67aa43456e09b095e95ad369ed81e5eb5ada1007fb002bcbbdf02133617402ca

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/08/2026, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
launcher-1.09_17.exe
Size 746KB
Sample260809-epdcpstvbw
SHA256 67aa43456e09b095e95ad369ed81e5eb5ada1007fb002bcbbdf02133617402ca
MD5 0fbc764e8da59c3d86513a39a4d4c260
SHA1 41150deef0b46d0dc8c864464910b533c86bbbad
SHA512 863eb404cec3c4c9b3f0041d1d7a2609fd6df20975d95eeb9499d23bc01f90452cdaeb01784c42116d8d58dc945e8e6f2eec19fcb97e046d6174baddb511f5c7
SSDEEP 12288:fuvaO9Es/ZxNwsooperNotmRcWT43YQFXdQXXXfyMKJ+n8M1bkc:fuvaQ/DNTqoPWkYQ9EaSnvN/
TLSH
T188F40153F09628AEF53B87734051A22338BCB1FED04B60296AF5119B7D77C896F16398
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Loads dropped DLL 3 IoCs

pid	Process
856	java.exe
856	java.exe
856	java.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	checkip.amazonaws.com

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4756	GameBarPresenceWriter.exe

Drops file in System32 directory 16 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_585900615f764770\usbport.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\usbport.inf_amd64_585900615f764770\usbport.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_702fdf2336d2162d\input.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_5ab7d1c25144fcab\msmouse.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\msmouse.inf_amd64_5ab7d1c25144fcab\msmouse.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\machine.inf_amd64_726cea1f0f349cf7\machine.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_8207ba80cf22e40a\hdaudbus.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\hdaudbus.inf_amd64_8207ba80cf22e40a\hdaudbus.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\input.inf_amd64_702fdf2336d2162d\input.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\keyboard.inf_amd64_cc6edbde0940344f\keyboard.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\mshdc.inf_amd64_84ea762c0a90c362\mshdc.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_726cea1f0f349cf7\machine.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_cc6edbde0940344f\keyboard.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_84ea762c0a90c362\mshdc.PNF	dxdiag.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1928	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	launcher-1.09_17.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	dxdiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	dxdiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dxdiag.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies registry class 47 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\VersionIndependentProgID	dxdiag.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{7E17CB29-F089-4879-AA04-59A2ED1ECA95}	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID\ = "DxDiag.DxDiagClassObject.1"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\ = "DxDiagProvider Class"	dxdiag.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\discord-939918927989973052\shell\open	java.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove\ = "Programmable"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ = "C:\\Windows\\system32\\dxdiagn.dll"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}	dxdiag.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{A22AC2E0-3F9F-4B8C-A9DB-E5CA9583173D}	dxdiag.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\discord-939918927989973052\URL Protocol	java.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{F1BBC14F-8FBB-4E0D-B9B6-1B72F885B0B9}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\ = "DxDiagClassObject Class"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID\ = "DxDiag.DxDiagClassObject"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CLSID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	dxdiag.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{4DFF4EAD-8BEF-4E48-A13F-0FF78F16460E}	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer\ = "DxDiag.DxDiagClassObject.1"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\ = "DxDiagProvider Class"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer\ = "DxDiag.DxDiagClassObject.1"	dxdiag.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\discord-939918927989973052\ = "URL:Run game 939918927989973052 protocol"	java.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\discord-939918927989973052\shell	java.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\discord-939918927989973052\shell\open\command\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\java.exe"	java.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer	dxdiag.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\discord-939918927989973052\DefaultIcon\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\java.exe"	java.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ThreadingModel = "Apartment"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\ProgID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\InprocServer32	dxdiag.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\discord-939918927989973052	java.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\discord-939918927989973052\shell\open\command	java.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\ = "DxDiagClassObject Class"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ = "DxDiagClassObject Class"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\CLSID	dxdiag.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\discord-939918927989973052\DefaultIcon	java.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}	dxdiag.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2428	dxdiag.exe
2428	dxdiag.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
5708	javaw.exe
5708	javaw.exe
2428	dxdiag.exe
856	java.exe
856	java.exe
1824	OpenWith.exe
856	java.exe
856	java.exe
772	OpenWith.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 5708	2192	launcher-1.09_17.exe	80
PID 5708 wrote to memory of 1928	5708	javaw.exe	81
PID 1928 wrote to memory of 2428	1928	cmd.exe	83
PID 5708 wrote to memory of 4564	5708	javaw.exe	86
PID 5708 wrote to memory of 856	5708	javaw.exe	88

C:\Users\Admin\AppData\Local\Temp\launcher-1.09_17.exe
"C:\Users\Admin\AppData\Local\Temp\launcher-1.09_17.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\launcher-1.09_17.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5708
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C dxdiag /t C:\Users\Admin\AppData\Roaming\.betacraft\launcher\dxdiag_report.txt
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1928
  - - C:\Windows\system32\dxdiag.exe
      dxdiag /t C:\Users\Admin\AppData\Roaming\.betacraft\launcher\dxdiag_report.txt
      4⤵
      Drops file in System32 directory
      Checks SCSI registry key(s)
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:2428
- - C:\Program Files\Java\jre-1.8\bin\java.exe
    "C:\Program Files\Java\jre-1.8\bin\java.exe" -version
    3⤵
    PID:4564
- - C:\Program Files\Java\jre-1.8\bin\java.exe
    "C:\Program Files\Java\jre-1.8\bin\java.exe" -XX:HeapDumpPath=java.exe_minecraft.exe.heapdump -Djava.util.Arrays.useLegacyMergeSort=true -Dbetacraft.resize_applet=true -Dhttp.nonProxyHosts=api.betacraft.uk|files.betacraft.uk|checkip.amazonaws.com -Xmx1G -Dhttp.proxyHost=betacraft.uk -Dhttp.proxyPort=11702 -cp C:\Users\Admin\AppData\Roaming\.betacraft\launcher\betacraft_wrapper.jar;C:\Users\Admin\AppData\Roaming\.betacraft\launcher\discord_rpc.jar org.betacraft.launcher.Launcher wrap hello - - - - "default instance"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:856

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:4756

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:1888

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:1960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 1063d8b431a04de8a0dc69153bb5ed8af065d83dfb7a2d6569cc51409f100340
MD5 ed7e68b640054f88cba3aef64c276c48
SHA1 5936995177c7200d2c2294c23c72bd92d5603b50
SHA512 b67e394bbea03e466c74070508ab6d2c700a913f240851f44639b364a4948448b8cfa3fa64e607700d47f052dafb21b752e2d6e9195cfec7e988abe35623dbc8
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 73c9e52778d062cd989788589ab720936e7cfeae71d919c25512492d29b61a08
MD5 6bc633387c66c961241b8b87e9390c88
SHA1 b5c80f8d581075fd369691cbdf3eeb0d999abdf0
SHA512 f7c1d959acf4600362e0a91cfb9e681e2da6d13ba0d65fce073400d3c4f4974898c978108ca83203436256c9f0e0ad7bb439a97b8e2ff7110edb2d4d0e99d0d9
MD5 SHA1 SHA512

Submit Download

discord-rpc.dll

Path C:\Users\Admin\AppData\Local\Temp\drpc550366199500\discord-rpc.dll
Size 390KB
SHA256 5cc2e504800cf4ed2f4781364f661ea22349658ddc391b5d54195e573109d87b
MD5 5882c37b79bae47a0d090006564edb22
SHA1 ac7bbbdb1d34eb763d8db4ef7875a50f700e9d48
SHA512 d4a6a1a36842dd1c8b2162168807b990e0d491a908e11b52ebf11174a67f818b131607c2122dbb484f5d946418a05a1a84d42e1468bef5c98ec3fcff7d225ccd
SSDEEP 6144:TnQCrLe2xJLChxTC+LxTYXrHJZ5upQtXsK+62C3wh+0U1c5xrunBLko:TnQCrLXxgvU7v8ph7+0kHB7
TLSH
T12C847D5AFB6448B5D0679135C973864BE3B27C891B70D78F23A8439A2F37BA1453E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jna775217565037542055.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna775217565037542055.dll
Size 240KB
SHA256 0525f9e2db0146f7abcc8cd86cf4fb01721fad0d5c9a1806b5805bb789eb8c98
MD5 1164914ca1307de98cc0d57e42285ef2
SHA1 9387f983c88c425c91e5caae2409cf4180b02096
SHA512 7fbb98c3768e22429ad39070fd2fdbf38d9585e81df592d7fb64cdc03e890d6ce57a72bafbc8815ace9076e5241cfb77d8c23ff1db66ba7564131506d487dc5e
SSDEEP 6144:ONdFEp41M0A9mAkXZdHlLm1Rq6Y+S4Dedhx3U3YfHy0o8N:2FEG1jQRA+SQOI
TLSH
T114342907F7B248E5E8B7C03A49136A12F57278194320EBEB47858B535F66BE09B3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinput.jar

Path C:\Users\Admin\AppData\Roaming\.betacraft\bin\jinput.jar
Size 226KB
SHA256 ce27de713e36a72a89e9495861c8265b0f81069366567c1c5c69e7d2ede58c89
MD5 e41a078a1f6cae716215235fbf0b5689
SHA1 a91a5631d319c8f50851b731c435cf66eb1d1e7e
SHA512 6a2e6adf035eb6d99bbe69dbda7d84cbdce5ef95ad3751731a5b564928a43306deec8799af8e5abcbb9decfd8cb50c2196098787f1373bc274ddc80852a3a2f1
SSDEEP 6144:39U+yLUxpmoMxD8nobRwNXiBkZZuUGT89bZZ:39U8xIb/m8BkvuUR3
TLSH
T1EB34CF276EAA8529F223C3320991A2D6FC2C95A45C0B926F7071C49D78B0D4617DBFDF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lwjgl.jar

Path C:\Users\Admin\AppData\Roaming\.betacraft\bin\lwjgl.jar
Size 1.0MB
SHA256 3751d0003f4c9c94075a362b03385357140c111dc5d3ffe2fd7c969bf421633e
MD5 980065fb23b1f8aab432cb5ee9da4f23
SHA1 d04e9dc91396d49f5d849277365f821ced845d94
SHA512 948262452fa5ea31016b314730c191966b8cf79c0740151fbadcff415b265f1d3a82470ff5c526ebf2058f8a3fd6dea71c207d77ec152fa0a82552b27637c66f
SSDEEP 24576:q6xwM053tw8NvDXbDkrl5QWZPBMOb6MDGDxsLJIMLQI:Litw85krlyWdBVbKxs9Is
TLSH
T17C25F123DCE7902AFD27413944932B3A741D37ECD886899017AA1BC2B5778A5FB27734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lwjgl_util.jar

Path C:\Users\Admin\AppData\Roaming\.betacraft\bin\lwjgl_util.jar
Size 183KB
SHA256 79780bf0034ce3483881728ff98c27f5006558dcb88710a564b670cf5bf045cb
MD5 0df9866d92e0f383c4753b28a80dd7aa
SHA1 6a147878f2d2675fe103f8bd0abee580f722b8a6
SHA512 364b79a3e5d6240fe5b28c2d16c0758403e45f6e88e88ba3c5e456c5c70a97c9fa8f6abff70b6309ca852c7f794d09afe89afcca968830121afd12f144772540
SSDEEP 3072:VaxteT4eaxYCGjZRn99oNlByzPRICdDGjl+LCKhhUBg1KVQEGCN:Vaxtm4eaulfCNlcOCdDpO+hUBIadGCN
TLSH
T1D904DF41FDFBFA3DE207813901838792653AD384A9E9E0B788D48656CAD4C964F437ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lwjgl64.dll

Path C:\Users\Admin\AppData\Roaming\.betacraft\bin\natives\lwjgl64.dll
Size 310KB
SHA256 094c38a9b6b9ab76e3730838d542419811e63de5d4a4ba5a22d83f6edd803943
MD5 73cb2a967d771c65bc46c543f61a9898
SHA1 0ef71be40bac0a5213b1a5c38739b1610ab311e6
SHA512 1fa057fe5739f1ba457e0b95f01c1a378469fcb4944453bbd5b335281dbce882e730b601fa1e6053860053fdce2a6bd7f72342b6e9d8b6bf1f75a49af59662e8
SSDEEP 3072:by6nSomUPQukwpSor62AIiGYIR2LGPHc0Ul+S4KQIw6tqYKVFlCh7NZqSEgbh:bciFkwpL2DI0yPHqw6tVKYr
TLSH
T1A2642363EF27C47AEE4B323944C00875721C74A01A5563C7261CEAC6B5DE7B487A6F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

betacraft_wrapper.jar

Path C:\Users\Admin\AppData\Roaming\.betacraft\launcher\betacraft_wrapper.jar
Size 746KB
SHA256 67aa43456e09b095e95ad369ed81e5eb5ada1007fb002bcbbdf02133617402ca
MD5 0fbc764e8da59c3d86513a39a4d4c260
SHA1 41150deef0b46d0dc8c864464910b533c86bbbad
SHA512 863eb404cec3c4c9b3f0041d1d7a2609fd6df20975d95eeb9499d23bc01f90452cdaeb01784c42116d8d58dc945e8e6f2eec19fcb97e046d6174baddb511f5c7
SSDEEP 12288:fuvaO9Es/ZxNwsooperNotmRcWT43YQFXdQXXXfyMKJ+n8M1bkc:fuvaQ/DNTqoPWkYQ9EaSnvN/
TLSH
T188F40153F09628AEF53B87734051A22338BCB1FED04B60296AF5119B7D77C896F16398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

discord_rpc.jar

Path C:\Users\Admin\AppData\Roaming\.betacraft\launcher\discord_rpc.jar
Size 2.0MB
SHA256 619500b324fcadc52b9e2319585934179b69e21589f34858cc31d7d6e2442eac
MD5 d75aa9aec06d3d536cc1229d21db46a9
SHA1 93c0f6aee918cc3a41baf36a90020d537d1eb1ba
SHA512 af8b37a56c906b1850385b80e40173928e792470faec5aed5d5c18e09c9d70235863449f650cbf1c1b542fcebf9e16964ab6ba90a82bba84be7b993db525576c
SSDEEP 49152:zkwTKERBhO88JnDqCTE+tAP4nkRCeaRPC+aGo/CP:zjeEXSBVT2BAXRPC+aTCP
TLSH
T1DBA52357FC5A811DCA27D5F732CF4B86AE165669AF116CED02FC092448829C307D3BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxdiag_report.txt

Path C:\Users\Admin\AppData\Roaming\.betacraft\launcher\dxdiag_report.txt
Size 84KB
SHA256 f29ce4161ab11f2edf530ec598f6e8ce9cab85394fe300143e187713b2590a23
MD5 a69ba770cde35413a4f72b96a2589aba
SHA1 e40d3e9a398883f39000affacfa120e9ab0b17ff
SHA512 7c867c39703a29bbe958ba7cecde85f9678996b862f9a64259922aff18c12a91520c6395ac092a0a67f39a1c88a844b05658cf5579163d2f2a7c298491fc33c9
SSDEEP 768:8XMU/VUvndCwzcCotHC9pBM8nKuj5nUovxlG0C14JkNEr+aL/F/JOlKwY0:8Tf6ljIV14Ou0
TLSH
T1A98398F96C51C454F051C15662787625DA2D34D320EA8DAD3ABCEFC90F22DFAE238E52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default instance.txt

Path C:\Users\Admin\AppData\Roaming\.betacraft\launcher\instances\default instance.txt
Size 298B
SHA256 6c3a1016d00413d7eb62445cf6ad2073588f5ba7365faf96b02366b2c05aec8d
MD5 0ebcbd44a64f9ed2f376e5cba8ac25f3
SHA1 c946703eb437485401ee6634d27a6adb8df25011
SHA512 52189fe9767478b5902a4c5156b7383cf3dfb9b9e0ef4e53fbaacf1fba4a20680eb77819cd92c5858a687e2a8fbf89c94089a0ea4a0fb9f27e8b01bd8ee8b316
TLSH
T1F1E0C220FFA2E86EBC7516818B60395602B39FA9321A75B5DEAC01CE79832096450857
MD5 SHA1 SHA512 TLSH

Submit Download

English.txt

Path C:\Users\Admin\AppData\Roaming\.betacraft\launcher\lang\English.txt
Size 36B
SHA256 2b6a86fb912cf4d4a5e31f6792d85657615db3d853fb8babffadcb69dd8f4df0
MD5 6669d7a6e0e6b3ed8df4c9e58bcbf889
SHA1 1759adc237ce6888508d964e746f57838946ae95
SHA512 9f575cfe707ebeadd592eb9f65919cea2ce870b074257c659973758d606f33a3169a0abd428b8e646b3469989e714da5d2807b74be6dd233b4e5e27b7ff1c118
MD5 SHA1 SHA512

Submit Download

launcher.settings

Path C:\Users\Admin\AppData\Roaming\.betacraft\launcher\launcher.settings
Size 127B
SHA256 1316aad9ccc6fadb756ebcf168a9c285d5032612b82ac5f10040071ab0fee2df
MD5 422a1ded941591e8690fee28db6adc6c
SHA1 7967510ec7aba79d96c346265788acfecb5f805e
SHA512 0fb9055c130eeb4436f7ed39516c532cf403bb33b259c6b8ed7f11a9aae3109a27651c42d18a49f1939662dafcb519a731c4eb324f83e45ef0fbe97fbaa670d5
TLSH
T138B0921A6B20E9AEAA188282215078955BF2A158E02228A05C8E070AD3EB20D829B567
MD5 SHA1 SHA512 TLSH

Submit Download

in-20091223-1459.jar

Path C:\Users\Admin\AppData\Roaming\.betacraft\versions\in-20091223-1459.jar
Size 1.7MB
SHA256 b2ac572f81a5ca1e2bdccc1216e7706863ea15eea311ab1f6bb7cced8aa84639
MD5 389646315d5a70fbcaa658668023432f
SHA1 94ee2e7aa7d093fa8dfc684baa8bd8afe002580f
SHA512 df451757c5fbd09eb626053d42bcfb5022c4552b96e110d0e673db6f895675fe964f6700bdea4569690b93cc4b6200783bbfe67752be901d10272882c668dbeb
SSDEEP 49152:+ig7ZVuhz9/Qxi7U2Nowcy3DyWoK31tz69:+ig7ZIhz9/cD2Nowcy3Dyxyju9
TLSH
T138853348F52F2666E0F2A33A951881127EB1AA798DD5E4C72D6034CF5D414E7CB9B3CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

in-20091223-1459.info

Path C:\Users\Admin\AppData\Roaming\.betacraft\versions\jsons\in-20091223-1459.info
Size 293B
SHA256 0526a3c1cf0a4b31f08a00b8d1a677bfdeedbc2f606eacd6300c1e32c50275cc
MD5 5e81b1091d9da6b6c21ee184d19b3e33
SHA1 e8fb06b156ef34b20392c5518dea4905a87a43b3
SHA512 5b3296a081d53f81259396aa3fc95efbec41273f1abe011e61ec33fb27305ac489317f783f483de179f499f7d29f75b4bbadec320123dfc748a68783416834f8
TLSH
T1A6E072E1E43EB036A6FAAB047324B7BE960A2B389052C3B079743A41084F43AA184C21
MD5 SHA1 SHA512 TLSH

Submit Download

83aa4cc77f591dfc2374580bbd95f6ba_49203b2b-5ec5-4cd4-8187-26a324878967

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-226940941-599731907-2645636698-1000\83aa4cc77f591dfc2374580bbd95f6ba_49203b2b-5ec5-4cd4-8187-26a324878967
Size 45B
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
MD5 SHA1 SHA512

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/856-674-0x000001B667980000-0x000001B667981000-memory.dmp

Download

memory/856-777-0x000001B667980000-0x000001B667981000-memory.dmp

Download

memory/856-526-0x000001B667980000-0x000001B667981000-memory.dmp

Download

memory/856-519-0x000001B667980000-0x000001B667981000-memory.dmp

Download

memory/856-622-0x000001B667980000-0x000001B667981000-memory.dmp

Download

memory/856-626-0x000001B667980000-0x000001B667981000-memory.dmp

Download

memory/856-532-0x000001B667980000-0x000001B667981000-memory.dmp

Download

memory/856-635-0x000001B667980000-0x000001B667981000-memory.dmp

Download

memory/856-511-0x000001B667980000-0x000001B667981000-memory.dmp

Download

memory/856-465-0x000001B667980000-0x000001B667981000-memory.dmp

Download

memory/856-634-0x000001B667980000-0x000001B667981000-memory.dmp

Download

memory/856-638-0x000001B667980000-0x000001B667981000-memory.dmp

Download

memory/856-540-0x000001B667980000-0x000001B667981000-memory.dmp

Download

memory/856-671-0x000001B667980000-0x000001B667981000-memory.dmp

Download

memory/856-596-0x000001B667980000-0x000001B667981000-memory.dmp

Download

memory/856-583-0x000001B667980000-0x000001B667981000-memory.dmp

Download

memory/856-684-0x000001B667980000-0x000001B667981000-memory.dmp

Download

memory/856-528-0x000001B667980000-0x000001B667981000-memory.dmp

Download

memory/856-440-0x000001B667980000-0x000001B667981000-memory.dmp

Download

memory/856-719-0x000001B667980000-0x000001B667981000-memory.dmp

Download

memory/856-709-0x000001B667980000-0x000001B667981000-memory.dmp

Download

memory/856-725-0x000001B667980000-0x000001B667981000-memory.dmp

Download

memory/2192-0-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2428-346-0x000001AC2D740000-0x000001AC2D741000-memory.dmp

Download

memory/2428-350-0x000001AC2D740000-0x000001AC2D741000-memory.dmp

Download

memory/2428-351-0x000001AC2D740000-0x000001AC2D741000-memory.dmp

Download

memory/2428-352-0x000001AC2D740000-0x000001AC2D741000-memory.dmp

Download

memory/2428-353-0x000001AC2D740000-0x000001AC2D741000-memory.dmp

Download

memory/2428-354-0x000001AC2D740000-0x000001AC2D741000-memory.dmp

Download

memory/2428-355-0x000001AC2D740000-0x000001AC2D741000-memory.dmp

Download

memory/2428-356-0x000001AC2D740000-0x000001AC2D741000-memory.dmp

Download

memory/2428-344-0x000001AC2D740000-0x000001AC2D741000-memory.dmp

Download

memory/2428-345-0x000001AC2D740000-0x000001AC2D741000-memory.dmp

Download

memory/5708-104-0x000001AE360B0000-0x000001AE360C0000-memory.dmp

Download

memory/5708-310-0x000001AE345B0000-0x000001AE345B1000-memory.dmp

Download

memory/5708-125-0x000001AE361A0000-0x000001AE361B0000-memory.dmp

Download

memory/5708-127-0x000001AE36110000-0x000001AE36120000-memory.dmp

Download

memory/5708-128-0x000001AE361B0000-0x000001AE361C0000-memory.dmp

Download

memory/5708-131-0x000001AE36120000-0x000001AE36130000-memory.dmp

Download

memory/5708-132-0x000001AE361C0000-0x000001AE361D0000-memory.dmp

Download

memory/5708-137-0x000001AE345B0000-0x000001AE345B1000-memory.dmp

Download

memory/5708-155-0x000001AE361D0000-0x000001AE361E0000-memory.dmp

Download

memory/5708-154-0x000001AE36130000-0x000001AE36140000-memory.dmp

Download

memory/5708-156-0x000001AE36140000-0x000001AE36150000-memory.dmp

Download

memory/5708-157-0x000001AE361E0000-0x000001AE361F0000-memory.dmp

Download

memory/5708-159-0x000001AE36150000-0x000001AE36160000-memory.dmp

Download

memory/5708-160-0x000001AE361F0000-0x000001AE36200000-memory.dmp

Download

memory/5708-162-0x000001AE36160000-0x000001AE36170000-memory.dmp

Download

memory/5708-163-0x000001AE36200000-0x000001AE36210000-memory.dmp

Download

memory/5708-166-0x000001AE36170000-0x000001AE36180000-memory.dmp

Download

memory/5708-167-0x000001AE36210000-0x000001AE36220000-memory.dmp

Download

memory/5708-169-0x000001AE36180000-0x000001AE36190000-memory.dmp

Download

memory/5708-170-0x000001AE36220000-0x000001AE36230000-memory.dmp

Download

memory/5708-172-0x000001AE36190000-0x000001AE361A0000-memory.dmp

Download

memory/5708-173-0x000001AE36230000-0x000001AE36240000-memory.dmp

Download

memory/5708-176-0x000001AE361A0000-0x000001AE361B0000-memory.dmp

Download

memory/5708-177-0x000001AE36240000-0x000001AE36250000-memory.dmp

Download

memory/5708-180-0x000001AE36250000-0x000001AE36260000-memory.dmp

Download

memory/5708-179-0x000001AE361B0000-0x000001AE361C0000-memory.dmp

Download

memory/5708-183-0x000001AE36260000-0x000001AE36270000-memory.dmp

Download

memory/5708-182-0x000001AE361C0000-0x000001AE361D0000-memory.dmp

Download

memory/5708-185-0x000001AE361D0000-0x000001AE361E0000-memory.dmp

Download

memory/5708-186-0x000001AE36270000-0x000001AE36280000-memory.dmp

Download

memory/5708-190-0x000001AE36280000-0x000001AE36290000-memory.dmp

Download

memory/5708-189-0x000001AE361E0000-0x000001AE361F0000-memory.dmp

Download

memory/5708-193-0x000001AE361F0000-0x000001AE36200000-memory.dmp

Download

memory/5708-194-0x000001AE36290000-0x000001AE362A0000-memory.dmp

Download

memory/5708-197-0x000001AE362A0000-0x000001AE362B0000-memory.dmp

Download

memory/5708-196-0x000001AE36200000-0x000001AE36210000-memory.dmp

Download

memory/5708-201-0x000001AE36210000-0x000001AE36220000-memory.dmp

Download

memory/5708-204-0x000001AE362B0000-0x000001AE362C0000-memory.dmp

Download

memory/5708-207-0x000001AE362C0000-0x000001AE362D0000-memory.dmp

Download

memory/5708-206-0x000001AE36220000-0x000001AE36230000-memory.dmp

Download

memory/5708-211-0x000001AE36230000-0x000001AE36240000-memory.dmp

Download

memory/5708-212-0x000001AE362D0000-0x000001AE362E0000-memory.dmp

Download

memory/5708-214-0x000001AE362E0000-0x000001AE362F0000-memory.dmp

Download

memory/5708-213-0x000001AE36240000-0x000001AE36250000-memory.dmp

Download

memory/5708-216-0x000001AE36250000-0x000001AE36260000-memory.dmp

Download

memory/5708-217-0x000001AE362F0000-0x000001AE36300000-memory.dmp

Download

memory/5708-218-0x000001AE345B0000-0x000001AE345B1000-memory.dmp

Download

memory/5708-222-0x000001AE36300000-0x000001AE36310000-memory.dmp

Download

memory/5708-221-0x000001AE36260000-0x000001AE36270000-memory.dmp

Download

memory/5708-223-0x000001AE36270000-0x000001AE36280000-memory.dmp

Download

memory/5708-224-0x000001AE36310000-0x000001AE36320000-memory.dmp

Download

memory/5708-227-0x000001AE36320000-0x000001AE36330000-memory.dmp

Download

memory/5708-226-0x000001AE36280000-0x000001AE36290000-memory.dmp

Download

memory/5708-295-0x000001AE345B0000-0x000001AE345B1000-memory.dmp

Download

memory/5708-304-0x000001AE345B0000-0x000001AE345B1000-memory.dmp

Download

memory/5708-124-0x000001AE36100000-0x000001AE36110000-memory.dmp

Download

memory/5708-334-0x000001AE345B0000-0x000001AE345B1000-memory.dmp

Download

memory/5708-327-0x000001AE345B0000-0x000001AE345B1000-memory.dmp

Download

memory/5708-341-0x000001AE345B0000-0x000001AE345B1000-memory.dmp

Download

memory/5708-121-0x000001AE36190000-0x000001AE361A0000-memory.dmp

Download

memory/5708-120-0x000001AE360F0000-0x000001AE36100000-memory.dmp

Download

memory/5708-117-0x000001AE36180000-0x000001AE36190000-memory.dmp

Download

memory/5708-116-0x000001AE360E0000-0x000001AE360F0000-memory.dmp

Download

memory/5708-112-0x000001AE360D0000-0x000001AE360E0000-memory.dmp

Download

memory/5708-113-0x000001AE36170000-0x000001AE36180000-memory.dmp

Download

memory/5708-110-0x000001AE36160000-0x000001AE36170000-memory.dmp

Download

memory/5708-109-0x000001AE360C0000-0x000001AE360D0000-memory.dmp

Download

memory/5708-107-0x000001AE36150000-0x000001AE36160000-memory.dmp

Download

memory/5708-105-0x000001AE36140000-0x000001AE36150000-memory.dmp

Download

memory/5708-103-0x000001AE360A0000-0x000001AE360B0000-memory.dmp

Download

memory/5708-388-0x000001AE345B0000-0x000001AE345B1000-memory.dmp

Download

memory/5708-101-0x000001AE36130000-0x000001AE36140000-memory.dmp

Download

memory/5708-100-0x000001AE36090000-0x000001AE360A0000-memory.dmp

Download

memory/5708-97-0x000001AE345B0000-0x000001AE345B1000-memory.dmp

Download

memory/5708-96-0x000001AE36120000-0x000001AE36130000-memory.dmp

Download

memory/5708-95-0x000001AE36080000-0x000001AE36090000-memory.dmp

Download

memory/5708-93-0x000001AE36110000-0x000001AE36120000-memory.dmp

Download

memory/5708-89-0x000001AE36060000-0x000001AE36070000-memory.dmp

Download

memory/5708-90-0x000001AE36070000-0x000001AE36080000-memory.dmp

Download

memory/5708-91-0x000001AE36100000-0x000001AE36110000-memory.dmp

Download

memory/5708-86-0x000001AE36050000-0x000001AE36060000-memory.dmp

Download

memory/5708-87-0x000001AE360F0000-0x000001AE36100000-memory.dmp

Download

memory/5708-88-0x000001AE345B0000-0x000001AE345B1000-memory.dmp

Download

memory/5708-83-0x000001AE36040000-0x000001AE36050000-memory.dmp

Download

memory/5708-473-0x000001AE345B0000-0x000001AE345B1000-memory.dmp

Download

memory/5708-84-0x000001AE360E0000-0x000001AE360F0000-memory.dmp

Download

memory/5708-80-0x000001AE360D0000-0x000001AE360E0000-memory.dmp

Download

memory/5708-79-0x000001AE36030000-0x000001AE36040000-memory.dmp

Download

memory/5708-78-0x000001AE360C0000-0x000001AE360D0000-memory.dmp

Download

memory/5708-71-0x000001AE36000000-0x000001AE36010000-memory.dmp

Download

memory/5708-72-0x000001AE360A0000-0x000001AE360B0000-memory.dmp

Download

memory/5708-73-0x000001AE360B0000-0x000001AE360C0000-memory.dmp

Download

memory/5708-74-0x000001AE36010000-0x000001AE36020000-memory.dmp

Download

memory/5708-75-0x000001AE36020000-0x000001AE36030000-memory.dmp

Download

memory/5708-67-0x000001AE35FF0000-0x000001AE36000000-memory.dmp

Download

memory/5708-68-0x000001AE36090000-0x000001AE360A0000-memory.dmp

Download

memory/5708-56-0x000001AE36060000-0x000001AE36070000-memory.dmp

Download

memory/5708-58-0x000001AE36070000-0x000001AE36080000-memory.dmp

Download

memory/5708-61-0x000001AE35D80000-0x000001AE35FF0000-memory.dmp

Download

memory/5708-63-0x000001AE36080000-0x000001AE36090000-memory.dmp

Download

memory/5708-50-0x000001AE36050000-0x000001AE36060000-memory.dmp

Download

memory/5708-48-0x000001AE36040000-0x000001AE36050000-memory.dmp

Download

memory/5708-47-0x000001AE36030000-0x000001AE36040000-memory.dmp

Download

memory/5708-42-0x000001AE36010000-0x000001AE36020000-memory.dmp

Download

memory/5708-43-0x000001AE36020000-0x000001AE36030000-memory.dmp

Download

memory/5708-37-0x000001AE345B0000-0x000001AE345B1000-memory.dmp

Download

memory/5708-34-0x000001AE36000000-0x000001AE36010000-memory.dmp

Download

memory/5708-31-0x000001AE35FF0000-0x000001AE36000000-memory.dmp

Download

memory/5708-23-0x000001AE345B0000-0x000001AE345B1000-memory.dmp

Download

memory/5708-15-0x000001AE345B0000-0x000001AE345B1000-memory.dmp

Download

memory/5708-3-0x000001AE35D80000-0x000001AE35FF0000-memory.dmp

Download