0619bd07d3183a8ae0cb1be408c6ad32295d47ddd666b2d51edd4d5f5d211227

Analysis

user interaction
yes
max time kernel
55s
max time network
99s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 18:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TLauncher-Installer-1.9.5.1.exe
Size 25.5MB
Sample260816-w9srkavwhy
SHA256 0619bd07d3183a8ae0cb1be408c6ad32295d47ddd666b2d51edd4d5f5d211227
MD5 de90bdf89be7e8f55b9ea1e9f0a88613
SHA1 ea25984a475c95ad41abae25885db7b24514a7af
SHA512 42f6cc77ea8cd43d167236e81e4164da7c8030605d7d1759494f41f5b9b5dcdbaec3b4d901f1925f13d915756b52ec22927e1dc304e89fb7f9342b84c475d188
SSDEEP 786432:ytpZzp8Q6W10rrKJBH5lFRqJkkt9O2B4Bi5e:ytpTTuPKJBZlC39ORb
TLSH
T1014733357AA29072D772363496996339F77EAD70AB3802D322903D3C7E716C15A7C21B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3076	irsetup.exe
204	BrowserInstaller.exe
4284	irsetup.exe
3548	TLauncher.exe

Loads dropped DLL 4 IoCs

pid	Process
3076	irsetup.exe
3076	irsetup.exe
3076	irsetup.exe
4284	irsetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Network Service Discovery 1 TTPs 3 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
5288	GameBarPresenceWriter.exe
4156	GameBarPresenceWriter.exe
2140	GameBarPresenceWriter.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c530-5.dat	upx
behavioral2/memory/3076-11-0x0000000000BB0000-0x00000000011B1000-memory.dmp	upx
behavioral2/memory/3076-539-0x0000000000BB0000-0x00000000011B1000-memory.dmp	upx
behavioral2/memory/3076-557-0x0000000000BB0000-0x00000000011B1000-memory.dmp	upx
behavioral2/memory/3076-582-0x0000000000BB0000-0x00000000011B1000-memory.dmp	upx
behavioral2/files/0x000300000001b1d4-597.dat	upx
behavioral2/memory/4284-607-0x0000000000840000-0x0000000000E37000-memory.dmp	upx
behavioral2/memory/4284-630-0x0000000000840000-0x0000000000E37000-memory.dmp	upx
behavioral2/memory/3076-1266-0x0000000000BB0000-0x00000000011B1000-memory.dmp	upx
behavioral2/memory/3076-1296-0x0000000000BB0000-0x00000000011B1000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TLauncher-Installer-1.9.5.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	irsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	irsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TLauncher.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	irsetup.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4284	irsetup.exe
4284	irsetup.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
3076	irsetup.exe
3076	irsetup.exe
3076	irsetup.exe
3076	irsetup.exe
4284	irsetup.exe
4284	irsetup.exe
3076	irsetup.exe
3812	javaw.exe
3812	javaw.exe
4828	OpenWith.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 3076	5020	TLauncher-Installer-1.9.5.1.exe	89
PID 3076 wrote to memory of 204	3076	irsetup.exe	91
PID 204 wrote to memory of 4284	204	BrowserInstaller.exe	92
PID 3076 wrote to memory of 3548	3076	irsetup.exe	94
PID 3548 wrote to memory of 3812	3548	TLauncher.exe	95

C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.9.5.1.exe
"C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.9.5.1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:3969818 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.9.5.1.exe" "__IRCT:3" "__IRTSS:26673860" "__IRSID:S-1-5-21-552508041-2681165170-3229858294-1000"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:204
  - - C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:3839250 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:3869932" "__IRSID:S-1-5-21-552508041-2681165170-3229858294-1000"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:4284
- - C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
    "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3548
  - - C:\Program Files\Java\jre-1.8\bin\javaw.exe
      "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:3812
    - - C:\Program Files\Java\jre-1.8\bin\javaw.exe
        
        "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Dfile.encoding=windows-1252 -jar C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
        5⤵
        
        PID:2168

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:4156

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
PID:2216

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:2140

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:600

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:5288

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc
1⤵
PID:4348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
PID:5608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
PID:2056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

200.ico

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico
Size 116KB
SHA256 9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946
MD5 e043a9cb014d641a56f50f9d9ac9a1b9
SHA1 61dc6aed3d0d1f3b8afe3d161410848c565247ed
SHA512 4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f
SSDEEP 1536:5HmLYAoZllsaebGVeTZ8Sz3HjpAAAAADYmaAAGg:UfoZll0bGVmjWh
TLSH
T1C6C330260E6D3150D3992D79BEEAE3384E764D90EC6D21A314ED782AF9376EC13ED440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowserInstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe
Size 3.7MB
SHA256 e20f18d8c5d3621a81d35fe43d759ddb148e35d1856a94fbe95dfbec93127a10
MD5 05db02530acae561d2e4b368ccd45f52
SHA1 050101d4689ee8012bcf7eff4cdbe15a3851ecc8
SHA512 8a3e37e6d5e73fdac7f4b974dd350011b83b410b2b26b140bb53f1c497d3fea857c9ecf03e931dba53908eeada1859d4f3797f47d187d84e651b1fa42f548b37
SSDEEP 98304:DLDSCHji8v64cym9lYQre8JVal0S8R4+h8GdspyRLndhyOu9w:DHfQbVTS8R4E8GduAT89w
TLSH
T15906F12A7A72C072C6323630969DA379E6BDB8705B35829317D01E3D2E715D2993C36F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG1.BMP

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.BMP
Size 12KB
SHA256 1d7a67b1c0d620506ac76da1984449dfb9c35ffa080dc51e439ed45eecaa7ee0
MD5 3adf5e8387c828f62f12d2dd59349d63
SHA1 bd065d74b7fa534e5bfb0fb8fb2ee1f188db9e3a
SHA512 e4ceb68a0a7d211152d0009cc0ef9b11537cfa8911d6d773c465cea203122f1c83496e655c9654aabe2034161e132de8714f3751d2b448a6a87d5e0dd36625be
SSDEEP 6:BlcgEMS0gjjjjjjjjjjjjjjjjjjjjjjjjjjj/naEMh:TcNwezg
TLSH
T192423A021F61C274F2CC0CA44D58244CEF10CA5B211B02C54C75073597C06D73EFB35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG1.PNG

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.PNG
Size 45KB
SHA256 a42ab4d62c5a5286202df15f9ad32b22396d5d12c7a4db8c5a2c98f90160ade1
MD5 b1c738ebb530ef3312b3d7209d2a8079
SHA1 9884f02de44291f3217c03b02089824b7b25b55a
SHA512 f79d826d716239deb6077717dd6880236eab7a4a6639bf5de678500e6d5488b5a70938988207b8554782878ff5472e23b577db288cf273007f8778ca08b8a9fa
SSDEEP 768:FU5FNyQXHLMQk/CIEB1TGAPytWZixXgqZrPvgzfF7OBhTNj9YGhaBcROHI4QkU:+5FNyQXHQ3/xq5bytpWk7vg7FeTNuGhl
TLSH
T14523F21ABF030526AF1A1B70B91D71EA14452289FCB789888F670817B1CF9E2F64DB49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG10.PNG

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG10.PNG
Size 206B
SHA256 348e3f3544cca4c9ca2af323fa8b3453a70ea421c82b331681dc1d4ef74921f3
MD5 5ad7b05326e53ab9d91b36331c3f84ea
SHA1 bea6d94e541a2380b9506df97349aed1ebb1e04a
SHA512 51dc9a6c323207e628f7494cf83451687d9a5977368d761489b48c25174edc0dcac3cea2705389001220aef8896c03c8dcb878e963545dc3cdf51f59c982847a
TLSH
T1E8D022C29B42BC3CC10FD039EAAB1250D8BA044E16638A4CA06161262310FC4C2EAE83
MD5 SHA1 SHA512 TLSH

Submit Download

IRIMG11.PNG

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG11.PNG
Size 25KB
SHA256 4b9893db13905698bda38bf78fa0660026f7a311c8f89fba9bfc042ebaba30e5
MD5 603bd21b7fe96d9daa9f7c4344fedad9
SHA1 35f460ab81b9854065b4ee73cf662a2f68907626
SHA512 b4168e5bbb8241f50ab27fae6ce38a2a16bbdfc030f6522b3c67170154ff2f6ff33f7c515aec80d180c1538a50d4bffd5cb4836806c3137548fe9a435fa099ea
SSDEEP 384:maivfrQhsfK/TrGXkLzxtgDsBIEA/9vy4Rml1hxgSUlp8ljYq/I48YgM8cM3:1iLA9QkLDg4SEA/9q4RmAPpYjYqT0d3
TLSH
T144C2E025FA275198E3B86EDE078D2343DE41620633385F5CEC3F55DF09B951912467A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG13.PNG

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG13.PNG
Size 41KB
SHA256 1708790d5496b9cc325cc0249cfa272aac3c3738188fc41eef83e8592de247ff
MD5 d157aa0e365b8a0b4a72096792813fb8
SHA1 8ce762ca86b54b91c38b22027a4a36417c3919fd
SHA512 aedcf9706ddd901d4a5bb5096daefef5506007fc96351b44521bebbe70ecd1aa8caecf1cb76d9ff461c73b32a73f577f62330a19b764b0870c0b087828c449f5
SSDEEP 768:pJGBX+j3ksnMoMVCv2YMgvXVwHAt8fTzwqYGtIoz8V0bWa2NrrCwyF:p85c3XnMbc2tgvmgtITzGzY2NrrCJ
TLSH
T1B613F1E881CF028DD7A552440AFC62863FD2DA58B2551F1EDD8A36F93DF34646C8392D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG14.PNG

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG14.PNG
Size 43KB
SHA256 6528bb11becf79c17c77a9c6624b82074b9dd6d3e932852c8fe1da22a57854aa
MD5 c1380329e781c0a64b39b7441848c380
SHA1 f038908d637389cd56c2bcd524c1f98090b194c1
SHA512 51a9dcb8955cdb7b78d3ffbf8da8ecd866d46b325b0fe8c948a2ce81302ffb11ee933ee5de2850ec92950a5a5a1b7cfe0237a3817cf5ced7029ed9bfb2464f0f
SSDEEP 768:fKdTjAjz+7WyOYqVxkwGW/wh8P97nd6alQO/IrLXjTVgqjqC:fKdfy+76zVxm8PzYeIrzVgqjV
TLSH
T1C413F210C4CD9A6703CF5E12E46538A5B8E158C0FA2DC4AC38E6DE24552E7EF5F107D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG15.PNG

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG15.PNG
Size 644B
SHA256 207bd7ad2eb7f48a2a1be1253363fa120ae79e25eacbd37d6b9be52d2128bfdd
MD5 803fe72088e9684779985bb4bc92c3c7
SHA1 427d3cbcd903a8ca0090914de9df0bb25f148776
SHA512 df33b0f72d3fa7da46ecb6f3d3b0df8cb3983d5c1ed04851e24bb3e6fc68eadbf01a1ffd5d3b98a5e9f13dfcdeb6a66e3624c66ab2ecccddd582de7569fff72b
TLSH
T164F068D615D15478C20781B480C502A3DCBA1A85DDD786445180B73317D1FCDD5C236D
MD5 SHA1 SHA512 TLSH

Submit Download

IRIMG17.PNG

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG17.PNG
Size 40KB
SHA256 06fad383e3506eb1be52877bee839b833de157a2601af1c443ef1244a92f5d8f
MD5 46cbccfdcee617bb76271de3c8293da3
SHA1 ccd7bd2af1cae294803facb927b6d172e5fe8a29
SHA512 e88c47376c6d8df4d8d351df14b7c88820dbfafae24ebfdc6d6ea07afab14c7ab8c1d0394e3fe3759eea7051f67ff3005651e4ae00a3c2f7c7a020fe48765423
SSDEEP 768:PYY9Me/k8H5G7Ee6KkwtLIAKI3z9MmzYPjvdz5bnuPusRWFBFHyAoK5:FlM8ZSEe6Kk2TT36dz56PDS7H0K5
TLSH
T17A130111E6DC90A27A965C083488703B95A330C95DF57F2F9813F69440EDB0F69FBB68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG2.BMP

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.BMP
Size 12KB
SHA256 9c893fe1ab940ee4c2424aa9dd9972e7ad3198da670006263ecbbb5106d881e3
MD5 f35117734829b05cfceaa7e39b2b61fb
SHA1 342ae5f530dce669fedaca053bd15b47e755adc2
SHA512 1805b376ab7aae87061e9b3f586e9fdef942bb32488b388856d8a96e15871238882928c75489994f9916a77e2c61c6f6629e37d1d872721d19a5d4de3e77f471
SSDEEP 3:y9lMll2/l0uqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdC:BlcI
TLSH
T128420404113000D5D1450175007471C5751547D5D004034C30114C14451047703CC044
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG3.BMP

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.BMP
Size 12KB
SHA256 4c85cdddd497ad81fedb090bc0f8d69b54106c226063fdc1795ada7d8dc74e26
MD5 f5d6a81635291e408332cc01c565068f
SHA1 72fa5c8111e95cc7c5e97a09d1376f0619be111b
SHA512 33333761706c069d2c1396e85333f759549b1dfc94674abb612fd4e5336b1c4877844270a8126e833d0617e6780dd8a4fee2d380c16de8cbf475b23f9d512b5a
SSDEEP 3:y9lMll2/l0ZVTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTn:BlcSj
TLSH
T1DA42040F110103C5D1C700350C57C1C4F51F45357004035C1011CC344D10457034C044
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG3.PNG

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.PNG
Size 475B
SHA256 d339d7a5fcaff72292150f3c7db87a73caa396e23224b570e053c8bb96a3a897
MD5 a32b83463a6f7cc50e6be2c85ba53ac2
SHA1 e07c81d391d9acfa5a0ccabca0cffa4bc5c6aadb
SHA512 c32d1cd6fb8d50cf373ca96df9a150494015997424de2454aabf0c090192538e5c6a1e20e1ad7d2f520b628c3bfe5b47ef79c02e18bf044101d7c25217580df0
TLSH
T1D0F0D4E9578D456CC14F4535631B5063FCA239C69A6F57454C286D1B8B59FE84031F81
MD5 SHA1 SHA512 TLSH

Submit Download

IRIMG4.PNG

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG4.PNG
Size 368B
SHA256 3207283d0abc0dd36c0991b40a738247394bbc92e5696eb790a5c888a9f28106
MD5 c864e0b6888f3aa5365c1b60c71db536
SHA1 f3b86b6dda72ba5e90e5a7f0afb4553f6b9c211e
SHA512 dddd8d83f80ca045bd6fcf697e3df717a56de7cdc3bfcb44d92b889f5fa570bc0671b3fac05233e459e1fd9f9c998afcd37bc766cba544e9b0d98546f37ec21d
TLSH
T1ECE0C0CF5B54AC28D9CFB976071B0590E5725D970C67C69831A0A4B91FACE489487282
MD5 SHA1 SHA512 TLSH

Submit Download

IRIMG7.PNG

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG7.PNG
Size 15KB
SHA256 f592120493d57f7a474894c022db4110521ebf5b61edb7f0fa376fbe9fff4474
MD5 78edb5aabe2594457426c71ed698cca3
SHA1 52e7296e6f24a6b782b5080b86d5f53cb9fa2a80
SHA512 b73b3c0f12c2b9c91de6cb15509b6ba8a97a587d7a772797aabd697a09304a881a2c7555105c26795ebe42577e612b61b9d7f4a4248155b93b44b696dcab7ca1
SSDEEP 192:iCkb8ZDjmPN25+aIjnal9vFhDU42iZmqz9slyG1fSlmsWYQd7IHK2VvwYUi3CGBY:mwlmV255AaLvrW/y0SAKjKjIy90kzlb7
TLSH
T1E172CF164308FE7050E4E52D06AAFDE9AB6187C9CF2543366204AD678438E729EFBC34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG8.PNG

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG8.PNG
Size 13KB
SHA256 38b5b1d3c302dc44a832260e23d2019991f971298c46a35d6f37544ea9ba853c
MD5 a8fcde435e0da925b01c094665420cbd
SHA1 f7c7db511d990c4f30f41ebc8126e7c48daca937
SHA512 ace09a3ed1c156471bbf76e9a7ff436637bd579746bfd36b19384a5178a708a1e69813f49884a311fb48a0e514b45528356aa73c4dab8b2ba795b0979fa4a380
SSDEEP 384:/KgfqXg9uwuzqNeLYQYi4ZpU1SRkb5c+V7mIT45HJq7c:ygfqQGzLLYQkdkpaa45HJIc
TLSH
T19452D00CD36DDC4EC705A132AD76766DA5E5A80EF3B93F83680275970234A106EA3E07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG9.PNG

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG9.PNG
Size 438B
SHA256 d16a8eaf8f979e45bacbbd8ef14afe482d74e926dff2e87e569342874ba34145
MD5 d5515147e2fd43bfcb51088cba0a2d11
SHA1 24319ae988efd59fdd883b14642bca432cffb049
SHA512 a54fb5461ede951704a1fdfd3ba0118a3e525412f1e9c41cceae17730d28ea2a6d22f1926c4eff50fd4a5e6caa4972fa085af1cc22ef47973a15763f4280ceb7
TLSH
T1F3F023C62F547AA0C50F6632DE1D8546C12364C73CF9B359DC04DB313380FC6A0461E2
MD5 SHA1 SHA512 TLSH

Submit Download

IRZip.lmd

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
Size 400KB
SHA256 3a6794c90d69383bd76098992cb512ae343cb2e1a3680dd4794e49895472b429
MD5 1698da32813956674734c753b55baa08
SHA1 cf4e3a707e59cd6c6bc5b7cca659d5dd2c080638
SHA512 eeb6ad23291f9bd37f20555ae8d557bf0e448e77433c3dbb859813cb70e80f9cd4d30219083aac23f99ed780ee510f31d78aedb44a548582e690eeed58245841
SSDEEP 12288:Gwji6+ZoE2oaXKOAilmVx+igEpONKiKjZTeGV+:ViJTbaXlAUnKiKjJeGV+
TLSH
T1D2948D01B6C0C0B2D1AD253124AAA3369A7E7D205735D7C3F79CFA7A5F311D1AA2934E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wow64.lmd

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
Size 252KB
SHA256 27b48727237cd0f8a1205e01e5c93cbe6c7a2f3938faf8d8daa5191094c347a5
MD5 bfa121019a2dd9f7749f6bb72570319e
SHA1 fc48a96ad45e00815060bb366fe8f31c140ecb19
SHA512 cda75a55119104b23489b1048c810e066099b13e12aade7cfc757ba91de7b6754edff2da561741a16c92aa00d7e4ea0b53f77ebea6aaca059a74847a0f5d4059
SSDEEP 3072:52E6GukcxWtnwkwNBp0AUTjQzKgvyVx9QlllMS25RpaLSDk/wY:52EcxW2kwNBp5UTsKgaQllaMLl
TLSH
T15F444B0176C4C032D27B21354877D375AA7ABD618BB48287BBDCAA7B5F705C28A37316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

irsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Size 1.8MB
SHA256 96070b2d82b6bffd54719f9753909be5f5151edbd5b37b26f50dea2e995ea430
MD5 21618eb1ebe1b4033d833eb057c3d065
SHA1 40e80d4f0d0254bebf73ceabf28d3c471f894aea
SHA512 4765b54fe15bb127f4f80777004276212ffb5fe2bad1b887eed9fca5c50d2b336805de32913c41ba7f726445a21b591e6494363b52b5333e273f3254fc927c19
SSDEEP 49152:wo5xdLZj7eHEWcSkMqQjeDlSvKjoSCpWmp8728hLFhC:woDdGgbQyDlSih/FFhC
TLSH
T1D1853381E665C38BC57C483BA8FB5D556B29AFC27311C7D20BB9BD1FB8367922C48850
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lua5.3.dll

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.3.dll
Size 395KB
SHA256 eef58c3dae331da03872b973230aa56b40e34035035cca5b468eda0c40daa819
MD5 8d18dbd14d7c233b0d1f5943226c35b7
SHA1 57de3e8d8e1f0e39244b3528310e513c7f90c5fa
SHA512 39777b070c6ea791ee5cdc1c8ad50015e9d6f6f96b2d8e02f4a80f97a7fa2c438770d5015eca5d19106cfce624b6a247de04cb4ce6baad353acbb298f0fc6aaa
SSDEEP 12288:B3yJ6pmOZCR40mbwkOMMe6uDa6H5FrCp6pFVY:IaLbwKLDTH5+6pFVY
TLSH
T14084BE41F283C0B2E6A411B996B49F774D78745A5336D0FBABE018B59E203F1777A30A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

irsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
Size 1.7MB
SHA256 ea04ee2883ca5dcb461ea894a4e2def7d0c89f11d9f06f3bae020f6a25e7b75d
MD5 fdc583888459954430cdb445138e8690
SHA1 1557c2343eebe793dad9d71af697db9c98f7224c
SHA512 4085953bdf51b93bbce4b2cdc1ae732de7a9a6e0b523fb794722fefef9d59be5624feb99f4f73cead9a4353d3f63c5434b21b65abcd0b3915c97d1d97747f7c4
SSDEEP 24576:Xgojt8rfJLbXIpyxOjNONgc2gI0pRR9djPOZYVFR9MRsixD6Oo1e4XHbtSwye:wUqrdspyxXn5Iy9Rdb92s27OgZ
TLSH
T1B1853323E5340AFBD86C2E3251BD2482AD7EFCF2F3690C4286557B1311ABB815A9D375
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lua5.3.dll

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.3.dll
Size 395KB
SHA256 0e43d22649d6b2ecbac9915dc6498fe1f41777dd33147d962b30dad0d5e76ab3
MD5 4eed99fd77f4ff9c252f56e153f9c9ab
SHA1 995cecfe73f719c5135461402fdfb17d79721831
SHA512 df0b514491e48e0f6103c61833f24fd0822a5b7fbaf1df9f48263bb83b1d5e5157307d0f6b7fdf3281e32886d3d8201b4a378239d2cbd31584a7c200c2b69e03
SSDEEP 12288:l3yJ6pmOZCR40mbwkOMMe6uDa6H5FrCp6pu76:MaLbwKLDTH5+6pu76
TLSH
T1F084BE41F283C0B2E6A411B996B49F774D78745A5336D0FBABE018B59E203F1777A30A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setuparguments.ini

Path C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
Size 767B
SHA256 ac8f20e9281eda9574f8fddea18eb491f1f94e4995dd0c09fb6c08e8b5738fa7
MD5 72f6018706f7ecd48f44ecbb6dde3ca2
SHA1 e25a458835122c4942777554d917319150db6ea1
SHA512 97fa8d190353be39a029c4c9a11da1ac4f817009cc5b59013ca547ea66764ded0d97453c0d8e6981844684d28902d34ff8695096bf5fe54eaa0075064a826a75
TLSH
T17B0162438E0122AFCCA45341E52B2D928D9CF9EEB09308E08BD7043BDAA0C59BC88477
MD5 SHA1 SHA512 TLSH

Submit Download

TLauncher.exe

Path C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
Size 9.2MB
SHA256 8cdc16a8f34f99dc85273838350ae9a9a840de8c6dda3c045c5514520842dd78
MD5 6afe8456101c71193942943f9f8db1c4
SHA1 cc2dd5b0d2a531b27b3531d4ae7b77df2d385c52
SHA512 dae1d037610e663b8a0f034e345043303bd2a15b67d0a30be3d5b3c3230f6d82d39d2622b326bb84c3c838d2b4c296d9c3b95ae3289ab266ad31048c496ed61b
SSDEEP 196608:RshNVPPzMDzdatp5ahrePa+52Pk6ptJT:RshN6Dzov5C
TLSH
T189A6F15BFED8C069FA0794324162D067B82D4BC8D14BF19B15BC669A88B1C894F07BDF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.xml

Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
Size 21KB
SHA256 15cdca6a11c95f616290e91bbc1e381e1d6675fcd5e4ea8a2549d82da813028d
MD5 c681f0cc957f5e5dd711747315e409f2
SHA1 49a21f1a210d4f075d6c832a6d8f1b28773b3bf5
SHA512 6cf1ad5b0601619839174345e959fe0fd423d9d7a54ed8e72ef9d50c5bae5da3cc9a6b3c6d41d6f475f30219d6c12948486179b434e7d3ae032622cad4fb1740
SSDEEP 96:kTftHJEjjzVFHQjJVFHQjOVFHQjYVFHKKFgLN83WJojSFvUep0/Sdj496/XMBWrC:eGVFH2VFH1VFHBVFHjsuop3pUJWKCud
TLSH
T1A8A2EA3C80DCDF7EEC93B37B4666546E65B1890C3ED22C59D2E8944F548460CBAB39E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.xml

Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
Size 2KB
SHA256 3d6b3d89d12ded3e755eb70068873bdd867af63e566655a427e6084c1dfaf5e5
MD5 d7a70e07debd2d7fa89f0b064cc34530
SHA1 187001b3189907aaa272f323c85a0486e73e2713
SHA512 000cfe4913f154ab781f55a1493264027a5119b99607a98f21316400969d201b0f2b5aab41e65c975e1b2920e2dab1404e6e821db87e8299b581c34f1f275543
TLSH
T10D415D3CC4DCDF1BFD96B7B72561643D9A61C1882A822C54C6D990CB50CA85CF9B36E3
MD5 SHA1 SHA512 TLSH

Submit Download

uninstall.xml

Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
Size 3KB
SHA256 971738897c939386e91b2b8593604a6135b2195a8888902d68b98356eef13a84
MD5 611626ee52688c55fd19bb6a243c48e9
SHA1 bc74df8f9ffa6b632a82728a08822f23d95cd427
SHA512 3e2d851501b0d2e7579a557903f2e1ccb3697d0394e889462233291fc8df5ea4cc9da6a97a1c283a26a7ea73013060bddfc15b9bbcff203fc4033c32d3fb9ce6
TLSH
T13B61253C84DCCF1FED92B7771261643EAAA085482EC33C54C6D9948F518A45CBAB36E3
MD5 SHA1 SHA512 TLSH

Submit Download

uninstall.xml

Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
Size 5KB
SHA256 a77159c63a0b33c177bca6e035f6dc40f2c213384a06fc6854804ada61897adb
MD5 58c11d0283eae0d0811e3672305607be
SHA1 1bbeeb3931ae9ac863715f8df5a6caf6dd035552
SHA512 34dd2040749c5adaf1c2994e3dbaf514f19b40d7c073e0d8676a66c862be5c718ccf3d6634e18568572a00faaf04696618dde0dca8958abf72a4e8fb938b5a4f
SSDEEP 96:kTf6JEjjzVFHQjJVFHQjOVFHQjYVFHKKFgLN83WJojSFvUep0/Sdj496/XMBWrAZ:eZVFH2VFH1VFHBVFHb
TLSH
T1B0B1E53884DCCF5EED52BB770272503EAAA049483EC73C58C6D9948F518945CBAB35E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log.2026-08-16_19.log

Path C:\Users\Admin\AppData\Roaming\.tlauncher\logs\starter\log.2026-08-16_19.log
Size 2KB
SHA256 f3a87a9935be88ad8630bb824fe3c5a5254651b807c7634043a24d129b7a045b
MD5 b25e0b53ec9beb118f4be2f67ef240fc
SHA1 352c1fdc0d982692eb59f432deee889a99ea973f
SHA512 063133fb704baaefcd87b177247c4e66f236f83eb2cad6b5681f88b2f1c2dc9bf4bc65006c4c5d2e936b47957c86db9ab913c3f365f259bbf7b77046a1fe71da
TLSH
T10E51CC7FE7865187E8C9F78EA133649DEF21190047D0C9A020836A50A49C19FBC9F3BD
MD5 SHA1 SHA512 TLSH

Submit Download

dependencies.json

Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\2.9374\dependencies.json
Size 25KB
SHA256 76fceb12658369b0d28f14dc35feaae204e36983c6d759c6c7665640547478be
MD5 f455dcacd2b3ea37e9db6332d4fb9ee5
SHA1 6dbe109b2ef589f56ea2e651d862330b82bc53b6
SHA512 71ce99956ec29f808d1d314cafd234126832bed708b560747439b6da79b6f2e45911665d30eb89643e94734abc7995abd0f510f2f8bf72dfa5399335c9a77a72
SSDEEP 192:KuBy8RG/vlH6fJkHMtpMpcDTIYEpbEpU7MaSWA6rQx+A+0Ujv9ykHHI2pebW4On2:s0gcH25An/nybSYw
TLSH
T1A9C2AB64C5A0AFF24425ADF8CC6F81A35352A94B8C6C3D597B4C004CDF2E58F15B9ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.json

Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\2.9374\resources.json
Size 17KB
SHA256 9cd7a802791beed588677cc4b578883263333da42660c6f87add35473ce56b96
MD5 e6f34f6b7ab960de4c3a371ef6e147b0
SHA1 ce8b11449203d40f1b281a09344158ed5756f06d
SHA512 02e6aba8ae885a2fc823955821c2f76b4af575bd5c4e9a0a365e59c5a5c1b90dd9f1561cadb7370c5f4c9e851e45b975ce7e5bc68bd9194f3155d75515455651
SSDEEP 192:icTMUnm/7w9r+h82ppiV3t87YPRjGrORgead64vluxBlEbgnVULdMzyeBKIt8bhN:Un/3qkJMWTLx
TLSH
T14282CB29E1F06D770404A9790C9A4193DA95598B8DB4BE11B32C02CCAF9E91F08F78FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appConfig.json

Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\appConfig.json
Size 4KB
SHA256 f1098290548cfee07c581d7886882f78ecb511def9d6edb2eeb3f1bc7aa5d033
MD5 038e4cad284426456ab89b0ceb8c9b9e
SHA1 91020deb0547704e85c42793bc860a0953c7eb9d
SHA512 065fa6a0433fbdc4a673835b874913d732732c5ba47063cfb0807af30c8d893b68176c2751f8fa3c0316d1d39e5b261c4cfb200ce949ad20f3282f5b7463f3c1
SSDEEP 96:DkcQphTOzcC3pjeER8+VSgZWcZo3c7WAcJF12cx:D+phTOzcC3pjeER8++cacNcj12cx
TLSH
T19E91CB7BC1801EE62703139DCCBD896BB9A2411B4D887828BB7D001C7F5F56F2DA459C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaConfig21.json

Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\javaConfig21.json
Size 3KB
SHA256 4e677c3608065a9a12f97bededc27fd440711f94288012207645df37f516d699
MD5 1c4e5f5f435bae981cfad5a1124e1140
SHA1 0eb17ad37343c07b31f5f75f829e10a161c25852
SHA512 82c25097e25649f82d4fe735d324639e12397df147185d53947a3ff204aa8d1c7ce5bf1bb994442aa2c5bb904110a14a53b0640b797bc665ba4a635b79595d57
TLSH
T18B710B0AD8511FEA250227FDC82D51E7B692404B8DA47C3CB76C610C9F2F2AD79E5ADC
MD5 SHA1 SHA512 TLSH

Submit Download

starter-core-1.268-v6.exe

Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\update\lch\starter-core-1.268-v6.exe
Size 9.2MB
SHA256 f0cb809918c2bf85a8eef2bcbd35218e75426b4e5698ca1cca50acf3e5a714ce
MD5 945b2a20000dcf96c356b15a1ca00abc
SHA1 c770f518ac82dfa316c3293722db36db2e81ddb8
SHA512 c20f5a7f841eb5055f970746cabcfcfd932f67563ec280f19a53a2b7cae0a310531df414f25bb1e8a5a640150d814771ee54e18a42b55586d523f9cb250bc23c
SSDEEP 196608:FmdhNVEixzMDz7ntpRvb1tPa+52Pk6ptJTh:FmdhNii6DzTT5Cj
TLSH
T146A6F15BBED8D06AF607D4324162D067B82D4BC8D14BF19B15BC269A88B1C894F07BDF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83aa4cc77f591dfc2374580bbd95f6ba_332724ed-3c1a-4b0f-bd9b-045e18507ba6

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-552508041-2681165170-3229858294-1000\83aa4cc77f591dfc2374580bbd95f6ba_332724ed-3c1a-4b0f-bd9b-045e18507ba6
Size 45B
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
MD5 SHA1 SHA512

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

TLauncher.lnk

Path C:\Users\Public\Desktop\TLauncher.lnk
Size 1KB
SHA256 8af5aa404c87016fff1cf5100b86e49d096b4a25fee8c1cbdb1c4a60b5b1d8f2
MD5 10b61c32851b273a48d6a22b00e03d32
SHA1 e48b3137cb5cfae84088fc68e1d637b0896cf612
SHA512 0314445fb7790a8fc6a387f6dcc4e8e99ae44006fc8b09a4fe0b39b5e858525802d6051497e629966e033d58e93f680f6ba7270be78cb582e3c8ed9095dca301
TLSH
T1FD41AD2056EB2BD5F3FF66B727B71125AB31BC10AB11B35E0400E28B1832E159E25B32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2168-1714-0x000001CAB2660000-0x000001CAB2661000-memory.dmp

Download

memory/2168-1763-0x000001CAB2660000-0x000001CAB2661000-memory.dmp

Download

memory/2168-1872-0x000001CAB2660000-0x000001CAB2661000-memory.dmp

Download

memory/2168-1871-0x000001CAB2660000-0x000001CAB2661000-memory.dmp

Download

memory/2168-1865-0x000001CAB2660000-0x000001CAB2661000-memory.dmp

Download

memory/2168-1853-0x000001CAB2660000-0x000001CAB2661000-memory.dmp

Download

memory/2168-1834-0x000001CAB2660000-0x000001CAB2661000-memory.dmp

Download

memory/2168-1835-0x000001CAB2660000-0x000001CAB2661000-memory.dmp

Download

memory/2168-1827-0x000001CAB2660000-0x000001CAB2661000-memory.dmp

Download

memory/2168-1795-0x000001CAB2660000-0x000001CAB2661000-memory.dmp

Download

memory/2168-1753-0x000001CAB2660000-0x000001CAB2661000-memory.dmp

Download

memory/2168-1761-0x000001CAB2660000-0x000001CAB2661000-memory.dmp

Download

memory/2168-1762-0x000001CAB2660000-0x000001CAB2661000-memory.dmp

Download

memory/2168-1656-0x000001CAB2660000-0x000001CAB2661000-memory.dmp

Download

memory/2168-1745-0x000001CAB2660000-0x000001CAB2661000-memory.dmp

Download

memory/2168-1746-0x000001CAB2660000-0x000001CAB2661000-memory.dmp

Download

memory/2168-1732-0x000001CAB2660000-0x000001CAB2661000-memory.dmp

Download

memory/2168-1733-0x000001CAB2660000-0x000001CAB2661000-memory.dmp

Download

memory/2168-1724-0x000001CAB2660000-0x000001CAB2661000-memory.dmp

Download

memory/2168-1725-0x000001CAB2660000-0x000001CAB2661000-memory.dmp

Download

memory/2168-1717-0x000001CAB2660000-0x000001CAB2661000-memory.dmp

Download

memory/2168-1718-0x000001CAB2660000-0x000001CAB2661000-memory.dmp

Download

memory/2168-1703-0x000001CAB2660000-0x000001CAB2661000-memory.dmp

Download

memory/2168-1713-0x000001CAB2660000-0x000001CAB2661000-memory.dmp

Download

memory/2216-1711-0x00000281DA5B0000-0x00000281DAC30000-memory.dmp

Download

memory/3076-1296-0x0000000000BB0000-0x00000000011B1000-memory.dmp

Download

memory/3076-11-0x0000000000BB0000-0x00000000011B1000-memory.dmp

Download

memory/3076-539-0x0000000000BB0000-0x00000000011B1000-memory.dmp

Download

memory/3076-557-0x0000000000BB0000-0x00000000011B1000-memory.dmp

Download

memory/3076-582-0x0000000000BB0000-0x00000000011B1000-memory.dmp

Download

memory/3076-1266-0x0000000000BB0000-0x00000000011B1000-memory.dmp

Download

memory/3548-1291-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/3812-1433-0x000001A361A60000-0x000001A361A61000-memory.dmp

Download

memory/3812-1428-0x000001A361A60000-0x000001A361A61000-memory.dmp

Download

memory/3812-1528-0x000001A361A60000-0x000001A361A61000-memory.dmp

Download

memory/3812-1644-0x000001A361A60000-0x000001A361A61000-memory.dmp

Download

memory/3812-1642-0x000001A361A60000-0x000001A361A61000-memory.dmp

Download

memory/3812-1522-0x000001A361A60000-0x000001A361A61000-memory.dmp

Download

memory/3812-1304-0x000001A361A60000-0x000001A361A61000-memory.dmp

Download

memory/3812-1590-0x000001A361A60000-0x000001A361A61000-memory.dmp

Download

memory/3812-1497-0x000001A361A60000-0x000001A361A61000-memory.dmp

Download

memory/3812-1482-0x000001A361A60000-0x000001A361A61000-memory.dmp

Download

memory/3812-1419-0x000001A361A60000-0x000001A361A61000-memory.dmp

Download

memory/3812-1418-0x000001A361A60000-0x000001A361A61000-memory.dmp

Download

memory/3812-1427-0x000001A361A60000-0x000001A361A61000-memory.dmp

Download

memory/3812-1429-0x000001A361A60000-0x000001A361A61000-memory.dmp

Download

memory/3812-1540-0x000001A361A60000-0x000001A361A61000-memory.dmp

Download

memory/3812-1443-0x000001A361A60000-0x000001A361A61000-memory.dmp

Download

memory/3812-1446-0x000001A361A60000-0x000001A361A61000-memory.dmp

Download

memory/3812-1352-0x000001A361A60000-0x000001A361A61000-memory.dmp

Download

memory/3812-1450-0x000001A361A60000-0x000001A361A61000-memory.dmp

Download

memory/3812-1421-0x000001A361A60000-0x000001A361A61000-memory.dmp

Download

memory/3812-1408-0x000001A361A60000-0x000001A361A61000-memory.dmp

Download

memory/3812-1404-0x000001A361A60000-0x000001A361A61000-memory.dmp

Download

memory/3812-1392-0x000001A361A60000-0x000001A361A61000-memory.dmp

Download

memory/3812-1391-0x000001A361A60000-0x000001A361A61000-memory.dmp

Download

memory/3812-1380-0x000001A361A60000-0x000001A361A61000-memory.dmp

Download

memory/3812-1383-0x000001A361A60000-0x000001A361A61000-memory.dmp

Download

memory/3812-1374-0x000001A361A60000-0x000001A361A61000-memory.dmp

Download

memory/3812-1368-0x000001A361A60000-0x000001A361A61000-memory.dmp

Download

memory/3812-1366-0x000001A361A60000-0x000001A361A61000-memory.dmp

Download

memory/3812-1303-0x000001A361A60000-0x000001A361A61000-memory.dmp

Download

memory/3812-1641-0x000001A361A60000-0x000001A361A61000-memory.dmp

Download

memory/3812-1633-0x000001A361A60000-0x000001A361A61000-memory.dmp

Download

memory/4284-607-0x0000000000840000-0x0000000000E37000-memory.dmp

Download

memory/4284-630-0x0000000000840000-0x0000000000E37000-memory.dmp

Download