Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/02/2023, 00:16

General

  • Target

    TLauncher-2.871-Installer-1.0.6-global.exe

  • Size

    23.6MB

  • MD5

    7a4472a78d0651e11d20aa08e43cc045

  • SHA1

    aab1d5f80d7399ae2c1982201733be7681d100b1

  • SHA256

    318df7404e6c4d5538a6d31997b95af52bbb8d40caf5553b3cbd9b1bc4f6db96

  • SHA512

    c152c9d21b0615548173dcc61accb1a1afd5b6f98e6ec21f6a7119536397f07a54ad4087669716c3344dd338ce4f24cecf9989d472f65eaa18c87d496f23c681

  • SSDEEP

    393216:gXQLpnUN/n8IPfs/dQETVlOBbpFEj9GZ1GphRqV56Hpk7IXOzDnKI17fyVS:ggLFUp8aHExiTI3qqHp6zvKcfyVS

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 15 IoCs
  • Loads dropped DLL 11 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 22 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies system certificate store 2 TTPs 10 IoCs
  • Suspicious use of SetWindowsHookEx 25 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:788
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe" "__IRCT:3" "__IRTSS:24771453" "__IRSID:S-1-5-21-2891029575-1462575-1165213807-1000"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4108
      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
        "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1012
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816850 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" "__IRCT:3" "__IRTSS:1840872" "__IRSID:S-1-5-21-2891029575-1462575-1165213807-1000"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1456
          • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
            "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Enumerates connected drives
            • Modifies system certificate store
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3732
            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=95.0.4635.37 --initial-client-data=0x320,0x344,0x348,0x2b8,0x34c,0x6f30e428,0x6f30e438,0x6f30e444
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:2300
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe" --version
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:1832
            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --pin-additional-shortcuts=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=3732 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20230212011736" --session-guid=7c66166d-1753-4cea-bcbe-6ac2967b9eb8 --server-tracking-blob=N2EwYTM0MzI3OWZjOGJhMWIzZmQ3ODhlNmNkMjg4NjY3MDc5YTQ4MmZlNWY5N2ZlOTc5ZjQ2N2M2NmFhM2FlYjp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInRpbWVzdGFtcCI6IjE2NzYxNjEwNTMuOTk5NSIsInVzZXJhZ2VudCI6IlNldHVwIEZhY3RvcnkgOS4wIiwidXRtIjp7ImNhbXBhaWduIjoiT3BlcmFEZXNrdG9wIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiTVNUTCJ9LCJ1dWlkIjoiY2FkNjk1Y2UtNjBiNy00Mzk2LTlhNWItMzkyM2MyMjJhMDViIn0= --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=BC05000000000000
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Enumerates connected drives
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1620
              • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=95.0.4635.37 --initial-client-data=0x34c,0x350,0x354,0x31c,0x358,0x6e7ee428,0x6e7ee438,0x6e7ee444
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:3648
              • C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.37\installer.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.37\installer.exe" --backend --initial-pid=3732 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --pin-additional-shortcuts=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302120117361" --session-guid=7c66166d-1753-4cea-bcbe-6ac2967b9eb8 --server-tracking-blob=N2EwYTM0MzI3OWZjOGJhMWIzZmQ3ODhlNmNkMjg4NjY3MDc5YTQ4MmZlNWY5N2ZlOTc5ZjQ2N2M2NmFhM2FlYjp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInRpbWVzdGFtcCI6IjE2NzYxNjEwNTMuOTk5NSIsInVzZXJhZ2VudCI6IlNldHVwIEZhY3RvcnkgOS4wIiwidXRtIjp7ImNhbXBhaWduIjoiT3BlcmFEZXNrdG9wIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiTVNUTCJ9LCJ1dWlkIjoiY2FkNjk1Y2UtNjBiNy00Mzk2LTlhNWItMzkyM2MyMjJhMDViIn0= --silent --desktopshortcut=1 --install-subfolder=95.0.4635.37
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates connected drives
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:3576
                • C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.37\installer.exe
                  C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.37\installer.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=95.0.4635.37 --initial-client-data=0x2b8,0x2bc,0x2c0,0x294,0x2c4,0x7ff9bda0a908,0x7ff9bda0a918,0x7ff9bda0a928
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetWindowsHookEx
                  PID:2484
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302120117361\assistant\_sfx.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302120117361\assistant\_sfx.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:1272
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302120117361\assistant\assistant_installer.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302120117361\assistant\assistant_installer.exe" --version
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3524
              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302120117361\assistant\assistant_installer.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302120117361\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x2fc,0x11c2dc0,0x11c2dd0,0x11c2ddc
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:2268
      • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
        "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2404
        • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
          "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
          4⤵
          • Suspicious use of SetWindowsHookEx
          PID:4844
  • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
    "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1180
    • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
      "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:1596

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

    Filesize

    50B

    MD5

    03450676d8f864fd212eed472d53cd77

    SHA1

    779a0a55dc5361dfa6bdf5cc274b4199d5c9e0ae

    SHA256

    785fc2dfdad9bdc332135e3430a896b4f00cf60b58113cb84ce81adeb947af5d

    SHA512

    9cd864ba6254eb18308b4d8f08e12e293fdb3508e097ef86cf97158eec192a09e05f1cbd45bb082fd80c3a6f09d64837dd0970eeef0f242cfe252223a23a842f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

    Filesize

    471B

    MD5

    1f4ed1c10e0b0c3cb9f5e9b8a7467e77

    SHA1

    16eb955e1825fbc737db36e82fdf8778c80e9fbb

    SHA256

    03eb24ad11bba3590d0100ff5bed07fa895bbff5ae7af13d5121deb4b509e918

    SHA512

    06c9be897247ccc5d066b597c7c485f2cd491b3ceed849d4f8ab02120715138753dea5236d43b2ec72500120792b14a25a5165a247b7b5395617e461339fefc0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

    Filesize

    434B

    MD5

    add9387b1b0e509698e4dd5128e20dc6

    SHA1

    8ab01e51f0bc27d771e343780d0e39c22ecc52a6

    SHA256

    bc28bdacf387c65be4ed3bc1df55f8e6d9d7891f7a8c7514438d490fd86e7683

    SHA512

    7d82ea7d83d6e6b018e8c746109710bccfa8669c695cf6b6b5ef053565a0a09d03efdd7a004f2627440c4ed0ca41848d5294664965d78d1ad027bf841cf09429

  • C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.37\installer.exe

    Filesize

    6.2MB

    MD5

    47aae2b0e982e612cd33f38e019cc09f

    SHA1

    b5f02e2a9542401ee173ebb031b339cd7777f525

    SHA256

    2fe3ae2fc849195d5cdbc9644a762120a6fca55e6a16588895d013a50c28b06d

    SHA512

    f448fbadd906c896ce3bc301cb3ad989905c2235dd496891e645e3b2c4bb16b15e6ad9a1f11f2d3772077c7ffe5db4c06e695261d805a7c2eaa0ae7991a9beab

  • C:\Users\Admin\AppData\Local\Programs\Opera\95.0.4635.37\installer.exe

    Filesize

    6.2MB

    MD5

    47aae2b0e982e612cd33f38e019cc09f

    SHA1

    b5f02e2a9542401ee173ebb031b339cd7777f525

    SHA256

    2fe3ae2fc849195d5cdbc9644a762120a6fca55e6a16588895d013a50c28b06d

    SHA512

    f448fbadd906c896ce3bc301cb3ad989905c2235dd496891e645e3b2c4bb16b15e6ad9a1f11f2d3772077c7ffe5db4c06e695261d805a7c2eaa0ae7991a9beab

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe

    Filesize

    2.7MB

    MD5

    b03fa114fbfdf310448a0ac2c024dfaf

    SHA1

    3db8f2736cca8011ae40cca8c8c916aa895b6f05

    SHA256

    111463bf9857b64ccb691b4a6ad757b2cd6e2851baf418d0040b6cddb9d7c69c

    SHA512

    5c8495719a9c334e802e6c120856ef96301ca1b23e57e8aeff215e9080402249120626eb83e396f8be860fe3b4099be197d6f749612fb8de09b4b06417747cc2

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe

    Filesize

    2.7MB

    MD5

    b03fa114fbfdf310448a0ac2c024dfaf

    SHA1

    3db8f2736cca8011ae40cca8c8c916aa895b6f05

    SHA256

    111463bf9857b64ccb691b4a6ad757b2cd6e2851baf418d0040b6cddb9d7c69c

    SHA512

    5c8495719a9c334e802e6c120856ef96301ca1b23e57e8aeff215e9080402249120626eb83e396f8be860fe3b4099be197d6f749612fb8de09b4b06417747cc2

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302120117361\assistant\_sfx.exe

    Filesize

    1.7MB

    MD5

    0238df215bf6943892daf85de8ad433a

    SHA1

    3d905e4e2c0e9170df61b7a199321847691f945e

    SHA256

    a7818aca6acbe347df13d51d9750f6a852c5aa2a58580f7f2015113e0a3e06d7

    SHA512

    fc6c12e359b9a4ce84ef878f29648a4c97c38fd12ed80996c5e03829833220010fff9c751a99f399dad3529bda6438424194ed18236addfbe430343807aaad69

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302120117361\assistant\_sfx.exe

    Filesize

    1.7MB

    MD5

    0238df215bf6943892daf85de8ad433a

    SHA1

    3d905e4e2c0e9170df61b7a199321847691f945e

    SHA256

    a7818aca6acbe347df13d51d9750f6a852c5aa2a58580f7f2015113e0a3e06d7

    SHA512

    fc6c12e359b9a4ce84ef878f29648a4c97c38fd12ed80996c5e03829833220010fff9c751a99f399dad3529bda6438424194ed18236addfbe430343807aaad69

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302120117361\assistant\assistant_installer.exe

    Filesize

    2.1MB

    MD5

    9df6e2fbb7e38964f35016bf91ef7424

    SHA1

    d0c1266dc46814bc6165cf6a69e90581228989a7

    SHA256

    3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

    SHA512

    b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302120117361\assistant\assistant_installer.exe

    Filesize

    2.1MB

    MD5

    9df6e2fbb7e38964f35016bf91ef7424

    SHA1

    d0c1266dc46814bc6165cf6a69e90581228989a7

    SHA256

    3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

    SHA512

    b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302120117361\assistant\assistant_installer.exe

    Filesize

    2.1MB

    MD5

    9df6e2fbb7e38964f35016bf91ef7424

    SHA1

    d0c1266dc46814bc6165cf6a69e90581228989a7

    SHA256

    3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

    SHA512

    b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302120117361\installer_prefs_include.json

    Filesize

    1KB

    MD5

    64799fbafdf929ff058cdc9d2db28387

    SHA1

    5161fed6222fd37bbda2dcd3859c0d8c640655fe

    SHA256

    d3db52fc90e8187e985f5bd86e4050f2e634641ed5c21f20e03b9548bf801c7b

    SHA512

    7224019bc96c6499175dd71056647981bc3a59fc97897aaf1804d3be13db2ace778d6960f25985f5bfa14bf5632ec8c431dd693204cd424af82a03d1788a5bac

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302120117361\installer_prefs_include.json.backup

    Filesize

    1KB

    MD5

    64799fbafdf929ff058cdc9d2db28387

    SHA1

    5161fed6222fd37bbda2dcd3859c0d8c640655fe

    SHA256

    d3db52fc90e8187e985f5bd86e4050f2e634641ed5c21f20e03b9548bf801c7b

    SHA512

    7224019bc96c6499175dd71056647981bc3a59fc97897aaf1804d3be13db2ace778d6960f25985f5bfa14bf5632ec8c431dd693204cd424af82a03d1788a5bac

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302120117361\opera_package

    Filesize

    86.8MB

    MD5

    d952728a4ce9fa6fd1df1e71f2cdad79

    SHA1

    62a0cdac813c83cea2f5a406a6940982f33d839a

    SHA256

    f115d42f06f27045cf1cf04bbfa4591789547ddb3614be6c912fa75bd4eb4cb6

    SHA512

    8720da841a9d31832b943fb56271e3efcb05520d0d5506a5ce823d8d5e909ebafd796d3d2b8afd82e2479329b84ee1813de5380598a7271ca9d5b64a2d3b4534

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302120117361\pref_default_overrides

    Filesize

    57B

    MD5

    f488c9f9d9d5e631484d4bf155f45442

    SHA1

    0f0e624770e47bea5186748a9de85c677dd84fa7

    SHA256

    e6f214ff5ccbbe6e7abcf309138cdcb46d3fe3915e9bbbe8dd3c15afb439f708

    SHA512

    d72d1daa86e650a0589f6991f7a7bb3b7ca3484d49bc0d0d703b28b8f399f3123df2bf3c949a899fab55bde7d888736f655e462e2cd02ade59bbf9e67df54064

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2302120117327853732.dll

    Filesize

    4.6MB

    MD5

    5ff9275c5cee292fff9034f03bd847e1

    SHA1

    37bf88e062278882492823c7039b7cf374756ae0

    SHA256

    2309501e723a011f4bf2b505e178cbb97af4d798a8720d344f2730c4d756ee08

    SHA512

    f58e5981e25cd6cdd5edb9d9974f137615dee7516d221bf0df08a7425ec68361f29d7b5ca1b835c476fcbcee0df4a028bfa5308867fb3976aaba67cbf8b8dd02

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2302120117344262300.dll

    Filesize

    4.6MB

    MD5

    5ff9275c5cee292fff9034f03bd847e1

    SHA1

    37bf88e062278882492823c7039b7cf374756ae0

    SHA256

    2309501e723a011f4bf2b505e178cbb97af4d798a8720d344f2730c4d756ee08

    SHA512

    f58e5981e25cd6cdd5edb9d9974f137615dee7516d221bf0df08a7425ec68361f29d7b5ca1b835c476fcbcee0df4a028bfa5308867fb3976aaba67cbf8b8dd02

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2302120117358951832.dll

    Filesize

    4.6MB

    MD5

    5ff9275c5cee292fff9034f03bd847e1

    SHA1

    37bf88e062278882492823c7039b7cf374756ae0

    SHA256

    2309501e723a011f4bf2b505e178cbb97af4d798a8720d344f2730c4d756ee08

    SHA512

    f58e5981e25cd6cdd5edb9d9974f137615dee7516d221bf0df08a7425ec68361f29d7b5ca1b835c476fcbcee0df4a028bfa5308867fb3976aaba67cbf8b8dd02

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2302120117368321620.dll

    Filesize

    4.6MB

    MD5

    5ff9275c5cee292fff9034f03bd847e1

    SHA1

    37bf88e062278882492823c7039b7cf374756ae0

    SHA256

    2309501e723a011f4bf2b505e178cbb97af4d798a8720d344f2730c4d756ee08

    SHA512

    f58e5981e25cd6cdd5edb9d9974f137615dee7516d221bf0df08a7425ec68361f29d7b5ca1b835c476fcbcee0df4a028bfa5308867fb3976aaba67cbf8b8dd02

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2302120117375513648.dll

    Filesize

    4.6MB

    MD5

    5ff9275c5cee292fff9034f03bd847e1

    SHA1

    37bf88e062278882492823c7039b7cf374756ae0

    SHA256

    2309501e723a011f4bf2b505e178cbb97af4d798a8720d344f2730c4d756ee08

    SHA512

    f58e5981e25cd6cdd5edb9d9974f137615dee7516d221bf0df08a7425ec68361f29d7b5ca1b835c476fcbcee0df4a028bfa5308867fb3976aaba67cbf8b8dd02

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2302120118456263576.dll

    Filesize

    5.5MB

    MD5

    7ee1a05f717605b8bb0a2282035be402

    SHA1

    9885b516e5853e69ad4dd61e932f445d0a5dd76d

    SHA256

    9abfb792127651d3f1ba83239485574fa597db9362935dc3b62a2667bff22787

    SHA512

    900616610198fe86cb0992e20305dce9cd46d5acff9bb89b8541da4f83f39d8831ae963c50f489d53d9640431b90b00463adef00ff14dbdcd2f5cc9f8ddeeb24

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2302120118461412484.dll

    Filesize

    5.5MB

    MD5

    7ee1a05f717605b8bb0a2282035be402

    SHA1

    9885b516e5853e69ad4dd61e932f445d0a5dd76d

    SHA256

    9abfb792127651d3f1ba83239485574fa597db9362935dc3b62a2667bff22787

    SHA512

    900616610198fe86cb0992e20305dce9cd46d5acff9bb89b8541da4f83f39d8831ae963c50f489d53d9640431b90b00463adef00ff14dbdcd2f5cc9f8ddeeb24

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe

    Filesize

    1.8MB

    MD5

    aa4de04ccc16b74a4c2301da8d621ec1

    SHA1

    d05c6d8200f6e6b1283df82d24d687adc47d9664

    SHA256

    e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

    SHA512

    28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe

    Filesize

    1.8MB

    MD5

    aa4de04ccc16b74a4c2301da8d621ec1

    SHA1

    d05c6d8200f6e6b1283df82d24d687adc47d9664

    SHA256

    e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

    SHA512

    28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

    Filesize

    1.7MB

    MD5

    1bbf5dd0b6ca80e4c7c77495c3f33083

    SHA1

    e0520037e60eb641ec04d1e814394c9da0a6a862

    SHA256

    bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

    SHA512

    97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

    Filesize

    97KB

    MD5

    da1d0cd400e0b6ad6415fd4d90f69666

    SHA1

    de9083d2902906cacf57259cf581b1466400b799

    SHA256

    7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

    SHA512

    f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

    Filesize

    1.3MB

    MD5

    7e08af319c9eb3297e09ca7bb8387de4

    SHA1

    4cf091f77a3eb9437ef33985e64bd10c1257284f

    SHA256

    6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

    SHA512

    bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

    Filesize

    1.3MB

    MD5

    7e08af319c9eb3297e09ca7bb8387de4

    SHA1

    4cf091f77a3eb9437ef33985e64bd10c1257284f

    SHA256

    6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

    SHA512

    bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

    Filesize

    326KB

    MD5

    80d93d38badecdd2b134fe4699721223

    SHA1

    e829e58091bae93bc64e0c6f9f0bac999cfda23d

    SHA256

    c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

    SHA512

    9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

    Filesize

    326KB

    MD5

    80d93d38badecdd2b134fe4699721223

    SHA1

    e829e58091bae93bc64e0c6f9f0bac999cfda23d

    SHA256

    c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

    SHA512

    9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

    Filesize

    1.3MB

    MD5

    e801c5847f5f9d207db53aaaf5c6f3a2

    SHA1

    8e6818ce66555e2cca92e5c5f32551fb4a91645e

    SHA256

    196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

    SHA512

    303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

    Filesize

    1.3MB

    MD5

    e801c5847f5f9d207db53aaaf5c6f3a2

    SHA1

    8e6818ce66555e2cca92e5c5f32551fb4a91645e

    SHA256

    196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

    SHA512

    303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

    Filesize

    326KB

    MD5

    80d93d38badecdd2b134fe4699721223

    SHA1

    e829e58091bae93bc64e0c6f9f0bac999cfda23d

    SHA256

    c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

    SHA512

    9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

    Filesize

    326KB

    MD5

    80d93d38badecdd2b134fe4699721223

    SHA1

    e829e58091bae93bc64e0c6f9f0bac999cfda23d

    SHA256

    c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

    SHA512

    9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

  • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

    Filesize

    2.7MB

    MD5

    b03fa114fbfdf310448a0ac2c024dfaf

    SHA1

    3db8f2736cca8011ae40cca8c8c916aa895b6f05

    SHA256

    111463bf9857b64ccb691b4a6ad757b2cd6e2851baf418d0040b6cddb9d7c69c

    SHA512

    5c8495719a9c334e802e6c120856ef96301ca1b23e57e8aeff215e9080402249120626eb83e396f8be860fe3b4099be197d6f749612fb8de09b4b06417747cc2

  • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

    Filesize

    2.7MB

    MD5

    b03fa114fbfdf310448a0ac2c024dfaf

    SHA1

    3db8f2736cca8011ae40cca8c8c916aa895b6f05

    SHA256

    111463bf9857b64ccb691b4a6ad757b2cd6e2851baf418d0040b6cddb9d7c69c

    SHA512

    5c8495719a9c334e802e6c120856ef96301ca1b23e57e8aeff215e9080402249120626eb83e396f8be860fe3b4099be197d6f749612fb8de09b4b06417747cc2

  • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

    Filesize

    2.7MB

    MD5

    b03fa114fbfdf310448a0ac2c024dfaf

    SHA1

    3db8f2736cca8011ae40cca8c8c916aa895b6f05

    SHA256

    111463bf9857b64ccb691b4a6ad757b2cd6e2851baf418d0040b6cddb9d7c69c

    SHA512

    5c8495719a9c334e802e6c120856ef96301ca1b23e57e8aeff215e9080402249120626eb83e396f8be860fe3b4099be197d6f749612fb8de09b4b06417747cc2

  • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

    Filesize

    2.7MB

    MD5

    b03fa114fbfdf310448a0ac2c024dfaf

    SHA1

    3db8f2736cca8011ae40cca8c8c916aa895b6f05

    SHA256

    111463bf9857b64ccb691b4a6ad757b2cd6e2851baf418d0040b6cddb9d7c69c

    SHA512

    5c8495719a9c334e802e6c120856ef96301ca1b23e57e8aeff215e9080402249120626eb83e396f8be860fe3b4099be197d6f749612fb8de09b4b06417747cc2

  • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

    Filesize

    2.7MB

    MD5

    b03fa114fbfdf310448a0ac2c024dfaf

    SHA1

    3db8f2736cca8011ae40cca8c8c916aa895b6f05

    SHA256

    111463bf9857b64ccb691b4a6ad757b2cd6e2851baf418d0040b6cddb9d7c69c

    SHA512

    5c8495719a9c334e802e6c120856ef96301ca1b23e57e8aeff215e9080402249120626eb83e396f8be860fe3b4099be197d6f749612fb8de09b4b06417747cc2

  • C:\Users\Admin\AppData\Local\Temp\setuparguments.ini

    Filesize

    643B

    MD5

    32872c34bd5150411ad0071795ecc4c7

    SHA1

    23d22975b7918dd8db098ad1bf0c36ed71ebb166

    SHA256

    681708cc3b67759687605271ce1bb45cf94d163bbeafd63e0f8e4059140bd997

    SHA512

    a71c19915d031f30972e4cee9cc6e147e2c3d269e3f48fa132c06eda45ac375f4eb5f30c8621889fc6b10a751ef31363af1c25ce5baf61b3334c48928f6ba06e

  • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

    Filesize

    5.2MB

    MD5

    58e22c0ee91280156cdaadacac7acddb

    SHA1

    189c552c94a9b0ae0208763bca77f2801debc224

    SHA256

    765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714

    SHA512

    9f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6

  • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

    Filesize

    5.2MB

    MD5

    58e22c0ee91280156cdaadacac7acddb

    SHA1

    189c552c94a9b0ae0208763bca77f2801debc224

    SHA256

    765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714

    SHA512

    9f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6

  • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

    Filesize

    5.2MB

    MD5

    58e22c0ee91280156cdaadacac7acddb

    SHA1

    189c552c94a9b0ae0208763bca77f2801debc224

    SHA256

    765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714

    SHA512

    9f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6

  • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\aopalliance\aopalliance\1.0\aopalliance-1.0.jar

    Filesize

    4KB

    MD5

    04177054e180d09e3998808efa0401c7

    SHA1

    0235ba8b489512805ac13a8f9ea77a1ca5ebe3e8

    SHA256

    0addec670fedcd3f113c5c8091d783280d23f75e3acb841b61a9cdb079376a08

    SHA512

    3f44a932d8c00cfeee2eb057bcd7c301a2d029063e0a916e1e20b3aec4877d19d67a2fd8aaf58fa2d5a00133d1602128a7f50912ffb6cabc7b0fdc7fbda3f8a1

  • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\com\google\guava\guava\19.0\guava-19.0.jar

    Filesize

    832KB

    MD5

    1b8584d5c939ec28be588fbbfda4e085

    SHA1

    d63bba78716205bfd52c0caac24cfec48778e83c

    SHA256

    3bd4232a2091ffc6c2a95fe96080347887906a27829da4f907ad9b868fb879af

    SHA512

    350093993ce719d1e44784dc774878d5187e1096535c0366aa2752257dcf9a3d2e2d8ec661957f530a866b574a6342680ba5a4a5bd59542cd0aff3b83416f986

  • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\javax\inject\javax.inject\1\javax.inject-1.jar

    Filesize

    2KB

    MD5

    289075e48b909e9e74e6c915b3631d2e

    SHA1

    6975da39a7040257bd51d21a231b76c915872d38

    SHA256

    91c77044a50c481636c32d916fd89c9118a72195390452c81065080f957de7ff

    SHA512

    e126b7ccf3e42fd1984a0beef1004a7269a337c202e59e04e8e2af714280d2f2d8d2ba5e6f59481b8dcd34aaf35c966a688d0b48ec7e96f102c274dc0d3b381e

  • C:\Users\Admin\AppData\Roaming\.tlauncher\doubleRunningProtection.txt

    Filesize

    13B

    MD5

    af81528ee0db492a69c0787c63bd20e5

    SHA1

    a999b38936a308981347801457f919deff740529

    SHA256

    b1b93d2977709b57fad6ad7ab11c86a21fe68b5d50b9d120fc9f38803c206077

    SHA512

    64c643f6d7d4854cd7a506084cc985fed1f60359b83758f75e23371974596dfe1de4ab7990ce077bdf12d5541b7e39922b85f577c48a40254d18c1bd6444c2e4

  • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

    Filesize

    40B

    MD5

    adb6c26aba74acbb4da1f775d45c29f5

    SHA1

    6e7b5e0345ead590d81f0327241cd7f1befecd5e

    SHA256

    6faa25af4020fcb7d99f63255bf9fa542bbacd82b4aaa4e75ddaaa3114544f77

    SHA512

    652e69303275ee8f28bc27f332886043841bd80a212fe1363db03df4ad5b79991df08ff3285da5c9077faaa453529a36a17f2aafc4cceb90f4d8fa6b23e9c1e6

  • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

    Filesize

    40B

    MD5

    adb6c26aba74acbb4da1f775d45c29f5

    SHA1

    6e7b5e0345ead590d81f0327241cd7f1befecd5e

    SHA256

    6faa25af4020fcb7d99f63255bf9fa542bbacd82b4aaa4e75ddaaa3114544f77

    SHA512

    652e69303275ee8f28bc27f332886043841bd80a212fe1363db03df4ad5b79991df08ff3285da5c9077faaa453529a36a17f2aafc4cceb90f4d8fa6b23e9c1e6

  • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

    Filesize

    40B

    MD5

    adb6c26aba74acbb4da1f775d45c29f5

    SHA1

    6e7b5e0345ead590d81f0327241cd7f1befecd5e

    SHA256

    6faa25af4020fcb7d99f63255bf9fa542bbacd82b4aaa4e75ddaaa3114544f77

    SHA512

    652e69303275ee8f28bc27f332886043841bd80a212fe1363db03df4ad5b79991df08ff3285da5c9077faaa453529a36a17f2aafc4cceb90f4d8fa6b23e9c1e6

  • memory/1456-158-0x00000000004A0000-0x0000000000888000-memory.dmp

    Filesize

    3.9MB

  • memory/1456-152-0x00000000004A0000-0x0000000000888000-memory.dmp

    Filesize

    3.9MB

  • memory/1596-216-0x0000000003020000-0x0000000004020000-memory.dmp

    Filesize

    16.0MB

  • memory/1596-252-0x0000000003020000-0x0000000004020000-memory.dmp

    Filesize

    16.0MB

  • memory/1620-175-0x0000000000400000-0x0000000000947000-memory.dmp

    Filesize

    5.3MB

  • memory/1832-167-0x0000000000400000-0x0000000000947000-memory.dmp

    Filesize

    5.3MB

  • memory/2300-161-0x0000000000400000-0x0000000000947000-memory.dmp

    Filesize

    5.3MB

  • memory/2300-179-0x0000000000400000-0x0000000000947000-memory.dmp

    Filesize

    5.3MB

  • memory/3648-177-0x0000000000400000-0x0000000000947000-memory.dmp

    Filesize

    5.3MB

  • memory/3732-157-0x0000000000400000-0x0000000000947000-memory.dmp

    Filesize

    5.3MB

  • memory/4108-184-0x00000000001E0000-0x00000000005C8000-memory.dmp

    Filesize

    3.9MB

  • memory/4108-142-0x00000000001E0000-0x00000000005C8000-memory.dmp

    Filesize

    3.9MB

  • memory/4108-141-0x00000000063F0000-0x00000000063F3000-memory.dmp

    Filesize

    12KB

  • memory/4108-140-0x0000000010000000-0x0000000010051000-memory.dmp

    Filesize

    324KB

  • memory/4108-137-0x00000000001E0000-0x00000000005C8000-memory.dmp

    Filesize

    3.9MB

  • memory/4844-197-0x00000000030F0000-0x00000000040F0000-memory.dmp

    Filesize

    16.0MB

  • memory/4844-205-0x00000000030F0000-0x00000000040F0000-memory.dmp

    Filesize

    16.0MB

  • memory/4844-234-0x00000000030F0000-0x00000000040F0000-memory.dmp

    Filesize

    16.0MB

  • memory/4844-240-0x00000000030F0000-0x00000000040F0000-memory.dmp

    Filesize

    16.0MB

  • memory/4844-220-0x00000000030F0000-0x00000000040F0000-memory.dmp

    Filesize

    16.0MB