Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    102s
  • max time network
    196s
  • platform
    windows7_x64
  • resource
    win7-20230703-en
  • resource tags

    arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
  • submitted
    07/07/2023, 16:42

General

  • Target

    TLauncher-2.885-Installer-1.1.3.exe

  • Size

    22.6MB

  • MD5

    bd3eefe3f5a4bb0c948251a5d05727e7

  • SHA1

    b18722304d297aa384a024444aadd4e5f54a115e

  • SHA256

    f1b132f7ecf06d2aa1dd007fc7736166af3ee7c177c91587ae43930c65e531e0

  • SHA512

    d7df966eeda90bf074249ba983aac4ba32a7f09fe4bb6d95811951df08f24e55e01c790ffebc3bc50ce7b1c501ff562f0de5e01ca340c8596881f69f8fed932d

  • SSDEEP

    393216:KXGWOLBh2NPfs/dQETVlOBbpFEjdGphRqV56HpkoaH3D8P2Q6YS6x9DOc:K2/BhSHExi73qqHpu34kYbzOc

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 21 IoCs
  • UPX packed file 18 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 63 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-2.885-Installer-1.1.3.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-2.885-Installer-1.1.3.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2172
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.885-Installer-1.1.3.exe" "__IRCT:3" "__IRTSS:23661420" "__IRSID:S-1-5-21-2813141852-3076131560-4232376420-1000"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2092
      • C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
        "C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2240
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816850 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:1841988" "__IRSID:S-1-5-21-2813141852-3076131560-4232376420-1000"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:2028
      • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
        "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2820
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" http://java-for-minecraft.com/
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2592
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2592 CREDAT:275457 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2600
  • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
    "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:2100
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://java-for-minecraft.com/
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2288
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2288 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2356

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    1KB

    MD5

    e7241c40dfde6c38bc387a57c3aa2dbf

    SHA1

    9708754ca64879a9a93dc01f83247a5a41305b63

    SHA256

    4a8ec959080c0a0788105c4e83fcc7736acfb9a8f9e7b130fd80aaa49ef4bc0f

    SHA512

    a4e89dcb2da9d5c633f3e59347f03777d65c3364c6d46903353b577de836319c5a5b782200c97e7ff9cfbbf371247c640da75dd76a25243ae68414d7eaf4b127

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

    Filesize

    724B

    MD5

    aa62f8ce77e072c8160c71b5df3099b0

    SHA1

    06b8c07db93694a3fe73a4276283fabb0e20ac38

    SHA256

    3eb4927c4d9097dc924fcde21b56d01d5d1ef61b7d22bfb6786e3b546b33e176

    SHA512

    71724e837286c5f0eb2ee4ad01ac0304d4c7597bb2d46169c342821b0da04d8597491bd27ef80e817bc77031cd29d2182ccc82ef8ea3860696875f89427c8e0a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

    Filesize

    724B

    MD5

    cfbc16e33dcbef6f773f0f79af528f45

    SHA1

    ecb8d5e8107bc671dd57fb2a137c00bffa419f1f

    SHA256

    f0937890fb1053069baac97b7992c6d22cb74cae20317fc05d51070d96950ffa

    SHA512

    59ac2ead1eb84edffb06867850beb1e63f72c5b5415abd2fd4e7c2a1922c368f612d2a0288c00e32d5da47c4a77968ffbe72660a8d1f577f44fb20df9c11a4af

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_94E0C54DBFB2FC554B80CE25640AFDE1

    Filesize

    471B

    MD5

    575f1868e405ee01ff71785fa37d0519

    SHA1

    233dd47d9be642c65822a8d03f76760c9bed8ef4

    SHA256

    f13ba1d50dfd6a589f1a47c2e2762bab514e324057e41137d50ff4b7770a1f64

    SHA512

    6ea8325d69abf35f906e9ec90ba845842de7056e602869a703b7a81212a28e4f07e6279e598ab933a775a87ec7a04c35c218e54cb487f786efbe07a35aec4047

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    410B

    MD5

    fa5ad9d98e3d293276565041f4c8354f

    SHA1

    024aa6ea1c1367d35fb3467298fb04d31f873b36

    SHA256

    dfc8be0f0fb0a239db48509bd32be6dac93c1b2d57d4e4e42603aeff42b07664

    SHA512

    7ca8e0aeac4fb739cd158197ca99ff213f473fb16ce88e4bbc66b82e8b459b4459ccf10141fa7eaa648d0bd4c330ad27e62e5f303c2aaa8ef85a259dd4928c17

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    cafabe1c3b54674407db8af305c4be79

    SHA1

    47683eb5ea14b3f061b3fec66711fa3de52e7382

    SHA256

    f7bab25c048e811d9e43c9daadf7c01b0f3873dbb152481a5beaf9294a788424

    SHA512

    ff471f46234125c5ccf4af6fa3d46629f6398724ddb809863cd4fe0931063b3dd254df763306a1203ad175c30e07678e73905553ed4f10052ac8af15e098c31f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    5573a13ad144c1377e037e05727ddef5

    SHA1

    5b1c5e1397ac5497ed11e8f8aa8154d93f6f0d35

    SHA256

    7757c1216d1755d60f476e82db972a451f06f802d1770207db465145a533dce4

    SHA512

    9ca81a643de379787592ab056721feb18f52ca5d7f85c024cab4cad98453a8ee4467cdf2906faa02ca4009bfd0f2b9f15f3fdf83501af662e29ce0372e4b51df

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    8bed2a4bfbd424bccdd00d1b8c40ec7d

    SHA1

    1d82127370ce53f5c5524dd40058e842644c33bc

    SHA256

    70eb22a7cc9c2c66a708e8f6e084b9aefdfc28987cf17db901d757a93606e85e

    SHA512

    4d42cab5c77496c438390560e30bbbba977a4d820e880b7210b76fa2546542ee7f0321af3c04976b6f24c55abbf2c712163912e02c6dff3e25139e5c5abfb6a6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    3f8d0586e64a086654a692751a72634f

    SHA1

    b8fab1d486e5979110129f5d4f98025052f56ddf

    SHA256

    8f9ed5d5c317d64a1286c1c1d458e402ac2e99a3dc522aa7741024a44c1b2507

    SHA512

    7b36ce92c85610ec610eb3099ea3ba519f9fcb91ec6ed66a0a21d24bfd07500951d73d56afaa1de84a55e15767ea6d4be542c6f577609b9e9962424f433dacae

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    46557f63ce7a67c5aab8b5aa49c8b0a0

    SHA1

    2dea9946be3cf60d259b78f2cd80c436dac22fca

    SHA256

    8b27474921008a811e5cadcce357a75be929240028f60c76996347a548ed799f

    SHA512

    62d635fb49640bfc5376921695eb9de0d12fde7c3ac72a0c7e5ea32fa0354e8212ea10b6a58dd084e2bab51ff8ab990d0d61ecca6b3572a79e6e8b178a921ab1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    62ad74615443d008d33ca23735ec9232

    SHA1

    06a006a199070aed27fd2c718861aebb2a98b956

    SHA256

    b6c29c4ec0c5bcf45186d7c5fe306dad3befbf7aee8d6d39e53a3d6ccfd00ce5

    SHA512

    f99a3fc0e880f44bc6518780a0c4e13973a08194b9dab9828fb1a47081fd3f31f28be812b22e9c34ebf419deb9b78d9c6a6a5d85d76986b933efdbf1e5cd47e8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    3311c8a971cf5382016c7b5f21b54d37

    SHA1

    301451b78d235a8fd6ebbc363c3841c0645327cd

    SHA256

    3ade930356413978ad8c1bed77fde556d9722d860bdc944343c31f30691a4cb6

    SHA512

    e2aed08b5684e13cb7767cff4216727c349105c6648159bb0baf0b59925dd1cc6fb3762448bcd775108810c5380efe98c88bcb597c7c72175b46b761dc871875

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    df006492791af951c044e12b0d379881

    SHA1

    cf6e42cc8298e29288b086c91c0853ab1b231b65

    SHA256

    5898a0267aabff27398730d86efb92a94a52310dfd53c4acbbd5c5df4fe92548

    SHA512

    2fba2ed3a04036dbbbf648e2d4aa516e746ccad33ea363b2cc72951a2ddacaef29dd730215b1ff0bbef4c579a1485df4c1b193e586b9f9435d8c15ad54f6e3e9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

    Filesize

    392B

    MD5

    feda4dba48214d87086f13a86e9b1db1

    SHA1

    8f945e8811afe383e95f953f62d98b38063c7b10

    SHA256

    96e53b8b82c9a605f79114db5cc57151e8e04159941d63b3e445f83b9cc4e64e

    SHA512

    212abe95a08419bdda57c9c7d79152047c7bcbea407c91e0364010796982355c39849d689567388d74ea6b7aff2c1d6bc14afdaf653169d4d73f8e20da6808f6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

    Filesize

    392B

    MD5

    55134bb1d58c587baa338a07274c0b06

    SHA1

    942eb9f5a8ba5628f42c5729155f6e340dc48ae9

    SHA256

    5571a6ed0b6e2ba6651789f77eb500d14767f9f05c2f1cff210025d1869467cb

    SHA512

    b473e920360b0bb723728c29b07a94879669eac1f21b43b17ee9b8021d4f31af146f9fff89a14d5da81393ba6bc2224652b1a7b16af14a7e8c60050696dc19fe

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_94E0C54DBFB2FC554B80CE25640AFDE1

    Filesize

    414B

    MD5

    1bc396e4d2660babe53eb8f07e8910e3

    SHA1

    9cbc1e66dc2981aca52e5c0f1596af08b67e0eff

    SHA256

    069ee1670d289f0d585f0162a44fee6ee1a2c452631bfcde643ff27133357214

    SHA512

    4b0b7df7bd25967d2a6cb2f8be3e15ed2afc77c72a76e7e956437ec636838084ccd06af4cac27eda107bbbaf96657be130d0906c14ab7c77ffb213ac171a09c4

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{73E69D71-1CE5-11EE-864C-66DBF85D7F8A}.dat

    Filesize

    5KB

    MD5

    ff3af6c021d71937d6783635d054475c

    SHA1

    64da00becfa3a3074b3459544271ea4ed55f8da3

    SHA256

    d6dbc3acf45d4a7f56978335069b71e7582cd2bbc8163a7a415dd3ea0f2d4d7d

    SHA512

    4f6cddb8a1b229c40edee1f1fc706ae2f986b843696b7ad8d8337fea5669f1925e8ee311dff47f282c94befeddc4b9411ce2c055f63f7a047da12f22fee15c9e

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{66D2F5F0-19B3-11EE-BB98-52FF6C828047}.dat

    Filesize

    5KB

    MD5

    61d277f812df65bd0631ccb0417e781e

    SHA1

    b71669cf26ea03e6369828db3f99f012a7f5f093

    SHA256

    a09da1875d5fc7333d3f87aaee8fc2f6b22de2ba5ee6a7a8ea5dbf9576a9995a

    SHA512

    73dde0f8852dd01c2d223a604ccf6cb32f9a0758854282e7a3fa69c35b01c53d2df20104d1d856ffcfcc3345162093a69ea5a8ee07d0d4aff15547213c2ad45c

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\{73E69D74-1CE5-11EE-864C-66DBF85D7F8A}.dat

    Filesize

    4KB

    MD5

    e8a45859e21063c8ec03eba6e90e0cd8

    SHA1

    c2cc92fb7cf562969e3c86358010e303c356bcaf

    SHA256

    a8425d813b3931801baee594f9445d61b2b907d5472a009fa16302eecbfbcdb7

    SHA512

    c82f25305739cd483d78425828bef2729da2be4149f570e4b71b621d8516be1fda471898c5bd0ca79b5285a022803403c70539efaa093345d56958cc625afc91

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\cresycd\imagestore.dat

    Filesize

    4KB

    MD5

    e68424374ea9285a3ac5e832309fe1dc

    SHA1

    34b4e2117a222aca39588e00dc870014eec68c22

    SHA256

    6ab1691ee1d815dba17df38b76026b3f5f11b7b608ee98c4c3ebcc32e07a9e84

    SHA512

    cfe37222c0594803f017b1a06203f2564540edcb0b2d4f19f5607a280332bbc64c22e898f8dac72a75ef2bbc40bf7779455c497266d749bff2837b4e006b0e45

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\00ANKNIC\Geometria-MediumItalic[1].eot

    Filesize

    133KB

    MD5

    4f5d0cff4b01ea43b37a8d35675da88b

    SHA1

    fc89cd4aef8db5dcb89eb9992945f58be75cb123

    SHA256

    d235cf3400e51a971edf939b821780d7b6f25cc0ac40236bc3ec80762f54bbf8

    SHA512

    6b5f3730d56f8ab9f4bccd566693a38f434246f8c67a598b798519eac8f9ac8c804aab4391d0fa0e7536ae864a0d05782001a0e1d711ddc33be566fc7d92d030

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\00ANKNIC\js[1].js

    Filesize

    207KB

    MD5

    b97a29aa5d3b05417444f1b17448017b

    SHA1

    ffa14dd0eba1b454bd8a994941efae93161fc53f

    SHA256

    531cab572952fef562f3812c8b1167142cfa898d16aefe5e733915561594e270

    SHA512

    404cb5803c76dcf2c061ee3b808e3b36b05f2c8cf5e1de3cb68e9b2a7408b56d29db85158977bf0b33e3bf99c76f3585adb07fbe888b3d185c6cb0cf81925632

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I7D1MYZ2\Geometria-Italic[1].eot

    Filesize

    136KB

    MD5

    a09caa037bb876d250a8ff67f7b9370d

    SHA1

    5004b28ed6bffa04364e9ef81e63bd04d58b5e4c

    SHA256

    6029eb14b08b79b84da587f9d5bb89958d658cb0c285c88ab18c322e6f3eb03a

    SHA512

    0e3716d0ace6611124925585d85bf09ed6ce78bb55584d989913bdf63892019964f372df096187ae6d0ba3d2cdde2b6a432a47dbe9307a41c5730a465d01739f

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I7D1MYZ2\stylesheet[1].css

    Filesize

    6KB

    MD5

    5a9976f81fab6d879b52bf460f9ffd30

    SHA1

    d150e8c74449a022a4a200edf71d3231c881a25e

    SHA256

    abc4e8a3e337391d86731857bd8fc2511e35c9f5c17544fe477d7295df0cf569

    SHA512

    5913a7a04f633a852e18311b76a09725a2ffb87dd8876a5afc2e408364fdacc33b634f8e3fdd37514e5a83c8b71b2333975a79ec040f54cf9a1d9cc56bfe09b6

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ODRCOPYD\Geometria-Thin[1].eot

    Filesize

    129KB

    MD5

    4ac4107ad6d9bb9a480240e74b1484fe

    SHA1

    0b6d3bdfdef2e9d9248c753105f790fa56ef418f

    SHA256

    cfcc9cbd639d06791d001a6e3fa3ef694ab402842882d7f6a123758760151897

    SHA512

    3e175daf32085e7ee2af58f3d16e3bae210520a65313b4abbae67088d4938b03f18e54f734ded79024c62e96b8f2da877a4d8c9481cf906c7c274405e5873b4e

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ODRCOPYD\Y3UTMWZE

    Filesize

    5B

    MD5

    fda44910deb1a460be4ac5d56d61d837

    SHA1

    f6d0c643351580307b2eaa6a7560e76965496bc7

    SHA256

    933b971c6388d594a23fa1559825db5bec8ade2db1240aa8fc9d0c684949e8c9

    SHA512

    57dda9aa7c29f960cd7948a4e4567844d3289fa729e9e388e7f4edcbdf16bf6a94536598b4f9ff8942849f1f96bd3c00bc24a75e748a36fbf2a145f63bf904c1

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T1HIK2FF\Geometria-ExtraBoldItalic[1].eot

    Filesize

    128KB

    MD5

    e015803b8ba06bd1b732253329bbaaa7

    SHA1

    836991b59df71cc5b04b701083f327093b25083f

    SHA256

    e781e297aeed5a63f623f126be84afa7260183fe3bb7c8b4779d8b9eb4b6bb63

    SHA512

    0e742a074e5c655e11b53fd9ea0b15c5a06d3a5187e39bcc04fa41140d62ea076e07469fa119c3a6ecfb6de9a9a6e90c1cb19696dbdf1f4cf7acc984d2a86314

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T1HIK2FF\Geometria-HeavyItalic[1].eot

    Filesize

    128KB

    MD5

    890e0c6eada28298313ef8088a5e85b3

    SHA1

    a7f9506392f2dcd3de00e654c83ae4b14d853a7f

    SHA256

    e033af1b78c96b40e4a30ad2415e98112e7d420f85291cfddfa52ff5e600b78c

    SHA512

    88a87b514c7920dff66a34edeccd764d4b72c70a07975b142dab88ba100ef27fecbb725621dbb32121bd8614dd1a771a182173c332e04ff604e9e35be8413c4a

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T1HIK2FF\Geometria-Heavy[1].eot

    Filesize

    122KB

    MD5

    6b3c88ff9a634a5e1a4f193112157f7a

    SHA1

    ba818394f7bad2e20c1d2b470d7a5ec0b8753fd2

    SHA256

    8dd274de31368be8afeab06a183d2d9b8485b8f6df5a5e964f8a4ca2c0b1dcf3

    SHA512

    f62e02a262fd414c0cb3238d502d987ec2fc380fca7600fd7904a5657b745279b6fa0c1b91c5cb1d706da5260bf51fc4baa490bfdae531ebcafc509165ab8cca

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T1HIK2FF\en[1].htm

    Filesize

    6KB

    MD5

    de12b6fa1d6ed32bb05f4e195e094b47

    SHA1

    c89605b04b09858855d31a7e156de8671cd6ba16

    SHA256

    395750da9537c87ccb0d7ab15a231d6d6628357b803cb717b66862924a776ac3

    SHA512

    8a58f0e8b38560e277340a5b424342e7b9fcabb415e14318a5a3199ffc56fc500ba89144d53d482073626ffffeaf6b5a31e4283482aac8b4d4d85406ae338ae1

  • C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

    Filesize

    1.8MB

    MD5

    cb50d496ae05fa1c8bfbcb3b7f910bfe

    SHA1

    3ec4d77b73c4d7e9858b11224314e99d082497a8

    SHA256

    7616c72f6659a3a2439d0452190459cd4ceb83fab2307e3e47c9604fa29d9f34

    SHA512

    22051de06c7e52a37ad36250aa095a8ccc0b0e1cdbfa2e9073c146e77e278cbdbe89bdb078dcfd8babf48baec1902b303ac39cc9db4114ce1516b06552dc924d

  • C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

    Filesize

    1.8MB

    MD5

    cb50d496ae05fa1c8bfbcb3b7f910bfe

    SHA1

    3ec4d77b73c4d7e9858b11224314e99d082497a8

    SHA256

    7616c72f6659a3a2439d0452190459cd4ceb83fab2307e3e47c9604fa29d9f34

    SHA512

    22051de06c7e52a37ad36250aa095a8ccc0b0e1cdbfa2e9073c146e77e278cbdbe89bdb078dcfd8babf48baec1902b303ac39cc9db4114ce1516b06552dc924d

  • C:\Users\Admin\AppData\Local\Temp\Cab3D11.tmp

    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

  • C:\Users\Admin\AppData\Local\Temp\Tar64DE.tmp

    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico

    Filesize

    116KB

    MD5

    e043a9cb014d641a56f50f9d9ac9a1b9

    SHA1

    61dc6aed3d0d1f3b8afe3d161410848c565247ed

    SHA256

    9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946

    SHA512

    4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe

    Filesize

    1.8MB

    MD5

    cb50d496ae05fa1c8bfbcb3b7f910bfe

    SHA1

    3ec4d77b73c4d7e9858b11224314e99d082497a8

    SHA256

    7616c72f6659a3a2439d0452190459cd4ceb83fab2307e3e47c9604fa29d9f34

    SHA512

    22051de06c7e52a37ad36250aa095a8ccc0b0e1cdbfa2e9073c146e77e278cbdbe89bdb078dcfd8babf48baec1902b303ac39cc9db4114ce1516b06552dc924d

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.PNG

    Filesize

    339B

    MD5

    e5e9c323b6a9533a09982b2117c61528

    SHA1

    3dc0e877803d6e16b28ce0840e2967cc74494a61

    SHA256

    ba1f3e4598c5716bbfea508fada40b7dfd0989ddabd453e8c8703c04270151fd

    SHA512

    bbfa29299a1e948506f6ec3802aceb27f8aef3a5b2e3c9789a92b2bcc959fc2523d2344739ccc89df370dde6ea23c1db5ffc7e4799b5e532b0ec85dc98996865

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG104.PNG

    Filesize

    644B

    MD5

    d59d425a5672bdb23aced47f2cf4c897

    SHA1

    6eb8bf3f328975250fb0f9fcf56bd1fe530971a9

    SHA256

    09858e3e9eea849635ec67d94dac9b6f0c1f8d4bf021fd4bd2998f7e23069026

    SHA512

    0f45ec639bb40c216dfd858df1a65766fd7ca95d5015ddbeff525dbe5433bb83ff786665864e386c92ce3ab3de0c3e409bd90b93260dc5f8ff5a983dec87b7d7

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG105.PNG

    Filesize

    40KB

    MD5

    5c1172831dec567dbdf05ae8e8a0a7f5

    SHA1

    cf9281b3bbfed132faece1c19ff5c9c0ef700d4a

    SHA256

    4d04ba36110afcd0c4d0e3c214cdfa42fb975bf3f5da6b78fd7e8f6a97eea4c5

    SHA512

    03f5341bb49404d96bf3532d1432ee3b40f377891f7ee1464011bbc7a6c76f0ea7162931fb18d89b5c16950c93bc0288da0ae5bce4f04565b627c92cd9c9972c

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG106.PNG

    Filesize

    1KB

    MD5

    a708af8ccc9c0b2ba65a828eb09651f0

    SHA1

    adefd77a4a1bc13f836b2ff7f773abb69e7f6177

    SHA256

    4ba6951d4f317a5fd8c38ccbdfb7f9731e7c5421b4bd9aeb7f83bff87ef3912a

    SHA512

    6e8e4d511bb8861a0dccba17da26147516ff70feb9ddff816e27e516432c99493a40624e482074f9fca04b9d638060e2bcf1346eeeee24019902c91b23793fff

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG109.PNG

    Filesize

    2KB

    MD5

    9e6e117037f3eea2ac5ba39de4891519

    SHA1

    156773a282502194ebc894922269dfea9fb3ba4c

    SHA256

    43398f595e5a0498cb9303252dcd5d0c0f98c1a1bc843c21debe8386e82700bd

    SHA512

    6afd9968434878ad1b739e298b351a221b00b9f140c475c9ab00d70b7e5ebaf6df6d20c70356db6f6f41c3ccb9ddbc34f1e8b4bf70f5ffcb64f0e0bdc0d9797c

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.PNG

    Filesize

    280B

    MD5

    5803b5d5f862418b64caa83396e69c7f

    SHA1

    97b6c8209b8ad65f4f9f3b953fe966bb09ee4e13

    SHA256

    ee340f8560ba2e71d7e6d305b959ff8fa77869dac916287da2bff7ce5aa2e159

    SHA512

    e9bf37f0c89299bfa369a8677ac56b12177dd3153246e5e6a9390577658111b731b0ab987044d30f43e05cb41d79ed31dae3b6f4521f225925920617d0414edd

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG22.PNG

    Filesize

    1KB

    MD5

    2003db45b3b05d65f34d7047e68a25bf

    SHA1

    418d27146938b810c31ddb6a1f8075e7be1d2f14

    SHA256

    10cf5fdda26ed5f3762d5a527fd2bac692034b8d848547e5c320037026317310

    SHA512

    8eb6143e3732bde22ba72da70b6ce6ee4ec9c9038334c2380b60e49dc24021792c32a2c7224bf04aa1cd8d77d57b0e3fdaf4606eeb3d4c2985bb9bd91b10738c

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.PNG

    Filesize

    281B

    MD5

    60a19921c7ff3c75e28c302f95460994

    SHA1

    07ac64ffbb153c8675e2ce0651afeaa5e8c6652d

    SHA256

    33341d30463fbc7cf3fba5070925569c822b6835aabdb8ef2c3cf09547912d46

    SHA512

    b30b960152dc13b1a9d384c4972169392cd405bdf4d3ecf73f85cf8a9a68a075131b2495c0348f54d43d0e7a279907bc7b76ac103f4a624738cbfc73bbeeba02

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG46.PNG

    Filesize

    206B

    MD5

    6b2addb09533ae5cc0650ebc8779f948

    SHA1

    7bef900d216614f9f498d33b345372e40d872628

    SHA256

    260b130f51840a7b353a640ae69484498c6ec957e37f3bac831a140db533da84

    SHA512

    769bbde3aaac255bd5464acaedae0a5b9ca0e11e9cc9ce0d71cdb4e47ee21fc3610bf43240d52cf2d9bdc74478384f5c1130f0d919927067631d01a1446aece4

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG85.PNG

    Filesize

    43KB

    MD5

    380f7b952bf592f1d46afc860e9634ad

    SHA1

    50c467afe895945bb246b700d66af758662bdbb0

    SHA256

    43303ebbb809356c71c8b040d2fa289106996aa04ccf54d9bf742db763a7213a

    SHA512

    08cba7883a4ed219f9da8537756d75a94219e2a3fb6dd50c81ca607b97388e7aedc19bebaa5d375f533f7ab17d8a748f85589f61a2e09d8a9c591ac5cd0bca8b

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG86.PNG

    Filesize

    1KB

    MD5

    93dfe531659e394eea5e5c7d6e99ccca

    SHA1

    00be7e0e02a48371c120b850410f46dd2cd4718a

    SHA256

    3fffd66684072e9aeafbda1679718a4dd1e569efa7e04df580a487aa9e4e08df

    SHA512

    a67ab0cd46fcb247e1ea47d17017aedd9e7359c739eabded9d2622d11c0a8fd49664ea383209c965d084a52b3134edd5a5be5902f1e85a85102f2c5cbc328af5

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

    Filesize

    1.7MB

    MD5

    1bbf5dd0b6ca80e4c7c77495c3f33083

    SHA1

    e0520037e60eb641ec04d1e814394c9da0a6a862

    SHA256

    bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

    SHA512

    97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

    Filesize

    97KB

    MD5

    da1d0cd400e0b6ad6415fd4d90f69666

    SHA1

    de9083d2902906cacf57259cf581b1466400b799

    SHA256

    7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

    SHA512

    f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

    Filesize

    1.3MB

    MD5

    a70accbc1f1001cbf1c4a139e4e5d7af

    SHA1

    138de36067af0c8f98e1f7bc4c6bea1d73bc53ab

    SHA256

    b000fef41ce0267255701aacc76c02159d207212c4595437077e7904b7968ca6

    SHA512

    46fde27847dfab38d2f6fefca31677a0d5a5ac775951fc19f1fc0b4ec56969622f0c4f036ecacc05b33854871f03232a4944f3e93a747280cac622503f5c4f04

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

    Filesize

    1.3MB

    MD5

    a70accbc1f1001cbf1c4a139e4e5d7af

    SHA1

    138de36067af0c8f98e1f7bc4c6bea1d73bc53ab

    SHA256

    b000fef41ce0267255701aacc76c02159d207212c4595437077e7904b7968ca6

    SHA512

    46fde27847dfab38d2f6fefca31677a0d5a5ac775951fc19f1fc0b4ec56969622f0c4f036ecacc05b33854871f03232a4944f3e93a747280cac622503f5c4f04

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

    Filesize

    1.3MB

    MD5

    a70accbc1f1001cbf1c4a139e4e5d7af

    SHA1

    138de36067af0c8f98e1f7bc4c6bea1d73bc53ab

    SHA256

    b000fef41ce0267255701aacc76c02159d207212c4595437077e7904b7968ca6

    SHA512

    46fde27847dfab38d2f6fefca31677a0d5a5ac775951fc19f1fc0b4ec56969622f0c4f036ecacc05b33854871f03232a4944f3e93a747280cac622503f5c4f04

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

    Filesize

    326KB

    MD5

    80d93d38badecdd2b134fe4699721223

    SHA1

    e829e58091bae93bc64e0c6f9f0bac999cfda23d

    SHA256

    c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

    SHA512

    9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat

    Filesize

    114KB

    MD5

    4a6a32076a6ec33b804682a0630d916e

    SHA1

    5f59244343506596b8b13145cc7b7685a85b25af

    SHA256

    91106348245a378a20028de836ca8c4f8b21248d6d5b115892f1d915d3f83ab5

    SHA512

    a0ac7f21f4d9c247915615faaaff2e164e6defb58bf015cdd3420a63238df8d3c984545179a4567d48882c4c59b483819f6bf59ca532d2449cd6deb081451fd3

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

    Filesize

    1.3MB

    MD5

    2b2fb67e0f041923ce66c1d1f2d91eee

    SHA1

    31d1a53b1eaa37f6bf7aae060e696f3a5bb15741

    SHA256

    dc7cfb70877d3d264043ddda52da40d3ccb58370c202e12b3a4219432ce4091f

    SHA512

    b74cbec340b65419a65db28ba9f38631a56f4ce15beec267693825c2714d3a000847df0ea4c7054eac3cb76a44fc0b42be97a85de3e71cbba4bad97053330e4b

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

    Filesize

    1.3MB

    MD5

    2b2fb67e0f041923ce66c1d1f2d91eee

    SHA1

    31d1a53b1eaa37f6bf7aae060e696f3a5bb15741

    SHA256

    dc7cfb70877d3d264043ddda52da40d3ccb58370c202e12b3a4219432ce4091f

    SHA512

    b74cbec340b65419a65db28ba9f38631a56f4ce15beec267693825c2714d3a000847df0ea4c7054eac3cb76a44fc0b42be97a85de3e71cbba4bad97053330e4b

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

    Filesize

    1.3MB

    MD5

    2b2fb67e0f041923ce66c1d1f2d91eee

    SHA1

    31d1a53b1eaa37f6bf7aae060e696f3a5bb15741

    SHA256

    dc7cfb70877d3d264043ddda52da40d3ccb58370c202e12b3a4219432ce4091f

    SHA512

    b74cbec340b65419a65db28ba9f38631a56f4ce15beec267693825c2714d3a000847df0ea4c7054eac3cb76a44fc0b42be97a85de3e71cbba4bad97053330e4b

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

    Filesize

    326KB

    MD5

    80d93d38badecdd2b134fe4699721223

    SHA1

    e829e58091bae93bc64e0c6f9f0bac999cfda23d

    SHA256

    c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

    SHA512

    9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

  • C:\Users\Admin\AppData\Local\Temp\setuparguments.ini

    Filesize

    589B

    MD5

    eba06b6b99f31e3ffb369ef47d3dac99

    SHA1

    fe0acd25b5a1c27aa193dc08bb9fe78c6fead6b3

    SHA256

    948fbde5e97eaebff12a8618253ad7919b09016c7999349f1f24fcb6ecaf2cff

    SHA512

    de5153717ed6ddc83dbe9d24651facae1cf547a0281cb1461553b55a0b51f34a12717f7099e39743ccadfa9f926de6975022617e178ec4f88891c45fe81b884a

  • C:\Users\Admin\AppData\Local\Temp\~DF792191D222D64CEE.TMP

    Filesize

    16KB

    MD5

    c808f8d278ab0e45cd4082231822e9ef

    SHA1

    35e8635efb03558752bdbeea46ac4e998171e80b

    SHA256

    33238716fb5cdaa3110d2c2c2338333e4540951e8a72e8d37b10b4e702bbac08

    SHA512

    1e0cee409cf18b50b88727d71cdb9892a18aafdfe1183ddbec91398d9d9cdeefb0a565b6532bb98d53a1b16bb73fe860ac7ebbe119735c7c55eae199dc42b8b9

  • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

    Filesize

    6.3MB

    MD5

    a09d58d5281883d9b555cb8f99974f57

    SHA1

    f900108770e0ee69a88df27bfeb3aa13322385b0

    SHA256

    dd5891adfd1f98f945cd02c02a231a41c8224ccc350050b65e2b987e075920aa

    SHA512

    0f9fc01df7bd6fcf25893ef1a31d0105e19a853d81d475312c1ad4d3f17b77ad6cba659c4b78bda8040279c91947d9277987447a3795b7acb393a5eb95ae8f3c

  • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

    Filesize

    6.3MB

    MD5

    a09d58d5281883d9b555cb8f99974f57

    SHA1

    f900108770e0ee69a88df27bfeb3aa13322385b0

    SHA256

    dd5891adfd1f98f945cd02c02a231a41c8224ccc350050b65e2b987e075920aa

    SHA512

    0f9fc01df7bd6fcf25893ef1a31d0105e19a853d81d475312c1ad4d3f17b77ad6cba659c4b78bda8040279c91947d9277987447a3795b7acb393a5eb95ae8f3c

  • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

    Filesize

    6.3MB

    MD5

    a09d58d5281883d9b555cb8f99974f57

    SHA1

    f900108770e0ee69a88df27bfeb3aa13322385b0

    SHA256

    dd5891adfd1f98f945cd02c02a231a41c8224ccc350050b65e2b987e075920aa

    SHA512

    0f9fc01df7bd6fcf25893ef1a31d0105e19a853d81d475312c1ad4d3f17b77ad6cba659c4b78bda8040279c91947d9277987447a3795b7acb393a5eb95ae8f3c

  • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

    Filesize

    6.3MB

    MD5

    a09d58d5281883d9b555cb8f99974f57

    SHA1

    f900108770e0ee69a88df27bfeb3aa13322385b0

    SHA256

    dd5891adfd1f98f945cd02c02a231a41c8224ccc350050b65e2b987e075920aa

    SHA512

    0f9fc01df7bd6fcf25893ef1a31d0105e19a853d81d475312c1ad4d3f17b77ad6cba659c4b78bda8040279c91947d9277987447a3795b7acb393a5eb95ae8f3c

  • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.BMP

    Filesize

    451KB

    MD5

    0b445ace8798426e7185f52b7b7b6d1e

    SHA1

    7a77b46e0848cc9b32283ccb3f91a18c0934c079

    SHA256

    2bbf97ccba3f87d469eac909c4ce8a3f13ed29c8f31b611e7d5cf89a0619eda6

    SHA512

    51523d5b711481293305465a3a3c6a3a50dca984cdc8cca1f4c44f3c21bfa430cd9aac1a8782d9605e6954cbafb307beb6b1a52e9785de1bc3f71067d80c6b6e

  • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG23.PNG

    Filesize

    1KB

    MD5

    714ff209a00d50ca301063a38165db1d

    SHA1

    1400fdbe5e535b581b34c054183929a7e5548a69

    SHA256

    7749ac363a9f638040d0fb132be254e7569ca94e8e9e7917d1cb78050d2387d6

    SHA512

    d6bb2a5229300b6ad307e430d9e5e02fcbc9316dfbac0b836fcb6cb2f95739716c628d4afef61e8d34dae33f6345550bccd57b3b01cdc5f9335811e5e3fac6e4

  • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNG

    Filesize

    45KB

    MD5

    b3af6be5f4d16abd764157ec3cffb2c4

    SHA1

    bdb2c7ae18e9dd6d2edf3ed59be14ccfc400f4b1

    SHA256

    0e34299965ba1e761daabad45cad9aa27dccaf90a30a4badf5008b6a3d15cb5c

    SHA512

    eaf0951a615dbc0c7d6a364a53fd3401b60f53875f5d9a3bba922eeeadff83cb12b81e4b8cae1c612c3782c3c16b20a6e0d882dd913bbb533277d82af71a317d

  • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG41.PNG

    Filesize

    457B

    MD5

    6afc90de971a64e963b2b2b2c9cfe0d3

    SHA1

    2198f7fc711a848ee4c20b51e72819b07bb81ce9

    SHA256

    d720258ffe5025af550847c3f674ca9854eb052b0bd964a40b920188d26f3ab4

    SHA512

    e418485b852e6ebed96bd85da59254ff63b7c6e390e71ae3e298252fee980b89942bd26070c4ae6615f44685fb496a87f7549a1ae45e2fcf091c10ae2bef661a

  • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG42.PNG

    Filesize

    352B

    MD5

    269665f4752b9a668b8ead9b4d6cead8

    SHA1

    9eac14e0358fde1a2d7bbcdaf61eee90b46589bb

    SHA256

    68c133a816069421a9e384aeffdb3dff59945ce69da2a77da947545aead75b27

    SHA512

    0c2040775584d05271b701b3e43c45c621b48e63b537f9d441bddd44d25d18042fdb3a213836c6b52582bb358d7cb08bce9c292f4ce0c79dc0ad879d259fb74e

  • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG45.PNG

    Filesize

    438B

    MD5

    1f4c666195230d70d3eb563429d7f2fe

    SHA1

    841e76c2570b50edb29560ff2d4c9a2cd460e4ef

    SHA256

    f1fb2782f6b321afa66a82c686ac0ce11919f38e7f33496f0f0b7241a901019b

    SHA512

    eacb98e7f9cef2f8d2ba13808f1f7a77d4244bac0b4a45ed788628064e8c86c4e15cf091b8adac1539a4705c867e72714c4b7d902ac0c281f04925661d3bce89

  • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG48.PNG

    Filesize

    1KB

    MD5

    6ac1b334813957693405396f4796860b

    SHA1

    0b65e65880496bb6a610bd9f247557ac82d8a977

    SHA256

    2e7817a1fac90ec183ec3d2325162a23078ddff4cd2c387d2b74f7d70321b4aa

    SHA512

    9319cd0beb9a114c334bc82ae618708fef4ef43ca3d70b112f60dcc38a68ecb8c728073c169d65d76e05e72e47624859a48e80e8e44e0e8d2fa4cd425f6f59fb

  • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG5.PNG

    Filesize

    1KB

    MD5

    14a02d0eb05243706364523f60261125

    SHA1

    d46052613634f65f7b2fb02058edd65acc7f79f0

    SHA256

    3d8a062470073015df141295ca78a41b68b39d24b17f50b212060c3677c02494

    SHA512

    15d99962f96cde8329b981701d2fdc8a46085b6b60d324c41cca5a27ba425fa24567a51b0ed91e2da70c7717e2a70e6882691a509a25d2c6a306527d0507ec61

  • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG66.PNG

    Filesize

    41KB

    MD5

    93989ba5ff12871a1574740f636c8698

    SHA1

    44c795f434bffd4efcdb915cffd1f18f959e08ba

    SHA256

    8585b72b8a5088e213b97ddb2f25a4bf5502a7c65058817722e0332b6017facb

    SHA512

    bd8f78d1ea50d05a528784b276b846f091a258bb51e27c7e6fb4d8757c05c62c801df570edaba67ad457e7cf3ef2363c777bccf56e9c8b68a74acf2a453825d2

  • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG67.PNG

    Filesize

    1KB

    MD5

    63710485777644af1779a06c56114dc3

    SHA1

    0c3fa7da31833a1e38acb5a7ef8b67e4fe96bba3

    SHA256

    9b55555c0b68c45073787fe674e622c38b0052baaed0ce72c209248ae2b084e4

    SHA512

    f5d7b20fd5207e71ee59cebffb8efffb5dd5bb24fde40622805da09e2ffc6c9d22fa31830f26780cdb67283d201c473829a116de5a67f3d5aa1a41c44d16adfe

  • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

    Filesize

    28KB

    MD5

    f10b9a94ea39206c71d6fcdac035a6ae

    SHA1

    3fa5155b3b353eca7fa0110670d16150252ab034

    SHA256

    04a77b62afa5da3cec226ed6287a4c96959f58f13d837e5c5496dfeb8113d78b

    SHA512

    6e38de842cfabcc6272e790ad9a91ecf8ab881a9e1f2079157e5667710c748ef141fed651a2c640a9c8a7f9d5129913295d8050328647d2a897f0e8fd1633b65

  • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

    Filesize

    6KB

    MD5

    4f7be9736242579cb8afa1af86980dfe

    SHA1

    1c486393847996db4f6b78532dd7bd9a0a924549

    SHA256

    9cecc28716f392d2394829f4cc3f307d08f5aecaf3e2124bdaaa0d6d9c3400b4

    SHA512

    4c55bc2698d8934713e791c015480248198e22efa66dd5ca79ea834b9835c9e85ca8c2869c9b40dc394ae7e27da039f79c392f88472dedc1adfa83dd1e94f1c9

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\WVY30Q1H.txt

    Filesize

    223B

    MD5

    fb469bf6afc9e5282051a78e6313a74e

    SHA1

    110c91ba80e461c12c404bbfff8ac37132a5b080

    SHA256

    a4db0dc6d225af8a026cb5ab53a9663fd35bd3eb936dc347635fcd2698615f69

    SHA512

    9fdc41fcaddaf5da00f27a755788fbc6ff2d75f17aaa6acc2aaffd39955a4f17d615b8fab21b8099cedce172c547a5ca3e4bc235cd00312032a632d171abcaed

  • \Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

    Filesize

    1.8MB

    MD5

    cb50d496ae05fa1c8bfbcb3b7f910bfe

    SHA1

    3ec4d77b73c4d7e9858b11224314e99d082497a8

    SHA256

    7616c72f6659a3a2439d0452190459cd4ceb83fab2307e3e47c9604fa29d9f34

    SHA512

    22051de06c7e52a37ad36250aa095a8ccc0b0e1cdbfa2e9073c146e77e278cbdbe89bdb078dcfd8babf48baec1902b303ac39cc9db4114ce1516b06552dc924d

  • \Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

    Filesize

    1.8MB

    MD5

    cb50d496ae05fa1c8bfbcb3b7f910bfe

    SHA1

    3ec4d77b73c4d7e9858b11224314e99d082497a8

    SHA256

    7616c72f6659a3a2439d0452190459cd4ceb83fab2307e3e47c9604fa29d9f34

    SHA512

    22051de06c7e52a37ad36250aa095a8ccc0b0e1cdbfa2e9073c146e77e278cbdbe89bdb078dcfd8babf48baec1902b303ac39cc9db4114ce1516b06552dc924d

  • \Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

    Filesize

    1.8MB

    MD5

    cb50d496ae05fa1c8bfbcb3b7f910bfe

    SHA1

    3ec4d77b73c4d7e9858b11224314e99d082497a8

    SHA256

    7616c72f6659a3a2439d0452190459cd4ceb83fab2307e3e47c9604fa29d9f34

    SHA512

    22051de06c7e52a37ad36250aa095a8ccc0b0e1cdbfa2e9073c146e77e278cbdbe89bdb078dcfd8babf48baec1902b303ac39cc9db4114ce1516b06552dc924d

  • \Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

    Filesize

    1.8MB

    MD5

    cb50d496ae05fa1c8bfbcb3b7f910bfe

    SHA1

    3ec4d77b73c4d7e9858b11224314e99d082497a8

    SHA256

    7616c72f6659a3a2439d0452190459cd4ceb83fab2307e3e47c9604fa29d9f34

    SHA512

    22051de06c7e52a37ad36250aa095a8ccc0b0e1cdbfa2e9073c146e77e278cbdbe89bdb078dcfd8babf48baec1902b303ac39cc9db4114ce1516b06552dc924d

  • \Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

    Filesize

    1.8MB

    MD5

    cb50d496ae05fa1c8bfbcb3b7f910bfe

    SHA1

    3ec4d77b73c4d7e9858b11224314e99d082497a8

    SHA256

    7616c72f6659a3a2439d0452190459cd4ceb83fab2307e3e47c9604fa29d9f34

    SHA512

    22051de06c7e52a37ad36250aa095a8ccc0b0e1cdbfa2e9073c146e77e278cbdbe89bdb078dcfd8babf48baec1902b303ac39cc9db4114ce1516b06552dc924d

  • \Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

    Filesize

    1.8MB

    MD5

    cb50d496ae05fa1c8bfbcb3b7f910bfe

    SHA1

    3ec4d77b73c4d7e9858b11224314e99d082497a8

    SHA256

    7616c72f6659a3a2439d0452190459cd4ceb83fab2307e3e47c9604fa29d9f34

    SHA512

    22051de06c7e52a37ad36250aa095a8ccc0b0e1cdbfa2e9073c146e77e278cbdbe89bdb078dcfd8babf48baec1902b303ac39cc9db4114ce1516b06552dc924d

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

    Filesize

    1.7MB

    MD5

    1bbf5dd0b6ca80e4c7c77495c3f33083

    SHA1

    e0520037e60eb641ec04d1e814394c9da0a6a862

    SHA256

    bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

    SHA512

    97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

    Filesize

    97KB

    MD5

    da1d0cd400e0b6ad6415fd4d90f69666

    SHA1

    de9083d2902906cacf57259cf581b1466400b799

    SHA256

    7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

    SHA512

    f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

    Filesize

    1.3MB

    MD5

    a70accbc1f1001cbf1c4a139e4e5d7af

    SHA1

    138de36067af0c8f98e1f7bc4c6bea1d73bc53ab

    SHA256

    b000fef41ce0267255701aacc76c02159d207212c4595437077e7904b7968ca6

    SHA512

    46fde27847dfab38d2f6fefca31677a0d5a5ac775951fc19f1fc0b4ec56969622f0c4f036ecacc05b33854871f03232a4944f3e93a747280cac622503f5c4f04

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

    Filesize

    1.3MB

    MD5

    a70accbc1f1001cbf1c4a139e4e5d7af

    SHA1

    138de36067af0c8f98e1f7bc4c6bea1d73bc53ab

    SHA256

    b000fef41ce0267255701aacc76c02159d207212c4595437077e7904b7968ca6

    SHA512

    46fde27847dfab38d2f6fefca31677a0d5a5ac775951fc19f1fc0b4ec56969622f0c4f036ecacc05b33854871f03232a4944f3e93a747280cac622503f5c4f04

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

    Filesize

    1.3MB

    MD5

    a70accbc1f1001cbf1c4a139e4e5d7af

    SHA1

    138de36067af0c8f98e1f7bc4c6bea1d73bc53ab

    SHA256

    b000fef41ce0267255701aacc76c02159d207212c4595437077e7904b7968ca6

    SHA512

    46fde27847dfab38d2f6fefca31677a0d5a5ac775951fc19f1fc0b4ec56969622f0c4f036ecacc05b33854871f03232a4944f3e93a747280cac622503f5c4f04

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

    Filesize

    1.3MB

    MD5

    a70accbc1f1001cbf1c4a139e4e5d7af

    SHA1

    138de36067af0c8f98e1f7bc4c6bea1d73bc53ab

    SHA256

    b000fef41ce0267255701aacc76c02159d207212c4595437077e7904b7968ca6

    SHA512

    46fde27847dfab38d2f6fefca31677a0d5a5ac775951fc19f1fc0b4ec56969622f0c4f036ecacc05b33854871f03232a4944f3e93a747280cac622503f5c4f04

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

    Filesize

    1.3MB

    MD5

    a70accbc1f1001cbf1c4a139e4e5d7af

    SHA1

    138de36067af0c8f98e1f7bc4c6bea1d73bc53ab

    SHA256

    b000fef41ce0267255701aacc76c02159d207212c4595437077e7904b7968ca6

    SHA512

    46fde27847dfab38d2f6fefca31677a0d5a5ac775951fc19f1fc0b4ec56969622f0c4f036ecacc05b33854871f03232a4944f3e93a747280cac622503f5c4f04

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

    Filesize

    326KB

    MD5

    80d93d38badecdd2b134fe4699721223

    SHA1

    e829e58091bae93bc64e0c6f9f0bac999cfda23d

    SHA256

    c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

    SHA512

    9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

    Filesize

    1.3MB

    MD5

    2b2fb67e0f041923ce66c1d1f2d91eee

    SHA1

    31d1a53b1eaa37f6bf7aae060e696f3a5bb15741

    SHA256

    dc7cfb70877d3d264043ddda52da40d3ccb58370c202e12b3a4219432ce4091f

    SHA512

    b74cbec340b65419a65db28ba9f38631a56f4ce15beec267693825c2714d3a000847df0ea4c7054eac3cb76a44fc0b42be97a85de3e71cbba4bad97053330e4b

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

    Filesize

    1.3MB

    MD5

    2b2fb67e0f041923ce66c1d1f2d91eee

    SHA1

    31d1a53b1eaa37f6bf7aae060e696f3a5bb15741

    SHA256

    dc7cfb70877d3d264043ddda52da40d3ccb58370c202e12b3a4219432ce4091f

    SHA512

    b74cbec340b65419a65db28ba9f38631a56f4ce15beec267693825c2714d3a000847df0ea4c7054eac3cb76a44fc0b42be97a85de3e71cbba4bad97053330e4b

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

    Filesize

    1.3MB

    MD5

    2b2fb67e0f041923ce66c1d1f2d91eee

    SHA1

    31d1a53b1eaa37f6bf7aae060e696f3a5bb15741

    SHA256

    dc7cfb70877d3d264043ddda52da40d3ccb58370c202e12b3a4219432ce4091f

    SHA512

    b74cbec340b65419a65db28ba9f38631a56f4ce15beec267693825c2714d3a000847df0ea4c7054eac3cb76a44fc0b42be97a85de3e71cbba4bad97053330e4b

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

    Filesize

    1.3MB

    MD5

    2b2fb67e0f041923ce66c1d1f2d91eee

    SHA1

    31d1a53b1eaa37f6bf7aae060e696f3a5bb15741

    SHA256

    dc7cfb70877d3d264043ddda52da40d3ccb58370c202e12b3a4219432ce4091f

    SHA512

    b74cbec340b65419a65db28ba9f38631a56f4ce15beec267693825c2714d3a000847df0ea4c7054eac3cb76a44fc0b42be97a85de3e71cbba4bad97053330e4b

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

    Filesize

    326KB

    MD5

    80d93d38badecdd2b134fe4699721223

    SHA1

    e829e58091bae93bc64e0c6f9f0bac999cfda23d

    SHA256

    c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

    SHA512

    9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

  • \Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

    Filesize

    6.3MB

    MD5

    a09d58d5281883d9b555cb8f99974f57

    SHA1

    f900108770e0ee69a88df27bfeb3aa13322385b0

    SHA256

    dd5891adfd1f98f945cd02c02a231a41c8224ccc350050b65e2b987e075920aa

    SHA512

    0f9fc01df7bd6fcf25893ef1a31d0105e19a853d81d475312c1ad4d3f17b77ad6cba659c4b78bda8040279c91947d9277987447a3795b7acb393a5eb95ae8f3c

  • \Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

    Filesize

    6.3MB

    MD5

    a09d58d5281883d9b555cb8f99974f57

    SHA1

    f900108770e0ee69a88df27bfeb3aa13322385b0

    SHA256

    dd5891adfd1f98f945cd02c02a231a41c8224ccc350050b65e2b987e075920aa

    SHA512

    0f9fc01df7bd6fcf25893ef1a31d0105e19a853d81d475312c1ad4d3f17b77ad6cba659c4b78bda8040279c91947d9277987447a3795b7acb393a5eb95ae8f3c

  • memory/2028-485-0x0000000000F80000-0x0000000001368000-memory.dmp

    Filesize

    3.9MB

  • memory/2092-367-0x00000000003D0000-0x00000000003D3000-memory.dmp

    Filesize

    12KB

  • memory/2092-74-0x0000000000C30000-0x0000000001018000-memory.dmp

    Filesize

    3.9MB

  • memory/2092-1608-0x0000000000C30000-0x0000000001018000-memory.dmp

    Filesize

    3.9MB

  • memory/2092-366-0x0000000010000000-0x0000000010051000-memory.dmp

    Filesize

    324KB

  • memory/2092-2152-0x00000000003D0000-0x00000000003D3000-memory.dmp

    Filesize

    12KB

  • memory/2100-2057-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/2172-71-0x0000000002BA0000-0x0000000002F88000-memory.dmp

    Filesize

    3.9MB

  • memory/2172-72-0x0000000002BA0000-0x0000000002F88000-memory.dmp

    Filesize

    3.9MB

  • memory/2172-73-0x0000000002BA0000-0x0000000002F88000-memory.dmp

    Filesize

    3.9MB

  • memory/2820-1610-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB