Resubmissions

26-03-2023 23:59

230326-313zhaaf38 10

26-03-2023 23:54

230326-3x7taaae99 7

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    26-03-2023 23:54

General

  • Target

    TLauncher-2.876-Installer-1.0.7-global.exe

  • Size

    22.6MB

  • MD5

    e89a95bce6075955a4e1acdb6bb56561

  • SHA1

    8b17013cbf2ea69d625d7bcb1e578933c13678fc

  • SHA256

    78d84068b47cf28b76c88ba4474c7c187510f4e4e967d079d3761dcab7851655

  • SHA512

    4ccb33f60c9292e12daa53b49524a36bbe1c1ca86d794b5134b8b954736a532e9f202123b39036c6a9c557e128bd8361e5c1cb86d40723cc00784026741d5e65

  • SSDEEP

    393216:DXkoYB+UAVl/Pfs/dQETVlOBbpFEjdGphRqV56HpkvQFa2Vj4h2cU:D0oYB+3fHHExi73qqHpU2Vj4hE

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4024
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe" "__IRCT:3" "__IRTSS:23645635" "__IRSID:S-1-5-21-2805025096-2326403612-4231045514-1000"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:224
      • C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
        "C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5000
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816338 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:1840798" "__IRSID:S-1-5-21-2805025096-2326403612-4231045514-1000"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:5024
  • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
    "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4784
    • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
      "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:1608
  • C:\Windows\System32\GameBarPresenceWriter.exe
    "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
    1⤵
      PID:2244
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4492
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
      1⤵
      • Drops desktop.ini file(s)
      • Checks processor information in registry
      • Modifies registry class
      PID:3860

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

      Filesize

      1.8MB

      MD5

      52e46b1adf9cd40428b41755df527bd4

      SHA1

      5f0bb9c9c14208851beb5c93d9268c16ab39dc07

      SHA256

      a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

      SHA512

      813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

    • C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

      Filesize

      1.8MB

      MD5

      52e46b1adf9cd40428b41755df527bd4

      SHA1

      5f0bb9c9c14208851beb5c93d9268c16ab39dc07

      SHA256

      a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

      SHA512

      813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico

      Filesize

      116KB

      MD5

      e043a9cb014d641a56f50f9d9ac9a1b9

      SHA1

      61dc6aed3d0d1f3b8afe3d161410848c565247ed

      SHA256

      9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946

      SHA512

      4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe

      Filesize

      1.8MB

      MD5

      52e46b1adf9cd40428b41755df527bd4

      SHA1

      5f0bb9c9c14208851beb5c93d9268c16ab39dc07

      SHA256

      a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13

      SHA512

      813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.PNG

      Filesize

      339B

      MD5

      bbdf2e8c0262e7e606d41ddbe5a3cd12

      SHA1

      acbb25f729af14b692ec9c8187a23b1a696f8e47

      SHA256

      d7c76896d206d977739556ad2d5811f7cf3117252afcd439a5aa0f2b645f6949

      SHA512

      0334fae3682889adbc18594b7917d8c93252a86bc04d08efc6860d5714ba4eb8aabc39c51e532c4aee57a938021540d2f2899781d9cd1de311036e1850a65067

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG104.PNG

      Filesize

      644B

      MD5

      38c12e1a54f8fd216ed3f13b36798cc6

      SHA1

      ccf1fe585d3374ebce4c1ec025e2d8ec39968a7c

      SHA256

      608924ba294590b5b706658d9aaa71b480ad9aa1b6797bbc5cf1632ac6c616b1

      SHA512

      0918af63f006d7fa04a3faeeb813e61c060316a126c4742a948a30f5b6ea368c3b8592011319dad3dbf8427dfcc095aa72f7b651d6fc31061f861f070447331b

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG105.PNG

      Filesize

      40KB

      MD5

      98abbfa2908f51f4eda33f465ccacc03

      SHA1

      1bd17c0835b1c8196d0a8166b4818b3138f65a28

      SHA256

      10438b49eeac103534a5fd867888437b761f346cec8714daeb95fdd246cc540a

      SHA512

      9eaa76ab654a786f5af84e9a20e7d0efb22ee00977e662ab5a057da1aff1a7552150bba0253704f00e60115347bfb4fe1784a703ad3846e221dbee41ea7a1470

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG108.PNG

      Filesize

      2KB

      MD5

      03b1d78771eb279766efb2d9f2fa8463

      SHA1

      8f10e304fd65e58136ccd6ab012ffc594e6fb707

      SHA256

      eec16d2cb57e38b485b6a269e9c2554c1dfc3b70dec9f7bbddc2b62526b3d832

      SHA512

      ca51cbaf20e6f62eb6ec69555d259ef61828d3166d09106bcd335dd417ed30660af71e7fd8db6bd22bf134cc530e1a55ecdd2c307e64e8edb28af95299d66f5a

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG112.PNG

      Filesize

      2KB

      MD5

      40c8967f400a4b47af766a57262e3401

      SHA1

      3a9173c57bb201cac325e57914f78c0cd588eb4d

      SHA256

      81a7bfac6b1d82bad7b760ff949c3b2a21361b14b9630501523e4ba80ecb5807

      SHA512

      9d6c3f10a70d52ecb120504ca4501b05bfdeabe979241b8226f121497e59a8bf63c7ee08549629806598a832770fdbf48c92e204e5e59b272e8e118c47d2445f

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG19.PNG

      Filesize

      1KB

      MD5

      46a65321aa1fce57d465c26e8b6eb392

      SHA1

      9efb9a3acd5b32556ea66398c74b014f91087559

      SHA256

      61df7a1f0367209668d4f0f6a285b8baff864d1341d382ebbc7fd4e71036b666

      SHA512

      094d69016f066ae835c71d7a950217b9ad09e8cd4d74131787203cae950e572c18213dc1ded139b1fa46c7f803cc15bf4f596c9d51aefe0d43850ae2865f3707

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.PNG

      Filesize

      280B

      MD5

      5a7901f7df307fba45b1c377f2c94ccc

      SHA1

      d6630cf733033cdfbda7af3213d49b32f5b06919

      SHA256

      d8471d5a5b4792c4b49e80b5cb22ef1e938dc3069b210646704f658548d7a9f8

      SHA512

      fc0036a7ed4b53edd72b91c4824919e6e8a82b5be1e82cdc134e267ef4792424124fb6ba5d7c86cf686910da0baba8453d7a6c12b39a5b4c0cb70658580f3bc9

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.PNG

      Filesize

      281B

      MD5

      05d7bba3d6ac92766c4495b8928202a6

      SHA1

      50b65a8ba5ed2633e43929ee4bd58c95a91a3363

      SHA256

      4804f3c4fae714657fdb85e98244828acc6ac938505c2da1ed694ae7b58f2949

      SHA512

      1544d5cd6f85aaeeacd26f2deb9da9eb510226b41079ee78c4dede14386e5ea3446efdfd475bfbfa3a6846fa2ff23d64f4dad3a4ddd304e32de80e4d7bcbc600

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG45.PNG

      Filesize

      438B

      MD5

      09229c3bfb801177839a7c2e22e33a1b

      SHA1

      f679c05c4c7b2f3722069420c6d6481fc856e7aa

      SHA256

      cbf81d779b469942613297a3ca6c09d885e3b1d4aa952dc1994a7175fbfc7e3f

      SHA512

      503bfa063b29dda95f15da303f707e5b78a6bdb74662c222d8a8b7e3a33264016a66acdd9de44aea932e7cde80a43c2406ea6f0250d3df8e182217bc4a0a7ed7

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG46.PNG

      Filesize

      206B

      MD5

      d8a095202e08fa1ac2578982e9a486db

      SHA1

      397ffc8af43ac18466b8df245b4faa6b278659e6

      SHA256

      28fed2b9a3cbde34da4b6b5d1af2d2844437d21f6dec85b3ca2faa5cd3b512e5

      SHA512

      ac751386a0004e335f4e5f4ea24bf6a474478c8a7ca54d018734e7cd44b8e9a0eb262b00fe1219b1c62c96b018b08ba6b1056d3a13e64b55c7e70d748a6ae9c6

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG85.PNG

      Filesize

      43KB

      MD5

      667b0b54ee5ba0d1cb66190226596e46

      SHA1

      b8658b35e7cf44b24053e4d01d3b51233d6526f6

      SHA256

      3a9ab8c3640f1b40b33553d7d3dd3d15bd6e702ef510ec0b66a2f14aa744bf83

      SHA512

      9ccc773214a0074634be66801d81d7a593ab154351fdbd1b93f56ffa80cf824ee31ff2e13f26536d5f3096e90df43fa223080b4dc55340614b076c08ef976dcb

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG92.PNG

      Filesize

      1KB

      MD5

      5f84b4bf9384d9fea8faecb0ca1abc97

      SHA1

      71c514dcdc0ac966a4c072949fcfadc0150618a5

      SHA256

      fa6875692ce4824a5ea7b054e513a6d85351304ef327aa6d179482fad49b91ec

      SHA512

      61546cb94e9dd560e483d5ef912212116c20e18b989dcefa3a99444417061ad9038c0806d903ecc39c970ea6b225f80c9df3804a48a91bcd5b7e078cb878d6e2

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

      Filesize

      1.7MB

      MD5

      1bbf5dd0b6ca80e4c7c77495c3f33083

      SHA1

      e0520037e60eb641ec04d1e814394c9da0a6a862

      SHA256

      bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

      SHA512

      97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

      Filesize

      1.7MB

      MD5

      1bbf5dd0b6ca80e4c7c77495c3f33083

      SHA1

      e0520037e60eb641ec04d1e814394c9da0a6a862

      SHA256

      bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

      SHA512

      97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

      Filesize

      97KB

      MD5

      da1d0cd400e0b6ad6415fd4d90f69666

      SHA1

      de9083d2902906cacf57259cf581b1466400b799

      SHA256

      7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

      SHA512

      f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

      Filesize

      97KB

      MD5

      da1d0cd400e0b6ad6415fd4d90f69666

      SHA1

      de9083d2902906cacf57259cf581b1466400b799

      SHA256

      7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

      SHA512

      f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

      Filesize

      1.3MB

      MD5

      111dddf2f308abc2a8f7555d5f642751

      SHA1

      11e6cdccbf29a71a97011b9444cf20c83ad8b57b

      SHA256

      c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

      SHA512

      11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

      Filesize

      1.3MB

      MD5

      111dddf2f308abc2a8f7555d5f642751

      SHA1

      11e6cdccbf29a71a97011b9444cf20c83ad8b57b

      SHA256

      c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

      SHA512

      11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

      Filesize

      1.3MB

      MD5

      111dddf2f308abc2a8f7555d5f642751

      SHA1

      11e6cdccbf29a71a97011b9444cf20c83ad8b57b

      SHA256

      c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0

      SHA512

      11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

      Filesize

      326KB

      MD5

      80d93d38badecdd2b134fe4699721223

      SHA1

      e829e58091bae93bc64e0c6f9f0bac999cfda23d

      SHA256

      c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

      SHA512

      9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

      Filesize

      326KB

      MD5

      80d93d38badecdd2b134fe4699721223

      SHA1

      e829e58091bae93bc64e0c6f9f0bac999cfda23d

      SHA256

      c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

      SHA512

      9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat

      Filesize

      108KB

      MD5

      aec508468d53ab8d55f5b4beb82c347d

      SHA1

      477d1ffb28834243f5811a4a2a54b4f0ca240120

      SHA256

      ebee84e34e221ad822486432333bad9e6357af2fb0d9651cc61c7fab8ec9b5bf

      SHA512

      26a0278af2a9e75ef966bc3f7f40d7669204c2004a043adaad102ef440caa6282e69372ca0c3c7d39a8450691d528c2dc77a4386bfb0c6e5a2a76c3fef900fbe

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

      Filesize

      1.3MB

      MD5

      5027f3112ac2d6f764769102a9145c8e

      SHA1

      a369a0e1d4ace1a8d66908aa43543bea03c76f5b

      SHA256

      d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

      SHA512

      181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

      Filesize

      1.3MB

      MD5

      5027f3112ac2d6f764769102a9145c8e

      SHA1

      a369a0e1d4ace1a8d66908aa43543bea03c76f5b

      SHA256

      d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

      SHA512

      181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

      Filesize

      1.3MB

      MD5

      5027f3112ac2d6f764769102a9145c8e

      SHA1

      a369a0e1d4ace1a8d66908aa43543bea03c76f5b

      SHA256

      d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c

      SHA512

      181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

      Filesize

      326KB

      MD5

      80d93d38badecdd2b134fe4699721223

      SHA1

      e829e58091bae93bc64e0c6f9f0bac999cfda23d

      SHA256

      c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

      SHA512

      9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

      Filesize

      326KB

      MD5

      80d93d38badecdd2b134fe4699721223

      SHA1

      e829e58091bae93bc64e0c6f9f0bac999cfda23d

      SHA256

      c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

      SHA512

      9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

    • C:\Users\Admin\AppData\Local\Temp\setuparguments.ini

      Filesize

      649B

      MD5

      d0b813e00054c41c2d0941f0b0cb5ff2

      SHA1

      c41519e877ba81f46906e6a9d0fe1fa7c40f38d5

      SHA256

      cb21f03ff50073a7afeb40e8ebcfbe3a3adc3b8f59ae694838c45a44c46b3b07

      SHA512

      962fc9024a482e2ba3e49b4acd8de6034bab0c65b3c05bbbf11ce395fa38ffc488bba2bbe0d7553572bf8f5b3cf8a4db369654568948b381956750eff81c8b45

    • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

      Filesize

      6.3MB

      MD5

      f08d9bbc61cff8e8c3504524c3220bef

      SHA1

      b4268c667469620bb528c04eaa819d508159b398

      SHA256

      2c4d8b48344ae221e349e525ac16eb364ffb5ab8deae80c7caa28dd5967cabdb

      SHA512

      a64a03d959487399fb57e1bd062c0e9f88a17ff9b3ad15e6b96a4b7332341d0fc9186ef99b2ab9bdcfa51864f21d08bce48479202c01d15470916e90fb09fef4

    • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

      Filesize

      6.3MB

      MD5

      f08d9bbc61cff8e8c3504524c3220bef

      SHA1

      b4268c667469620bb528c04eaa819d508159b398

      SHA256

      2c4d8b48344ae221e349e525ac16eb364ffb5ab8deae80c7caa28dd5967cabdb

      SHA512

      a64a03d959487399fb57e1bd062c0e9f88a17ff9b3ad15e6b96a4b7332341d0fc9186ef99b2ab9bdcfa51864f21d08bce48479202c01d15470916e90fb09fef4

    • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

      Filesize

      6.3MB

      MD5

      f08d9bbc61cff8e8c3504524c3220bef

      SHA1

      b4268c667469620bb528c04eaa819d508159b398

      SHA256

      2c4d8b48344ae221e349e525ac16eb364ffb5ab8deae80c7caa28dd5967cabdb

      SHA512

      a64a03d959487399fb57e1bd062c0e9f88a17ff9b3ad15e6b96a4b7332341d0fc9186ef99b2ab9bdcfa51864f21d08bce48479202c01d15470916e90fb09fef4

    • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\aopalliance\aopalliance\1.0\aopalliance-1.0.jar

      Filesize

      4KB

      MD5

      04177054e180d09e3998808efa0401c7

      SHA1

      0235ba8b489512805ac13a8f9ea77a1ca5ebe3e8

      SHA256

      0addec670fedcd3f113c5c8091d783280d23f75e3acb841b61a9cdb079376a08

      SHA512

      3f44a932d8c00cfeee2eb057bcd7c301a2d029063e0a916e1e20b3aec4877d19d67a2fd8aaf58fa2d5a00133d1602128a7f50912ffb6cabc7b0fdc7fbda3f8a1

    • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\com\github\junrar\junrar\0.7\junrar-0.7.jar

      Filesize

      151KB

      MD5

      75a215b9e921044cd2c88e73f6cb9745

      SHA1

      18cc717b85af0b12ba922abf415c2ff4716f8219

      SHA256

      7c764fa1af319b98ff452189ab31bb722ea74ed7a52b17b0c6282249c10a61fc

      SHA512

      1a44af2f3f8dbfbf38ad5f71ef11b32d5822d734f77af2cdea419fb6af845e894acb60bffbcebb4533068d86b55a22a8b0f74be20b204c2343bdb165d9c787f9

    • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\com\google\guava\guava\19.0\guava-19.0.jar

      Filesize

      2.2MB

      MD5

      43bfc49bdc7324f6daaa60c1ee9f3972

      SHA1

      6ce200f6b23222af3d8abb6b6459e6c44f4bb0e9

      SHA256

      58d4cc2e05ebb012bbac568b032f75623be1cb6fb096f3c60c72a86f7f057de4

      SHA512

      834f2bf4a5b35edffde0263409649aeaf34ca9a742ba511a06bb9b01626f9e774d2d3c8ba91a7905929dc8cd5e6471de29f7d0ab10260ece2af709b7fdbe4bc3

    • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\com\google\inject\extentions\guice-assistedinject\4.1.0\guice-assistedinject-4.1.0.jar

      Filesize

      41KB

      MD5

      65912196b6e91f2ceb933001c1fb5c94

      SHA1

      af799dd7e23e6fe8c988da12314582072b07edcb

      SHA256

      663728123fb9a6b79ea39ae289e5d56b4113e1b8e9413eb792f91e53a6dd5868

      SHA512

      60b15182130ddfd801dd0438058d641dd5ba9122f2d1e081eb63f5e2c12fff0271d9d47c58925be0be8267ed22ae893ea9d1b251faba17dc1d2552b5d93056de

    • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\com\google\inject\guice\4.1.0\guice-4.1.0.jar

      Filesize

      658KB

      MD5

      41f66d1d4d250efebde3bbf8b2d55dfa

      SHA1

      eeb69005da379a10071aa4948c48d89250febb07

      SHA256

      9b9df27a5b8c7864112b4137fd92b36c3f1395bfe57be42fedf2f520ead1a93e

      SHA512

      109a1595668293b32376e885ad59e0e4c0e088ea00f58119f0f7d0d2055f03eb93a9f92d974b6dbd56ef721792ac03c889d9add3a2850aa7ccd732c2682d17ef

    • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\dnsjava\dnsjava\2.1.8\dnsjava-2.1.8.jar

      Filesize

      307KB

      MD5

      540f330717bca9d29c8762cf6daca443

      SHA1

      eed8a2cbf56cc60d07a189a429ead3067564193c

      SHA256

      52de1ff2a7556ac2cc4284abd7123bc3d6274210fc4e3b1d9ba90efad5f6a153

      SHA512

      a4bcb8bbb43906f42faf1802c504ccc9c616e49afd5dd7db77676d13aaed79a300979ffc2195b680a9c6d5f03466b611b6f1338d824099816aa224b234760f4b

    • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\javax\inject\javax.inject\1\javax.inject-1.jar

      Filesize

      2KB

      MD5

      289075e48b909e9e74e6c915b3631d2e

      SHA1

      6975da39a7040257bd51d21a231b76c915872d38

      SHA256

      91c77044a50c481636c32d916fd89c9118a72195390452c81065080f957de7ff

      SHA512

      e126b7ccf3e42fd1984a0beef1004a7269a337c202e59e04e8e2af714280d2f2d8d2ba5e6f59481b8dcd34aaf35c966a688d0b48ec7e96f102c274dc0d3b381e

    • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\log4j\log4j\1.2.17\log4j-1.2.17.jar

      Filesize

      478KB

      MD5

      04a41f0a068986f0f73485cf507c0f40

      SHA1

      5af35056b4d257e4b64b9e8069c0746e8b08629f

      SHA256

      1d31696445697720527091754369082a6651bd49781b6005deb94e56753406f9

      SHA512

      3f12937a69ba60d0f5e86265168d6a0d069ce20d95b99a3ace463987655e7c63053f4d7e36e32f2b53f86992b888ca477bf81253ad04c721896b397f94ee57fc

    • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\net\sf\jopt-simple\jopt-simple\4.9\jopt-simple-4.9.jar

      Filesize

      64KB

      MD5

      39c6476e4de3d4f90ad4ca0ddca48ec2

      SHA1

      ee9e9eaa0a35360dcfeac129ff4923215fd65904

      SHA256

      26c5856e954b5f864db76f13b86919b59c6eecf9fd930b96baa8884626baf2f5

      SHA512

      fd04c19bce810a1548b2d2eaadb915cff2cbc81a81ec5258aafc1ba329100daedc49edad1fc7b254ab892996796124283d7004b5414f662c0efa3979add9ca5f

    • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\apache\commons\commons-lang3\3.4\commons-lang3-3.4.jar

      Filesize

      424KB

      MD5

      8667a442ee77e509fbe8176b94726eb2

      SHA1

      5fe28b9518e58819180a43a850fbc0dd24b7c050

      SHA256

      734c8356420cc8e30c795d64fd1fcd5d44ea9d90342a2cc3262c5158fbc6d98b

      SHA512

      b1b556692341a240f8b81f8f71b8b5c0225ccf857ce1b185e7fe6d7a9bb2a4d77823496cd6e2697a20386e7f3ba02d476a0e4ff38071367beb3090104544922d

    • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\apache\httpcomponents\fluent-hc\4.5.13\fluent-hc-4.5.13.jar

      Filesize

      30KB

      MD5

      8f7e4f1a95a870ebee87ddacc425362c

      SHA1

      300bf1846737e34b9ea10faae257ca8fdcd0616f

      SHA256

      f883b6b027d5e05c53e48e4fe3548715c52dbd590ffa3f52d039574f1a4d0728

      SHA512

      98e30ed27d6ac078450efe5e236117445c93e05eb280399e056816c52643a3a33adce5e3a885ce8488186f38d05e0fb6c65dfcbaa509be8c6047ef2f0870d9b0

    • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\apache\logging\log4j\log4j-core\2.14.1\log4j-core-2.14.1.jar

      Filesize

      1.7MB

      MD5

      948dda787593340a7af1a18e328b7b7f

      SHA1

      9141212b8507ab50a45525b545b39d224614528b

      SHA256

      ade7402a70667a727635d5c4c29495f4ff96f061f12539763f6f123973b465b0

      SHA512

      6e41ff42f12deedb8da06cbed73d0a9a5389660b7ee058436f8fcb6b14a6ab3105faf8e3f2c007d38ccc85af1e704505b84be5a80d8e68a434aae82b54b85f70

    • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\tlauncher\picture-bundle\3.7\picture-bundle-3.7.jar

      Filesize

      2.1MB

      MD5

      904094a40b7d81b12936f43b49952922

      SHA1

      5ccf048dd51a7d0cdd59a1ea6ce2e3b167feacf3

      SHA256

      0cd5746118a3a38b7e6126770bc53c0f7c4641fab786e3d6004a4caace4fc536

      SHA512

      36e2bc67d73319b8f10a572ee3ca6f541aa51ca16c1efea9430111f3a058c9c922a43865b064811117f1c3892e39aee3bc79d7fc5ce20ccd75a13d447ca68911

    • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\tlauncher\skin-server-API\1.0\skin-server-API-1.0.jar

      Filesize

      14KB

      MD5

      13a8e72587ac6eacfb0986f75e51eb7c

      SHA1

      6c3daf89705427f73e6106d2d4d9619e99c5ecb5

      SHA256

      1fcffa073f722737431e2699b1f3ea48b92a3b825397d8f0d1464e4d4d15a014

      SHA512

      134735390415f60d0c42ff33a060bda508e273b35fc9aab271c20ff23f331b51cf3fa36443009e0987049f6bfb22c4098a1473e65ea0349e719fbf4b528f344e

    • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\tlauncher\tlauncher-resource\1.4\tlauncher-resource-1.4.jar

      Filesize

      3.2MB

      MD5

      acbc8aa5ba5cdddf5f1e67befe8cc597

      SHA1

      63b4bf89744b532e65c1afa3294743d2b3798f2b

      SHA256

      1f46b3a163012f9729905633b5e5e03ce385066ae43138a564729c942f9ca6b9

      SHA512

      d974a032d9af451c0dd51fbc0d64840f3e03eb502f40e4ab60d6722913b8a48d44a75752fcff60656e4d19089570a894222959745af11bcdf93ea1544192fee3

    • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\tukaani\xz\1.5\xz-1.5.jar

      Filesize

      97KB

      MD5

      51050e595b308c4aec8ac314f66e18bc

      SHA1

      9c64274b7dbb65288237216e3fae7877fd3f2bee

      SHA256

      86f30fa8775fa3a62cdb39d1ed78a6019164c1058864048d42cbee244e26e840

      SHA512

      c5c130bf22f24f61b57fc0c6243e7f961ca2a8928416e8bb288aec6650c1c1c06ace4383913cd1277fc6785beb9a74458807ea7e3d6b2e09189cfaf2fb9ab7e1

    • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.BMP

      Filesize

      451KB

      MD5

      0b445ace8798426e7185f52b7b7b6d1e

      SHA1

      7a77b46e0848cc9b32283ccb3f91a18c0934c079

      SHA256

      2bbf97ccba3f87d469eac909c4ce8a3f13ed29c8f31b611e7d5cf89a0619eda6

      SHA512

      51523d5b711481293305465a3a3c6a3a50dca984cdc8cca1f4c44f3c21bfa430cd9aac1a8782d9605e6954cbafb307beb6b1a52e9785de1bc3f71067d80c6b6e

    • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG11.PNG

      Filesize

      1KB

      MD5

      a7abdc35d821b444be3ff4c2c076b9df

      SHA1

      1b8b0bef1a10a8b22d32a288efbd32b25dbf46fc

      SHA256

      7fae8a0524f3bb30ef060439eefd7660ff67c30b9c22910e124cc1275a55c2df

      SHA512

      69b4c2acd15c8dff520c8d1031a344a8cc762440b4eff3b43934709fec2402d558e9bfddd828f0a6dbff45813d57e1d587a65f7d8a79f724729317d87aa16003

    • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG29.PNG

      Filesize

      1KB

      MD5

      e6663f52235742a1dc27b96241538ff5

      SHA1

      37234351ade7563f9dc8fb05eba0a13d3fd65a7d

      SHA256

      26a99701ea3b890bc5e09dab86f5ed6db99a4d62db5b35b55e2b5a3598478e49

      SHA512

      090719e1745c1e23b7ac623d6a102797c206e03529e7706af7e2cd35b17352750587a5689997a923134ebe988e94843da8deab770bca60935f08964fa7ce6e2b

    • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNG

      Filesize

      45KB

      MD5

      2799f9daca46770a871ce1b5eed32e7c

      SHA1

      a2792f571210a7f38cdbe49391017300ee7b1ce4

      SHA256

      fc22676f5b6cdae17b78ddfd16bb070687516fbc827a7edd0541f3a32d85c9e9

      SHA512

      c41f2e4c4ca59d6f9d11fac11296ab87f1b508b5d64e5db7762f2f6dd387aa96206b2b0fa127f17c0b8c24a0b56e81af12d5937474a450222d9c4416c1acb16a

    • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG41.PNG

      Filesize

      457B

      MD5

      ce17d7ce06488f394ce124f17d5acafc

      SHA1

      8a5dceae9ea369b686123c8f940bb0ea07870ffa

      SHA256

      c4b04568930f03979d71f48a57b9ad06b4cdf687272f6753ff662006e8e6237f

      SHA512

      c33f1370213cabd1b84c936f1ac14f9bcc83bc03a633bbe25efe1e906bcee515d0e615c86b7ee3b34404dd1d95ce74d1a00908de8cdacbf9961de3f1ceb8362b

    • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG42.PNG

      Filesize

      352B

      MD5

      1f5c8939031a7f93762862cfc88a8e56

      SHA1

      6dc4df87344db0ddf09c777e7a80d1b5661559b8

      SHA256

      14be26e969eb15ef7e76e0ad02d8aa0516c5391e8b09dba0a9a6c5f57ae24aba

      SHA512

      de45d700c86329c704777917863fd1ddeca90d2bed67a72794164882bf15725ce83c7733f664ee0a2af7df54a6be2def729d19237fb2c434115396ac126ff47f

    • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG54.PNG

      Filesize

      2KB

      MD5

      6c6f8e031e196f2f57c70ea411091c28

      SHA1

      266c1b4feb60f06387c30ec810c52b5a570706b9

      SHA256

      ea64efad0cabdb9300ba83804b7b98e36393e1626a684ce0abd38d1ed1d34e90

      SHA512

      f4018b1a0bc65390cb96581dbf4f4032317304cbaf8526ef1cbb2f700ab501859b007c13989f5df81247d959c35e721cfceb5ff6c95cbf2cd198a74198d68a58

    • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG66.PNG

      Filesize

      41KB

      MD5

      1557c08e187b7783083e0b80051fd321

      SHA1

      2c6ee47799d713e88fd589609b81912a4522044e

      SHA256

      0c0e74dd07c45833a5dd7ba931e5d528eb16334defdd06171df2f632d6e47842

      SHA512

      485f69b3878b2bd7fdf52ad020dde2cbc34dd1970aaa4e5eb8f8618f6091b5b827b428447859499c3d61ea9cde2edcbb97c8fb0560cd0aaff50027c0f97ee6f3

    • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG73.PNG

      Filesize

      1KB

      MD5

      44411a40791606c0445226eff31e43ee

      SHA1

      f482762866ad847b10b11a3108709cb554d1f9f1

      SHA256

      2205b4c552bcc49ffa7964b61b6c20dc4bbad14c941e8f695db1dbb6719349e4

      SHA512

      e5e4e67fc3a5564e7cc5c267f816362558439d0c3c33f6ad52d2f4ebfeb01f0dac4f6e4b72fb6da53ea343d306d4cc662cde54c149d7f8a4767c2f8a57e84066

    • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG8.BMP

      Filesize

      451KB

      MD5

      d2b43decae0a14deb90423bfb687dc63

      SHA1

      c191705fcb927d476d4fc639860bd52e324a274c

      SHA256

      3266fb3a33a97fac7d71652129865c3d0dd06e70af6ed5a3b2506d842eb69e70

      SHA512

      3cd903b0c4590e25502cd0f91b678c1e798989211e174d5a6dbfd52b343a426b867204979cc078a4919d63a4c4401c4f8eaa295227cec0ccc043c7e285d3d2df

    • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

      Filesize

      33KB

      MD5

      7bc30d2b3394aed748542f982ecf0729

      SHA1

      1a9fda9ff23c5f07bb327492746107d080782a18

      SHA256

      bc5d19ece41fbfab2153c7518aa655676cc401e6b149e804cfdd0a57d4d8a6e2

      SHA512

      98cfd3a6bc7bff9000c37ec7bd4cb32dc67a9b7079a0cca3b3f7963db559596cc660ef987f53e6178e5601650ae9b6048ea8362527385c3ff957cbb5b7a16ea7

    • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

      Filesize

      6KB

      MD5

      4f7be9736242579cb8afa1af86980dfe

      SHA1

      1c486393847996db4f6b78532dd7bd9a0a924549

      SHA256

      9cecc28716f392d2394829f4cc3f307d08f5aecaf3e2124bdaaa0d6d9c3400b4

      SHA512

      4c55bc2698d8934713e791c015480248198e22efa66dd5ca79ea834b9835c9e85ca8c2869c9b40dc394ae7e27da039f79c392f88472dedc1adfa83dd1e94f1c9

    • C:\Users\Admin\Videos\Captures\desktop.ini

      Filesize

      190B

      MD5

      b0d27eaec71f1cd73b015f5ceeb15f9d

      SHA1

      62264f8b5c2f5034a1e4143df6e8c787165fbc2f

      SHA256

      86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

      SHA512

      7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

    • memory/224-548-0x0000000010000000-0x0000000010051000-memory.dmp

      Filesize

      324KB

    • memory/224-1535-0x0000000010000000-0x0000000010051000-memory.dmp

      Filesize

      324KB

    • memory/224-441-0x00000000062D0000-0x00000000062D3000-memory.dmp

      Filesize

      12KB

    • memory/224-440-0x0000000010000000-0x0000000010051000-memory.dmp

      Filesize

      324KB

    • memory/224-547-0x00000000004D0000-0x00000000008B8000-memory.dmp

      Filesize

      3.9MB

    • memory/224-1534-0x00000000004D0000-0x00000000008B8000-memory.dmp

      Filesize

      3.9MB

    • memory/224-147-0x00000000004D0000-0x00000000008B8000-memory.dmp

      Filesize

      3.9MB

    • memory/224-456-0x00000000004D0000-0x00000000008B8000-memory.dmp

      Filesize

      3.9MB

    • memory/224-457-0x0000000010000000-0x0000000010051000-memory.dmp

      Filesize

      324KB

    • memory/224-1829-0x00000000004D0000-0x00000000008B8000-memory.dmp

      Filesize

      3.9MB

    • memory/224-484-0x00000000004D0000-0x00000000008B8000-memory.dmp

      Filesize

      3.9MB

    • memory/224-485-0x0000000010000000-0x0000000010051000-memory.dmp

      Filesize

      324KB

    • memory/224-486-0x00000000004D0000-0x00000000008B8000-memory.dmp

      Filesize

      3.9MB

    • memory/1608-1869-0x00000000029C0000-0x00000000029C1000-memory.dmp

      Filesize

      4KB

    • memory/1608-1843-0x00000000029C0000-0x00000000029C1000-memory.dmp

      Filesize

      4KB

    • memory/1608-1891-0x00000000029C0000-0x00000000029C1000-memory.dmp

      Filesize

      4KB

    • memory/1608-1895-0x00000000029C0000-0x00000000029C1000-memory.dmp

      Filesize

      4KB

    • memory/1608-1911-0x00000000029C0000-0x00000000029C1000-memory.dmp

      Filesize

      4KB

    • memory/1608-1852-0x00000000029C0000-0x00000000029C1000-memory.dmp

      Filesize

      4KB

    • memory/1608-1931-0x00000000029C0000-0x00000000029C1000-memory.dmp

      Filesize

      4KB

    • memory/1608-1948-0x00000000029C0000-0x00000000029C1000-memory.dmp

      Filesize

      4KB

    • memory/1608-1949-0x00000000029C0000-0x00000000029C1000-memory.dmp

      Filesize

      4KB

    • memory/4784-1832-0x0000000000400000-0x0000000000417000-memory.dmp

      Filesize

      92KB

    • memory/5024-542-0x0000000000560000-0x0000000000948000-memory.dmp

      Filesize

      3.9MB

    • memory/5024-546-0x0000000000560000-0x0000000000948000-memory.dmp

      Filesize

      3.9MB