Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    171s
  • max time network
    190s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    08/08/2024, 22:35

General

  • Target

    https://tlauncher.org/en/

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks for any installed AV software in registry 1 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Windows directory 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 31 IoCs
  • Suspicious use of SendNotifyMessage 27 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\LaunchWinApp.exe
    "C:\Windows\system32\LaunchWinApp.exe" "https://tlauncher.org/en/"
    1⤵
      PID:3640
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:500
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • NTFS ADS
      • Suspicious use of WriteProcessMemory
      PID:1936
      • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\TLauncher-Installer-1.4.9.exe
        "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\TLauncher-Installer-1.4.9.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2632
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1773458 "__IRAFN:C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\TLauncher-Installer-1.4.9.exe" "__IRCT:3" "__IRTSS:25232289" "__IRSID:S-1-5-21-1687926120-3022217735-1146543763-1000"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks for any installed AV software in registry
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:3188
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4252
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4032
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:3452
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      PID:4708
    • C:\Windows\SysWOW64\werfault.exe
      werfault.exe /h /shared Global\7104e5f20fea4ce99df25d0f18edf059 /t 912 /p 3188
      1⤵
        PID:2096
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
        1⤵
          PID:4212
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe"
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:2916
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe"
            2⤵
            • Checks processor information in registry
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3604
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3604.0.1850789558\439184202" -parentBuildID 20221007134813 -prefsHandle 1700 -prefMapHandle 1696 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f5b033b-97d0-4ed7-b7c4-252749f28772} 3604 "\\.\pipe\gecko-crash-server-pipe.3604" 1776 1f052f04458 gpu
              3⤵
                PID:1836
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3604.1.1585111523\1896693396" -parentBuildID 20221007134813 -prefsHandle 2120 -prefMapHandle 2116 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf160f07-3b40-4379-96a0-8bd14c6c9094} 3604 "\\.\pipe\gecko-crash-server-pipe.3604" 2132 1f051dfb658 socket
                3⤵
                • Checks processor information in registry
                PID:2340
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3604.2.76688975\2142956310" -childID 1 -isForBrowser -prefsHandle 2876 -prefMapHandle 2672 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1228 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9d44455d-120e-4aec-8cb9-74df4e234f01} 3604 "\\.\pipe\gecko-crash-server-pipe.3604" 2668 1f055dfbc58 tab
                3⤵
                  PID:3180
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3604.3.862234417\1553996965" -childID 2 -isForBrowser -prefsHandle 3412 -prefMapHandle 3408 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1228 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6e4b2fc-8790-480b-b6e6-315aded17c8c} 3604 "\\.\pipe\gecko-crash-server-pipe.3604" 3436 1f0560c4e58 tab
                  3⤵
                    PID:5036
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3604.4.120741155\1497986269" -childID 3 -isForBrowser -prefsHandle 4060 -prefMapHandle 4056 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1228 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ae9ea5c-eeb9-4913-8263-2aedea99e653} 3604 "\\.\pipe\gecko-crash-server-pipe.3604" 4072 1f057de3758 tab
                    3⤵
                      PID:3584
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3604.5.1854912262\669952302" -childID 4 -isForBrowser -prefsHandle 4900 -prefMapHandle 4904 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1228 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {add8da82-f77c-4f3e-a40f-28c45ab00b13} 3604 "\\.\pipe\gecko-crash-server-pipe.3604" 4916 1f0585f5c58 tab
                      3⤵
                        PID:1896
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3604.6.2144845745\775764645" -childID 5 -isForBrowser -prefsHandle 5064 -prefMapHandle 5068 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1228 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a663e181-a99a-4b82-9bcf-4674b3e04927} 3604 "\\.\pipe\gecko-crash-server-pipe.3604" 5052 1f05878e558 tab
                        3⤵
                          PID:3972
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3604.7.1272312410\1510470182" -childID 6 -isForBrowser -prefsHandle 5248 -prefMapHandle 5252 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1228 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a71aa0a5-1c35-4028-af33-e9f75274d23f} 3604 "\\.\pipe\gecko-crash-server-pipe.3604" 5240 1f058791b58 tab
                          3⤵
                            PID:4384
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3604.8.1043774191\325189564" -childID 7 -isForBrowser -prefsHandle 5092 -prefMapHandle 2612 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1228 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a58048ae-bacd-4dd2-a3d0-8a96164dd0c5} 3604 "\\.\pipe\gecko-crash-server-pipe.3604" 3480 1f05994be58 tab
                            3⤵
                              PID:1484
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\Admin\Desktop\OpenSave.shtml
                          1⤵
                          • Enumerates system info in registry
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          PID:2492
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb55349758,0x7ffb55349768,0x7ffb55349778
                            2⤵
                              PID:1800
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1708,i,8856688237991412339,12884362091068798558,131072 /prefetch:2
                              2⤵
                                PID:3184
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2012 --field-trial-handle=1708,i,8856688237991412339,12884362091068798558,131072 /prefetch:8
                                2⤵
                                  PID:800
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2076 --field-trial-handle=1708,i,8856688237991412339,12884362091068798558,131072 /prefetch:8
                                  2⤵
                                    PID:1000
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3000 --field-trial-handle=1708,i,8856688237991412339,12884362091068798558,131072 /prefetch:1
                                    2⤵
                                      PID:2620
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3008 --field-trial-handle=1708,i,8856688237991412339,12884362091068798558,131072 /prefetch:1
                                      2⤵
                                        PID:500
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4684 --field-trial-handle=1708,i,8856688237991412339,12884362091068798558,131072 /prefetch:8
                                        2⤵
                                          PID:1308
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4812 --field-trial-handle=1708,i,8856688237991412339,12884362091068798558,131072 /prefetch:8
                                          2⤵
                                            PID:5012
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4728 --field-trial-handle=1708,i,8856688237991412339,12884362091068798558,131072 /prefetch:8
                                            2⤵
                                              PID:4624
                                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                            1⤵
                                              PID:4988

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

                                              Filesize

                                              4KB

                                              MD5

                                              1bfe591a4fe3d91b03cdf26eaacd8f89

                                              SHA1

                                              719c37c320f518ac168c86723724891950911cea

                                              SHA256

                                              9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

                                              SHA512

                                              02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                              Filesize

                                              602B

                                              MD5

                                              627df7578f5ac62d9bc686407e491aae

                                              SHA1

                                              4f144290bd83812bd14e6cf3aea4bc5d3a8634b9

                                              SHA256

                                              7223a59054dd95eef0d302bf4a8cc094bb730550b4e63dddd98798d989547a52

                                              SHA512

                                              b24b6a4c9c9d368623db8f2fef1c4411a95d1b31075c1b205f635b6ed11b6f5b20bc57aa1f2b006525a437573433cc853e7fed2cdc34363dcfc654fa5ca4b0cf

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                              Filesize

                                              5KB

                                              MD5

                                              706de7abbcaaa49f407dcf3cd649aadc

                                              SHA1

                                              5acfcaed2df925b5671eda42c478f31f66e14632

                                              SHA256

                                              dc7fe1d9929ba7ef6c0996328bc4c1f15c2a14309b925b74cb00b6d67a3d1309

                                              SHA512

                                              97a2559695112e866a38e1e59bb0f81c29d33a1f01d0a75b1f58ac2978e7d776634026eea0c5d91ffb43680c33d882a8495fc0ef06af4ae1edf922f83a0fb8bf

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                              Filesize

                                              12KB

                                              MD5

                                              2e6717f04a9d9ef3e21aa1ae9d786dfe

                                              SHA1

                                              759e1f129aac5ad0f60a8455ed71732c1d68faff

                                              SHA256

                                              a7f930fa0bfaa206b0db147619b45b05c1e59d09660f53c3e81c9eef9e4aebec

                                              SHA512

                                              7e0828ff32ee8c3ce8511b20d56d5f7318c89a4a841a8576d6b6474121cca12711a90258be26b80465119c572db5ca39238f201ea2de50c858d8faad911e794d

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                              Filesize

                                              291KB

                                              MD5

                                              b08c311ca5e1f4127162dea568fd471f

                                              SHA1

                                              aa281870df58522a177ba535674f49bc433e3826

                                              SHA256

                                              bfedebe9d9ca37faa8b4465e64d1bfdf92375ff4d4140affcb6f9ce9a3cf7d58

                                              SHA512

                                              0d90e3a81ff5f43bd52012607da67e7311d36143ce18d7d7b306feba34e9621d3235091ffe67b81b09a822bb04d13208a7519658dd5a84a96152b2beb0fbfca2

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

                                              Filesize

                                              264KB

                                              MD5

                                              f50f89a0a91564d0b8a211f8921aa7de

                                              SHA1

                                              112403a17dd69d5b9018b8cede023cb3b54eab7d

                                              SHA256

                                              b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                              SHA512

                                              bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                              Filesize

                                              2B

                                              MD5

                                              99914b932bd37a50b983c5e7c90ae93b

                                              SHA1

                                              bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                              SHA256

                                              44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                              SHA512

                                              27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OHP8MVFQ\edgecompatviewlist[1].xml

                                              Filesize

                                              74KB

                                              MD5

                                              d4fc49dc14f63895d997fa4940f24378

                                              SHA1

                                              3efb1437a7c5e46034147cbbc8db017c69d02c31

                                              SHA256

                                              853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

                                              SHA512

                                              cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YII18RLT\tag[1].js

                                              Filesize

                                              216KB

                                              MD5

                                              bfdeae2b9430db381d45a07b8c1cfd48

                                              SHA1

                                              3d11c35d6d8e90a7693762038003b35791fda3c8

                                              SHA256

                                              9f58a36f283dccfda7fd4789fbe86ff00f4248cfb427027aab18767799a61c35

                                              SHA512

                                              5ab3cf0a775b359e4603ae85fec4318eb3c520020f2531a2ce88ed2708ce431378ec71d6c0f28f44de4e63df6da50e9ffcf71dcce73e01b45406ee6c3c3fc612

                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\64KV0CFZ\tlauncher[1].xml

                                              Filesize

                                              357B

                                              MD5

                                              a6466190abcc25407142c8181539da89

                                              SHA1

                                              81fccd84b5346c9a5514232d9653547f53450a7c

                                              SHA256

                                              0c407393b7bca7000c2a6fda6ead117de70c5ef389a2bb91c16fa14ec6cea338

                                              SHA512

                                              1b6e3f3707861e3f764631307f42cecf4935d4233120a734adf638f9dea88cd14e0d5e56ca91ae3916ec3df4676896b9411c534ced77d8c3d5ac844ab77a3cae

                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\64KV0CFZ\tlauncher[1].xml

                                              Filesize

                                              515B

                                              MD5

                                              9a821989a8cf6621ac4f09d08b5cf7d9

                                              SHA1

                                              b982bf826a2129c6cf1ca5c226757d36fb71d73c

                                              SHA256

                                              11afd85c6ff95dfb01b482a8fc6327a9395aa1dec081d9faefea4aa8b3f68a88

                                              SHA512

                                              755eb7e4538e2173aed9e9d9d8aa48d798a3bb8ef7984a27dd0da07449d952f2609b9b1c9785803c7d589f07f2cb53d2126e9a7607a67f8ed20af329e8d2b494

                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\64KV0CFZ\tlauncher[1].xml

                                              Filesize

                                              1KB

                                              MD5

                                              d9ceccf148295b62f13fd122f93d053f

                                              SHA1

                                              0ce4763c9c146c970485832263390cfd3da8bfe7

                                              SHA256

                                              ca5f9805f9c5594658d088d8130f483f778e09ce778fc29ab98b20047ddf532a

                                              SHA512

                                              eba9ae20af89ecd7e56c0368ec2befbd736f0e0f9f767d009173e5d2f9bc88efad152eb15a50fbbd2b1cf48943b718040d39b7c6ef4e1d402b74829a56e61c52

                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\64KV0CFZ\tlauncher[1].xml

                                              Filesize

                                              1KB

                                              MD5

                                              7049b4e174896c844d8a4739df097b79

                                              SHA1

                                              4ea608b0147bf908352017d6d14a2a95a115fe81

                                              SHA256

                                              799726e3bab48eef75a03bf85596427ed1114b512ace05ae1f5b66cfc2d91c54

                                              SHA512

                                              ac2e862ea55b3a1f73702c5915ac29ee5a21b235adc21901bf5e1a2c75d21eff4fbe9daeb3fd42fc864487d4995632ba6d547562ac7172d7fd797ac3959f9e69

                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\IY08M0IB\suggestions[1].en-US

                                              Filesize

                                              17KB

                                              MD5

                                              5a34cb996293fde2cb7a4ac89587393a

                                              SHA1

                                              3c96c993500690d1a77873cd62bc639b3a10653f

                                              SHA256

                                              c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

                                              SHA512

                                              e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\P0JFXRVZ\favicon-32x32[1].png

                                              Filesize

                                              652B

                                              MD5

                                              316cf4ceba9e30859b1d1e4664431d3e

                                              SHA1

                                              12a6d3b9b2b706ea7a1f9184e91dcbdee40d2bce

                                              SHA256

                                              83fdf17b337fd136e3983ed9f5b562f11a25fa312d4da7f1748e3cde659110b4

                                              SHA512

                                              f2e5e37f830f6d7b47792baf51dafbdee739e1c0c1f87db3562a15f01bf809a9c38e27ba37d5489697b0328066b722f134ba30d308a371feccebd798dd722b03

                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF14FF6677F8358BA3.TMP

                                              Filesize

                                              16KB

                                              MD5

                                              a12106b95737b1a0f2e82c01298e0f0d

                                              SHA1

                                              1ea0cec0a98d7178ac6ca040fc7a81bdb78b978a

                                              SHA256

                                              76fbb4c55adf8936a2326c7369d5e43f8f580c04ad90d2c1ac818229e7cab81d

                                              SHA512

                                              2eb1837557edbf677c1741815c1a1c84f493a086468381e60fab693cf6b7ead2333396e8cf060bec47aee5cc555302e20888d1c7dbfcc056a330cb399c55b0ec

                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\TLauncher-Installer-1.4.9.exe.psf0yf3.partial

                                              Filesize

                                              24.1MB

                                              MD5

                                              79673d0cd668ac6e4ecfc7dcc4db5b23

                                              SHA1

                                              0a576f857765e759f582126f099b0c04c6c6349e

                                              SHA256

                                              8535bf7f8914c54823a1b57e5977c84add0caebfc967567dcf13f8fd843b8b1d

                                              SHA512

                                              a9d1c9d47cf67bf80a60c6250cd84151551e549a1ff179faa62381260d03d531dbd5b1df2bc83a43f71ab5a699aaf593ba6606416e3c8957b6c2fa8e3863f8c9

                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YII18RLT\TLauncher-Installer-1.4.9[1].exe

                                              Filesize

                                              223KB

                                              MD5

                                              f374afd61825134188a5edec8cb6d4df

                                              SHA1

                                              f2e9ca2d5bc464aa3f7a75d85f3487c55b7354d6

                                              SHA256

                                              cb9f0e5aeb2e81e088013f0a74a13fc355732a7a3ab2c3878872ca7ddceff16a

                                              SHA512

                                              c180e45eb16adeb06c59e06e8669aad36fe3b415c95bb91898aab883b94eb9c9d2cef529d17351bedf20c7deffaecf5c95229fff18b621592c49e93e91a6eb72

                                            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico

                                              Filesize

                                              116KB

                                              MD5

                                              e043a9cb014d641a56f50f9d9ac9a1b9

                                              SHA1

                                              61dc6aed3d0d1f3b8afe3d161410848c565247ed

                                              SHA256

                                              9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946

                                              SHA512

                                              4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

                                            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe

                                              Filesize

                                              1.6MB

                                              MD5

                                              199e6e6533c509fb9c02a6971bd8abda

                                              SHA1

                                              b95e5ef6c4c5a15781e1046c9a86d7035f1df26d

                                              SHA256

                                              4257d06e14dd5851e8ac75cd4cbafe85db8baec17eaebd8f8a983b576cd889f8

                                              SHA512

                                              34d90fa78bd5c26782d16421e634caec852ca74b85154b2a3499bc85879fc183402a7743dd64f2532b27c791df6e9dd8113cc652dcb0cdf3beae656efe79c579

                                            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG49.BMP

                                              Filesize

                                              1.8MB

                                              MD5

                                              5c9fb63e5ba2c15c3755ebbef52cabd2

                                              SHA1

                                              79ce7b10a602140b89eafdec4f944accd92e3660

                                              SHA256

                                              54ee86cd55a42cfe3b00866cd08defee9a288da18baf824e3728f0d4a6f580e7

                                              SHA512

                                              262c50e018fd2053afb101b153511f89a77fbcfd280541d088bbfad19a9f3e54471508da8b56c90fe4c1f489b40f9a8f4de66eac7f6181b954102c6b50bdc584

                                            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

                                              Filesize

                                              1.2MB

                                              MD5

                                              f3b300079862aff353b412d490bf5abc

                                              SHA1

                                              b61ad13daa7d39a02aa1329788ece0737390a45d

                                              SHA256

                                              c052cb74d9b0ce37efba9c018b5bcf74c51cfbdcaf990ae53cb9772ea318945a

                                              SHA512

                                              d6e02701ec0990fd9a4b0e82ce69048a35ac114e7515ed2ed6a445ec9f8ad9f98287491e087a269b3e973fb55da360e2df1a516a9fa850c68cfcfaadacb2fbb6

                                            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

                                              Filesize

                                              325KB

                                              MD5

                                              c333af59fa9f0b12d1cd9f6bba111e3a

                                              SHA1

                                              66ae1d42b2de0d620fe0b7cc6e1c718c6c579ed0

                                              SHA256

                                              fad540071986c59ec40102c9ca9518a0ddce80cf39eb2fd476bb1a7a03d6eb34

                                              SHA512

                                              2f7e2e53ba1cb9ff38e580da20d6004900494ff7b7ae0ced73c330fae95320cf0ab79278e7434272e469cb4ea2cbbd5198d2cd305dc4b75935e1ca686c6c7ff4

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\datareporting\glean\db\data.safe.bin

                                              Filesize

                                              2KB

                                              MD5

                                              230c1a45a46b08a7ff6f22b7d20587a0

                                              SHA1

                                              4bcb6a8f3d3a1e55fa62e09f1f365643f40d840d

                                              SHA256

                                              aadba15cfa5f1e2aa4bc96a8574e634c04e02a06b7f52eaaf0854e0913bdbe02

                                              SHA512

                                              7236d3f5061db9a17a999adee52da0f7baeb107d39d542cea612f8dca0cca595425771a857cdca0d84450c41b10fe90f6a52dcadf2c0ee4178dc861da1d1802f

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\datareporting\glean\pending_pings\6f422f9a-aa4e-432e-aefd-5251fa1fcc79

                                              Filesize

                                              10KB

                                              MD5

                                              aca381a09a5463479d3ad7ca870bafd9

                                              SHA1

                                              f5b9cfa7011f405e60a290a60d2a7de8b317fafb

                                              SHA256

                                              93eba6154ec5c6bba299a96f8f5e82898a321ed3612745c84a299b3245277ac2

                                              SHA512

                                              3a57cfea3ce9eb7c3e833342f54db77d8ac4ac8d91ac78a6047dd20babbc0f4787eaf8818183df538cb1dcd2613fc10116a85fb0d135791e02aef8ec657f738f

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\datareporting\glean\pending_pings\bdb1647d-1e82-4109-af54-611d67286d23

                                              Filesize

                                              746B

                                              MD5

                                              211dd4a0c36b2cddf49981938e3a88b2

                                              SHA1

                                              29c359e2393306b630a4bf78f41dd83a575bd5f5

                                              SHA256

                                              71b1c4a2949dc9a6d31044c02820e589550e05a1b8cfae497ad45004e1829c75

                                              SHA512

                                              4aa42de7930d5ae2a8b6cf3ccc095b0ea32c13ff85ba4f30a45a7243f83f350d9cf094594ec6f148a4f0b55dbb2468df19fe1dd38272de4098bec831d0e49bbb

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\prefs-1.js

                                              Filesize

                                              6KB

                                              MD5

                                              c03d64c2c780469d602a6a96d297d47c

                                              SHA1

                                              d278c0960aa5469d0756f409941816a8b62b8db3

                                              SHA256

                                              15a4487d2bf853e5ed648ee535e170c70cb12621ae48eccb8a4170783a7c28f1

                                              SHA512

                                              dbd29f78b6494819d52260084b5bf36612f76df155b278048ff85788e13881ac8beb091ce0fa6423635be5dc98e3286d6659f23f07c97b489fb5912c07147cde

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\prefs-1.js

                                              Filesize

                                              6KB

                                              MD5

                                              1040807dc00f23c04e021b7e0f23ac6f

                                              SHA1

                                              5c791ee23e659903ca96e1af52bdd947b59038cc

                                              SHA256

                                              8d20590bb1430f28438a7db13b696185499cc25ae3f8d2d813619c1efec88f6e

                                              SHA512

                                              21f29e1e89e25f2997c767627e2c311da7a0375790b99c32d2573d611e3f49e2f54e1f7d397be195ae72b9794fee2d135cde393223293a4cbe00f108d7c16399

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\prefs.js

                                              Filesize

                                              6KB

                                              MD5

                                              8af3d255eea50837c8b8215e8362f46b

                                              SHA1

                                              80d4721a8b85cfe9c2566514b579bbbdf613dbd0

                                              SHA256

                                              498dea046bf34dde2066cca19265d6d0144ae0b76f3590a5e12e4224185b52e1

                                              SHA512

                                              a179ffc41f1b7450a96bb87194bd9d23c6bdd066b04b06949f3f07cdf935edc47f0a56963bcbc8b1155f1f2a0fee7d88c404a9dc8e1e7ad4cb5a399927320bc6

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\sessionstore-backups\recovery.jsonlz4

                                              Filesize

                                              4KB

                                              MD5

                                              a25737e938735fc253c1d6da23de435c

                                              SHA1

                                              0f77c0b40d80b74c5cb19799dd8ff6e02c1b9afa

                                              SHA256

                                              de670296b0c4cba63c7bedf7fcfc3fb2d1beec9de17c2866a3f8927ce9d906d5

                                              SHA512

                                              21fde33b67381ea1792c745d913482afa6851c3047dafdb117bf335c55f789ea08574db2fd63c07ce8987e46a434393692b91d5b90581f62849c68d97d2068a9

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\sessionstore-backups\recovery.jsonlz4

                                              Filesize

                                              3KB

                                              MD5

                                              843f217434f2795b6d5bdf6267f48015

                                              SHA1

                                              a0c09e902141ebe5099cdb81ac03fac9e4ac7c6d

                                              SHA256

                                              7b5771852d212c0c5f841c74c50c9cc5f83c6cf83b6918f78498517f4a644bd2

                                              SHA512

                                              1cecf2fafeb4a7c65fd3e29625b750a88d7c9e7d9006b0e7c068c7c648dac0a099fcfc31674881602aa3d07a0f0c561ac9f6ff92184d133cb86b6b94a0814219

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\sessionstore.jsonlz4

                                              Filesize

                                              4KB

                                              MD5

                                              7c40c6f6d24ae9869f5bf468855e2df7

                                              SHA1

                                              64849eb52ca6b4139cf73ad0c94aa8c9d3ee09da

                                              SHA256

                                              ca4657b97ec69c53843c34eaa89f2e01a40d2d8e38b384ad4db1800542e2be8f

                                              SHA512

                                              300984fbf3ab4bf2673bfd96dcfac3e9c2fd23d9ff6bf9f892dee3a5e1ef7faaf809c47f6f15ef5b37215ec55d91bc33c0b5b70d1f58da00895d9c13abe33a40

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                              Filesize

                                              184KB

                                              MD5

                                              3018d1aad8385b734068dbad441e344e

                                              SHA1

                                              2a3925bc92ec843db64b6db2cd6fe18ccf084a86

                                              SHA256

                                              f33415b0b1fc8c7e52356318d44aef1ae6bd9c64a89afa012d43a01a79954f88

                                              SHA512

                                              7ab1a1115a4f7ac61ba41bfe5875792cfa84d81f14f71239e43848de5940bfa07e2e34ea4be85a61c091d0b4b7742f3f55961fd26734b528cdb2c0b4d169c5e0

                                            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

                                              Filesize

                                              1.7MB

                                              MD5

                                              dabd469bae99f6f2ada08cd2dd3139c3

                                              SHA1

                                              6714e8be7937f7b1be5f7d9bef9cc9c6da0d9e9b

                                              SHA256

                                              89acf7a60e1d3f2bd7804c0cd65f8c90d52606d2a66906c8f31dce2e0ea66606

                                              SHA512

                                              9c5fd1c8f00c78a6f4fd77b75efae892d1cb6baa2e71d89389c659d7c6f8b827b99cecadb0d56c690dd7b26849c6f237af9db3d1a52ae8531d67635b5eff5915

                                            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

                                              Filesize

                                              97KB

                                              MD5

                                              da1d0cd400e0b6ad6415fd4d90f69666

                                              SHA1

                                              de9083d2902906cacf57259cf581b1466400b799

                                              SHA256

                                              7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

                                              SHA512

                                              f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

                                            • memory/500-352-0x0000027D821B0000-0x0000027D821B1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/500-0-0x0000027DFBA20000-0x0000027DFBA30000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/500-351-0x0000027D82190000-0x0000027D82191000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/500-35-0x0000027D80530000-0x0000027D80532000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/500-16-0x0000027DFBB20000-0x0000027DFBB30000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/3188-1260-0x0000000000B80000-0x0000000000F69000-memory.dmp

                                              Filesize

                                              3.9MB

                                            • memory/3188-1300-0x0000000010000000-0x0000000010051000-memory.dmp

                                              Filesize

                                              324KB

                                            • memory/3188-1222-0x0000000010000000-0x0000000010051000-memory.dmp

                                              Filesize

                                              324KB

                                            • memory/3188-544-0x0000000000B80000-0x0000000000F69000-memory.dmp

                                              Filesize

                                              3.9MB

                                            • memory/3452-284-0x000002309B770000-0x000002309B870000-memory.dmp

                                              Filesize

                                              1024KB

                                            • memory/3452-460-0x000002309ACD0000-0x000002309ACD2000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/3452-442-0x000002309ACB0000-0x000002309ACB2000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/3452-440-0x0000023099800000-0x0000023099802000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/3452-436-0x0000023099350000-0x0000023099352000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/3452-438-0x00000230993D0000-0x00000230993D2000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/3452-434-0x0000023099340000-0x0000023099342000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/3452-410-0x00000230991B0000-0x00000230991B2000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/3452-348-0x0000023097B40000-0x0000023097C40000-memory.dmp

                                              Filesize

                                              1024KB

                                            • memory/3452-327-0x000002309B1F0000-0x000002309B2F0000-memory.dmp

                                              Filesize

                                              1024KB

                                            • memory/3452-307-0x000002309AA30000-0x000002309AB30000-memory.dmp

                                              Filesize

                                              1024KB

                                            • memory/3452-288-0x0000023097A00000-0x0000023097A02000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/3452-296-0x0000023097CA0000-0x0000023097CA2000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/3452-298-0x0000023097CB0000-0x0000023097CB2000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/3452-294-0x0000023097A20000-0x0000023097A22000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/3452-291-0x0000023097A10000-0x0000023097A12000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/3452-285-0x000002309AA30000-0x000002309AB30000-memory.dmp

                                              Filesize

                                              1024KB

                                            • memory/3452-253-0x0000023099BC0000-0x0000023099BC2000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/3452-243-0x00000230998E0000-0x00000230998E2000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/3452-247-0x0000023099920000-0x0000023099922000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/3452-249-0x00000230999E0000-0x00000230999E2000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/3452-245-0x0000023099900000-0x0000023099902000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/3452-241-0x00000230985E0000-0x00000230985E2000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/3452-230-0x0000023097B40000-0x0000023097C40000-memory.dmp

                                              Filesize

                                              1024KB

                                            • memory/3452-58-0x0000023086700000-0x0000023086800000-memory.dmp

                                              Filesize

                                              1024KB

                                            • memory/4032-45-0x000001AE11500000-0x000001AE11600000-memory.dmp

                                              Filesize

                                              1024KB