274210fc4e3b1d9ba90efad5f6a153

          SHA512

          a4bcb8bbb43906f42faf1802c504ccc9c616e49afd5dd7db77676d13aaed79a300979ffc2195b680a9c6d5f03466b611b6f1338d824099816aa224b234760f4b

        • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\javax\inject\javax.inject\1\javax.inject-1.jar

          Filesize

          2KB

          MD5

          289075e48b909e9e74e6c915b3631d2e

          SHA1

          6975da39a7040257bd51d21a231b76c915872d38

          SHA256

          91c77044a50c481636c32d916fd89c9118a72195390452c81065080f957de7ff

          SHA512

          e126b7ccf3e42fd1984a0beef1004a7269a337c202e59e04e8e2af714280d2f2d8d2ba5e6f59481b8dcd34aaf35c966a688d0b48ec7e96f102c274dc0d3b381e

        • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\log4j\log4j\1.2.17\log4j-1.2.17.jar

          Filesize

          478KB

          MD5

          04a41f0a068986f0f73485cf507c0f40

          SHA1

          5af35056b4d257e4b64b9e8069c0746e8b08629f

          SHA256

          1d31696445697720527091754369082a6651bd49781b6005deb94e56753406f9

          SHA512

          3f12937a69ba60d0f5e86265168d6a0d069ce20d95b99a3ace463987655e7c63053f4d7e36e32f2b53f86992b888ca477bf81253ad04c721896b397f94ee57fc

        • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\net\sf\jopt-simple\jopt-simple\4.9\jopt-simple-4.9.jar

          Filesize

          64KB

          MD5

          39c6476e4de3d4f90ad4ca0ddca48ec2

          SHA1

          ee9e9eaa0a35360dcfeac129ff4923215fd65904

          SHA256

          26c5856e954b5f864db76f13b86919b59c6eecf9fd930b96baa8884626baf2f5

          SHA512

          fd04c19bce810a1548b2d2eaadb915cff2cbc81a81ec5258aafc1ba329100daedc49edad1fc7b254ab892996796124283d7004b5414f662c0efa3979add9ca5f

        • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\apache\commons\commons-lang3\3.4\commons-lang3-3.4.jar

          Filesize

          424KB

          MD5

          8667a442ee77e509fbe8176b94726eb2

          SHA1

          5fe28b9518e58819180a43a850fbc0dd24b7c050

          SHA256

          734c8356420cc8e30c795d64fd1fcd5d44ea9d90342a2cc3262c5158fbc6d98b

          SHA512

          b1b556692341a240f8b81f8f71b8b5c0225ccf857ce1b185e7fe6d7a9bb2a4d77823496cd6e2697a20386e7f3ba02d476a0e4ff38071367beb3090104544922d

        • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\apache\httpcomponents\fluent-hc\4.5.13\fluent-hc-4.5.13.jar

          Filesize

          30KB

          MD5

          8f7e4f1a95a870ebee87ddacc425362c

          SHA1

          300bf1846737e34b9ea10faae257ca8fdcd0616f

          SHA256

          f883b6b027d5e05c53e48e4fe3548715c52dbd590ffa3f52d039574f1a4d0728

          SHA512

          98e30ed27d6ac078450efe5e236117445c93e05eb280399e056816c52643a3a33adce5e3a885ce8488186f38d05e0fb6c65dfcbaa509be8c6047ef2f0870d9b0

        • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\apache\logging\log4j\log4j-core\2.14.1\log4j-core-2.14.1.jar

          Filesize

          1.7MB

          MD5

          948dda787593340a7af1a18e328b7b7f

          SHA1

          9141212b8507ab50a45525b545b39d224614528b

          SHA256

          ade7402a70667a727635d5c4c29495f4ff96f061f12539763f6f123973b465b0

          SHA512

          6e41ff42f12deedb8da06cbed73d0a9a5389660b7ee058436f8fcb6b14a6ab3105faf8e3f2c007d38ccc85af1e704505b84be5a80d8e68a434aae82b54b85f70

        • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\tlauncher\picture-bundle\3.7\picture-bundle-3.7.jar

          Filesize

          2.1MB

          MD5

          904094a40b7d81b12936f43b49952922

          SHA1

          5ccf048dd51a7d0cdd59a1ea6ce2e3b167feacf3

          SHA256

          0cd5746118a3a38b7e6126770bc53c0f7c4641fab786e3d6004a4caace4fc536

          SHA512

          36e2bc67d73319b8f10a572ee3ca6f541aa51ca16c1efea9430111f3a058c9c922a43865b064811117f1c3892e39aee3bc79d7fc5ce20ccd75a13d447ca68911

        • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\tlauncher\skin-server-API\1.0\skin-server-API-1.0.jar

          Filesize

          14KB

          MD5

          13a8e72587ac6eacfb0986f75e51eb7c

          SHA1

          6c3daf89705427f73e6106d2d4d9619e99c5ecb5

          SHA256

          1fcffa073f722737431e2699b1f3ea48b92a3b825397d8f0d1464e4d4d15a014

          SHA512

          134735390415f60d0c42ff33a060bda508e273b35fc9aab271c20ff23f331b51cf3fa36443009e0987049f6bfb22c4098a1473e65ea0349e719fbf4b528f344e

        • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\tlauncher\tlauncher-resource\1.4\tlauncher-resource-1.4.jar

          Filesize

          3.2MB

          MD5

          acbc8aa5ba5cdddf5f1e67befe8cc597

          SHA1

          63b4bf89744b532e65c1afa3294743d2b3798f2b

          SHA256

          1f46b3a163012f9729905633b5e5e03ce385066ae43138a564729c942f9ca6b9

          SHA512

          d974a032d9af451c0dd51fbc0d64840f3e03eb502f40e4ab60d6722913b8a48d44a75752fcff60656e4d19089570a894222959745af11bcdf93ea1544192fee3

        • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\tukaani\xz\1.5\xz-1.5.jar

          Filesize

          97KB

          MD5

          51050e595b308c4aec8ac314f66e18bc

          SHA1

          9c64274b7dbb65288237216e3fae7877fd3f2bee

          SHA256

          86f30fa8775fa3a62cdb39d1ed78a6019164c1058864048d42cbee244e26e840

          SHA512

          c5c130bf22f24f61b57fc0c6243e7f961ca2a8928416e8bb288aec6650c1c1c06ace4383913cd1277fc6785beb9a74458807ea7e3d6b2e09189cfaf2fb9ab7e1

        • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.BMP

          Filesize

          451KB

          MD5

          0b445ace8798426e7185f52b7b7b6d1e

          SHA1

          7a77b46e0848cc9b32283ccb3f91a18c0934c079

          SHA256

          2bbf97ccba3f87d469eac909c4ce8a3f13ed29c8f31b611e7d5cf89a0619eda6

          SHA512

          51523d5b711481293305465a3a3c6a3a50dca984cdc8cca1f4c44f3c21bfa430cd9aac1a8782d9605e6954cbafb307beb6b1a52e9785de1bc3f71067d80c6b6e

        • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG23.PNG

          Filesize

          1KB

          MD5

          1cf6dc4a707fb390470baa010180aa2c

          SHA1

          573461063ec81b452576c266fabb0e30cb774e89

          SHA256

          c3fcda4e4b73324d577bccdcc7750507ea59cbab13d58e13dcb5be4f3272923b

          SHA512

          81b259e4bbe1f0265ce72d2efb92472b23c5a65fb1da6353d007aeb08d5bad56fde5fac0d85328395f2793c8733204384031c13aae9b42b0b17e435249f1789c

        • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNG

          Filesize

          45KB

          MD5

          f9eec55204e0bd1957aaa009bc1f0aa9

          SHA1

          3f576b56f97fc8cf1557d054496ac66d82f1569b

          SHA256

          015062c19f673688f853a0054f62ded39687d3c16cfd58cdd05954f58de76b6f

          SHA512

          355e36a9f014d841975ae955c6020b941396f595e1cc5e39a6a526481d5344800cbba6be5db83e44e866a9c04465a79354ca4dbd529f6a63518740fba1c1207d

        • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG41.PNG

          Filesize

          457B

          MD5

          e715517d216e2ea8972321486c64a82e

          SHA1

          ce56341376871dfb0940da71b8c2b0174eeb9a37

          SHA256

          9cace032772bfc90b522b17a1a262072df599ad8e9517a4e16d6e0b97d68e8ed

          SHA512

          008324bdd3cb33bb3d905e789af3648f814ed826db1a38f58426005637aaf8c11fb7cf038d38901f9fdf342a89a1f7f5db298923589fe6801567eb82b0f5f49d

        • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG42.PNG

          Filesize

          352B

          MD5

          f88854422ec72b0b5277a3873d17998a

          SHA1

          d2e8cbbb9872a1373fa2359a8097dbd338e10e78

          SHA256

          9c737e6242db287ef5afa117dc938286b9aa05efeb0d6af1f6fe6e83efb3900f

          SHA512

          d7094b9c457ac5b76eb8a1a2918e5571e7d8c8b57669e046037a3f8ee3749d57c1dadca4b8b0fadd0c5ffc488f036cb70d7f392ed11f74d99592bc7a5e4b7435

        • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG46.PNG

          Filesize

          206B

          MD5

          8afc6a2df8322ac99e9320a0eb07f978

          SHA1

          1c5134eb8e2d52fb55ad9a5dfddddd82c38897bb

          SHA256

          e5a9aafbba5c72f541d09f5d6cbedabe1caf0076fc198a6ac2fba7ad7a0df979

          SHA512

          9f955409fff9a0011a06967040df80675aad83b893ab2d00080d3411aad2844e416641b247ba18bcb9a7753f17e4887ecc18b9fca1389075dc8d1f98bbce694b

        • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG48.PNG

          Filesize

          1KB

          MD5

          b892dcb07f669beaf1f92b08237d712f

          SHA1

          320d43d5afc38abf5d73d0363f88417b4363dd8b

          SHA256

          cadbc5331a0cadb9898090f5624decc1e231cc8b1b50d35bee97a8bfae04e6f0

          SHA512

          d47a0555f0a048e18d9628f50299d1ad5632da9cb620164bf3a684fa22a33d56b3736f64d614566532029d31e92cc2184a85fd6970257a78a11deacca5e79b32

        • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG5.PNG

          Filesize

          1KB

          MD5

          3868db0b80c782a378d17b7133f41a7f

          SHA1

          0c52b2223be436848c656472db2aaa5fe99422e5

          SHA256

          b814c7da30e3615e78267290272964bc1cf700a8cab57520f4d7624fcef20b89

          SHA512

          029d4e6a4a5e6d1644b17d6c3b376f57564b25bc941c810466c39f6fdf5d87915f5ba36e31a64ea73b15c9b2eea9b73089ecf2b3773c6f9be8567ace230d2c33

        • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG66.PNG

          Filesize

          41KB

          MD5

          383d7e5742dade5dc9f24d3b3ea42812

          SHA1

          650af6fc1ca47619a7298c090d9c1e5ede22a271

          SHA256

          681a223f76a0c42de09062573219c16988512efc43e056391d71bc9dc3363b4c

          SHA512

          01f370ec27505f5474e2b6b746d46e37d121906f3c43e4468a1ee78053c75b3249a4dbe1cb813d13363a4575785629925558621d5d660a32a4e7a5ad666c6396

        • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG67.PNG

          Filesize

          1KB

          MD5

          de1b0d4aebc8d24f87c9536c5f2a5ff3

          SHA1

          9855d577b6827c7e96171584b907e2efe5b803e6

          SHA256

          ec0653fad51c2068e8b22e17a31907b2cd0c9629781112d6ba27a3f499e83509

          SHA512

          85dd7a66ec9cc5e782578886349e26956b68ad80fd7d20ea931f6b4ea9cd957248ddb52ebafa9161f9302862ecc72b72bd497068d9b63db467d46e74c71cdffe

        • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

          Filesize

          21KB

          MD5

          53f273f8e2da4ae72b5e0229470ef9d3

          SHA1

          4bf71767acac851a90f66888920f0625e7dc6557

          SHA256

          43978b0ee53ab74bdc6cecdc7823daa6249f6c76e746fd6308a2ef5f1abe352f

          SHA512

          48c63eee75ba759f8eea35243decfd667a336415dfeec25e3655b6726b46ce68d2cbc7119e09aa0f23bcdeb564e4ef006b0d7dbc5e37bfe33109d9452bf1166e

        • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

          Filesize

          10KB

          MD5

          4e77b12328fcd58587ae3fa25ca2aa11

          SHA1

          40fa8cd9910d3586e46ec9921b376ecee238cd2a

          SHA256

          30376302e9177c1611e5655dcb28c414ad5a37f4c61a97b7a1b5c6a4a39f36df

          SHA512

          b153d83979de60e3462d6ef87c579eff8d068687be7d9ade49a0c8685ad754aa4ee2e2571d7d607b2090ce3db44ea25dca9c24243b6821014a34ba00eb19e4ba

        • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

          Filesize

          40B

          MD5

          4ebb6877e372e6f6523c9499ee25ca7d

          SHA1

          82ca3f6131a7b4e95a89d3ab30249f26c3295f9c

          SHA256

          61989ec37e28d455c0797a51fde3d3e24309a23c054484a0b892336cb02a4011

          SHA512

          41b3ec94c02a120fae076611e16ff2c8d039c9a2417d656109ecdd7a41b0906590e15fce912ee64aa1edb3a37900cb58bc22454e33cdfecb16947fea9466c72d

        • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

          Filesize

          40B

          MD5

          4ebb6877e372e6f6523c9499ee25ca7d

          SHA1

          82ca3f6131a7b4e95a89d3ab30249f26c3295f9c

          SHA256

          61989ec37e28d455c0797a51fde3d3e24309a23c054484a0b892336cb02a4011

          SHA512

          41b3ec94c02a120fae076611e16ff2c8d039c9a2417d656109ecdd7a41b0906590e15fce912ee64aa1edb3a37900cb58bc22454e33cdfecb16947fea9466c72d

        • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

          Filesize

          40B

          MD5

          4ebb6877e372e6f6523c9499ee25ca7d

          SHA1

          82ca3f6131a7b4e95a89d3ab30249f26c3295f9c

          SHA256

          61989ec37e28d455c0797a51fde3d3e24309a23c054484a0b892336cb02a4011

          SHA512

          41b3ec94c02a120fae076611e16ff2c8d039c9a2417d656109ecdd7a41b0906590e15fce912ee64aa1edb3a37900cb58bc22454e33cdfecb16947fea9466c72d

        • C:\Users\Admin\Videos\Captures\desktop.ini

          Filesize

          190B

          MD5

          b0d27eaec71f1cd73b015f5ceeb15f9d

          SHA1

          62264f8b5c2f5034a1e4143df6e8c787165fbc2f

          SHA256

          86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

          SHA512

          7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

        • memory/392-643-0x0000000000A80000-0x0000000000F8E000-memory.dmp

          Filesize

          5.1MB

        • memory/432-499-0x00000000005D0000-0x00000000009B8000-memory.dmp

          Filesize

          3.9MB

        • memory/432-147-0x00000000005D0000-0x00000000009B8000-memory.dmp

          Filesize

          3.9MB

        • memory/432-1662-0x00000000005D0000-0x00000000009B8000-memory.dmp

          Filesize

          3.9MB

        • memory/432-437-0x0000000006990000-0x0000000006993000-memory.dmp

          Filesize

          12KB

        • memory/432-461-0x00000000005D0000-0x00000000009B8000-memory.dmp

          Filesize

          3.9MB

        • memory/432-462-0x0000000010000000-0x0000000010051000-memory.dmp

          Filesize

          324KB

        • memory/432-467-0x00000000005D0000-0x00000000009B8000-memory.dmp

          Filesize

          3.9MB

        • memory/432-1986-0x00000000005D0000-0x00000000009B8000-memory.dmp

          Filesize

          3.9MB

        • memory/432-656-0x00000000005D0000-0x00000000009B8000-memory.dmp

          Filesize

          3.9MB

        • memory/432-585-0x00000000005D0000-0x00000000009B8000-memory.dmp

          Filesize

          3.9MB

        • memory/432-503-0x0000000010000000-0x0000000010051000-memory.dmp

          Filesize

          324KB

        • memory/432-435-0x0000000010000000-0x0000000010051000-memory.dmp

          Filesize

          324KB

        • memory/1168-2055-0x0000000002B60000-0x0000000002B61000-memory.dmp

          Filesize

          4KB

        • memory/1168-2062-0x0000000002B60000-0x0000000002B61000-memory.dmp

          Filesize

          4KB

        • memory/1168-2064-0x0000000002B60000-0x0000000002B61000-memory.dmp

          Filesize

          4KB

        • memory/1168-2034-0x0000000002B60000-0x0000000002B61000-memory.dmp

          Filesize

          4KB

        • memory/1168-2010-0x0000000002B60000-0x0000000002B61000-memory.dmp

          Filesize

          4KB

        • memory/1168-2002-0x0000000002B60000-0x0000000002B61000-memory.dmp

          Filesize

          4KB

        • memory/2076-1983-0x0000000000400000-0x0000000000417000-memory.dmp

          Filesize

          92KB

        • memory/2272-559-0x0000000000A80000-0x0000000000F8E000-memory.dmp

          Filesize

          5.1MB

        • memory/3764-598-0x0000000000A80000-0x0000000000F8E000-memory.dmp

          Filesize

          5.1MB

        • memory/4620-571-0x0000000000F50000-0x000000000145E000-memory.dmp

          Filesize

          5.1MB

        • memory/4844-550-0x0000000000A80000-0x0000000000F8E000-memory.dmp

          Filesize

          5.1MB

        • memory/4904-527-0x0000000000760000-0x0000000000B48000-memory.dmp

          Filesize

          3.9MB

        • memory/4904-592-0x0000000000760000-0x0000000000B48000-memory.dmp

          Filesize

          3.9MB

        • memory/4904-1991-0x0000000000760000-0x0000000000B48000-memory.dmp

          Filesize

          3.9MB