Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

URLScan

urlscan

https://github.com/v...

windows10-2004-x64

10

Resubmissions

11/03/2024, 19:32

240311-x871jacc31 10

11/03/2024, 19:26

240311-x5whbscb4v 10

Analysis

  • max time kernel
    65s
  • max time network
    100s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/03/2024, 19:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://github.com/valinet/ExplorerPatcher/releases/latest/download/ep_setup.exe

Score
10/10
lummadiscoveryevasionpersistencestealer

Malware Config

Signatures

  • Detect Lumma Stealer payload V4 1 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Downloads MZ/PE file
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Stops running service(s) 3 TTPs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Registers COM server for autorun 1 TTPs 6 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 10 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies registry class 34 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 35 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/valinet/ExplorerPatcher/releases/latest/download/ep_setup.exe
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1868
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff85ae46f8,0x7fff85ae4708,0x7fff85ae4718
      2⤵
        PID:2376
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,4564337144344269271,17744009904780387897,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
        2⤵
          PID:4560
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,4564337144344269271,17744009904780387897,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3680
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,4564337144344269271,17744009904780387897,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
          2⤵
            PID:2992
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4564337144344269271,17744009904780387897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
            2⤵
              PID:3628
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4564337144344269271,17744009904780387897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
              2⤵
                PID:4320
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4564337144344269271,17744009904780387897,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
                2⤵
                  PID:4188
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4564337144344269271,17744009904780387897,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2328
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,4564337144344269271,17744009904780387897,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5056 /prefetch:8
                  2⤵
                    PID:2876
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4564337144344269271,17744009904780387897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
                    2⤵
                      PID:2676
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2096,4564337144344269271,17744009904780387897,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5888 /prefetch:8
                      2⤵
                        PID:1304
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4564337144344269271,17744009904780387897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
                        2⤵
                          PID:5124
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4564337144344269271,17744009904780387897,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
                          2⤵
                            PID:5136
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4564337144344269271,17744009904780387897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
                            2⤵
                              PID:5384
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4564337144344269271,17744009904780387897,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
                              2⤵
                                PID:5392
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4564337144344269271,17744009904780387897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1836 /prefetch:1
                                2⤵
                                  PID:5560
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,4564337144344269271,17744009904780387897,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 /prefetch:8
                                  2⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:3440
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:2584
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:780
                                  • C:\Windows\System32\rundll32.exe
                                    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                    1⤵
                                      PID:964
                                    • C:\Users\Admin\Downloads\ep_setup.exe
                                      "C:\Users\Admin\Downloads\ep_setup.exe"
                                      1⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Drops file in Program Files directory
                                      • Drops file in Windows directory
                                      • NTFS ADS
                                      • Suspicious use of SendNotifyMessage
                                      PID:4436
                                      • C:\Windows\system32\taskkill.exe
                                        "C:\Windows\system32\taskkill.exe" /f /im explorer.exe
                                        2⤵
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4748
                                      • C:\Windows\system32\sc.exe
                                        "C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
                                        2⤵
                                        • Launches sc.exe
                                        PID:4132
                                      • C:\Windows\system32\sc.exe
                                        "C:\Windows\system32\sc.exe" start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
                                        2⤵
                                        • Launches sc.exe
                                        PID:3000
                                      • C:\Windows\system32\regsvr32.exe
                                        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host.dll"
                                        2⤵
                                        • Loads dropped DLL
                                        • Registers COM server for autorun
                                        • Modifies registry class
                                        PID:5972
                                      • C:\Windows\system32\regsvr32.exe
                                        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll"
                                        2⤵
                                        • Loads dropped DLL
                                        • Registers COM server for autorun
                                        • Modifies registry class
                                        PID:4612
                                      • C:\Windows\explorer.exe
                                        "C:\Windows\explorer.exe"
                                        2⤵
                                        • Modifies Installed Components in the registry
                                        • Loads dropped DLL
                                        • Enumerates connected drives
                                        • Checks SCSI registry key(s)
                                        • Modifies registry class
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of SendNotifyMessage
                                        • Suspicious use of SetWindowsHookEx
                                        PID:2748
                                        • C:\Users\Admin\Downloads\ep_setup.exe
                                          "C:\Users\Admin\Downloads\ep_setup.exe"
                                          3⤵
                                            PID:5008
                                            • C:\Windows\system32\taskkill.exe
                                              "C:\Windows\system32\taskkill.exe" /f /im explorer.exe
                                              4⤵
                                              • Kills process with taskkill
                                              PID:1564
                                            • C:\Windows\system32\sc.exe
                                              "C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
                                              4⤵
                                              • Launches sc.exe
                                              PID:4972
                                            • C:\Windows\system32\sc.exe
                                              "C:\Windows\system32\sc.exe" start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
                                              4⤵
                                              • Launches sc.exe
                                              PID:5220
                                            • C:\Windows\system32\regsvr32.exe
                                              "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host.dll"
                                              4⤵
                                                PID:5884
                                              • C:\Windows\system32\regsvr32.exe
                                                "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll"
                                                4⤵
                                                  PID:3504
                                                • C:\Windows\explorer.exe
                                                  "C:\Windows\explorer.exe"
                                                  4⤵
                                                    PID:1660
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                              • Loads dropped DLL
                                              • Suspicious use of SetWindowsHookEx
                                              PID:4208
                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                              1⤵
                                                PID:1988
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:5532
                                                • C:\Windows\System32\rundll32.exe
                                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                  1⤵
                                                    PID:4808
                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                    1⤵
                                                      PID:4988
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:3804
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:4940
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:656
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:4408

                                                            Network

                                                            MITRE ATT&CK Enterprise v15

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            • C:\Program Files\ExplorerPatcher\ExplorerPatcher.IA-32.dll
                                                              Filesize

                                                              151KB

                                                              MD5

                                                              a0eb5f36996f922a1c2317310b68b6dc

                                                              SHA1

                                                              cbc47dd09f1dd86b4621038f8aba88faf94c0e80

                                                              SHA256

                                                              d35c7f813627e0f34b32763e40b1d24e74c3f0f6517f1c9ac71218ef028cebda

                                                              SHA512

                                                              8849ac97086609be01ecf4ed517582477c2f15d1f1efd1636e13ad732f356e56770f6130ef533008d049e9b27b7886fea8e6b244b1810107a12725944d94550b

                                                              Download Submit

                                                            • C:\Program Files\ExplorerPatcher\WebView2Loader.dll
                                                              Filesize

                                                              136KB

                                                              MD5

                                                              c44baed957b05b9327bd371dbf0dbe99

                                                              SHA1

                                                              80b48c656b8555ebc588de3de0ec6c7e75ae4bf1

                                                              SHA256

                                                              ad8bb426a8e438493db4d703242f373d9cb36d8c13e88b6647cd083716e09bef

                                                              SHA512

                                                              ad1b76594dca7cde6bbcde55bc3abe811f9e903e2cf6613d49201e14e789cfc763cb528d499dd2db84db097a210d63c7d88cc909ca1c836d831e3519c2ce7b35

                                                              Download Submit

                                                            • C:\Program Files\ExplorerPatcher\ep_dwm.exe
                                                              Filesize

                                                              115KB

                                                              MD5

                                                              45541d4fc2b51689fa8f4e46cfa743ae

                                                              SHA1

                                                              ff961630a339fcb66fc11a481f0c097e6d55fafb

                                                              SHA256

                                                              78ed70e70054566dd60afd6536805d6aca382509664e7a77fae74ccb2f0fd1cb

                                                              SHA512

                                                              968c1940440568498d050179a6fd92f203dc9efcfe003a13e8ef80221766ca70350233b68803aee0287bc278f8554fa8cebc334da4558ca66d908da1a88ed6ef

                                                              Download Submit

                                                            • C:\Program Files\ExplorerPatcher\ep_gui.dll
                                                              Filesize

                                                              578KB

                                                              MD5

                                                              37fc9dc443a51d38a73c65f59ee4ba0f

                                                              SHA1

                                                              5e5c62aad0ee2888a078ef19d6980b0207149917

                                                              SHA256

                                                              4698e09658fdb4a352aa9448c271470f8446dc8c0b6747a2bc26a0f51a76d323

                                                              SHA512

                                                              e317a8db4008adf8d3ac59c9881232ced516925baf7c1f10db8db840c9e1fb0e45f30a0d1b35a8d3917a0fd22b39a278e60e6726e2e40d7ba95955b366fbf9be

                                                              Download Submit

                                                            • C:\Program Files\ExplorerPatcher\ep_weather_host.dll
                                                              Filesize

                                                              236KB

                                                              MD5

                                                              5a23a64d9267c2534e53b0b09181876a

                                                              SHA1

                                                              3c5d6d93d64204a28c2244a018687651ba437b0f

                                                              SHA256

                                                              86dde99b9ae74fc50c8dae7159034d32ecb000275cfc8cf9392b5e7f96b1d67c

                                                              SHA512

                                                              4c8760b970173ed041fd3716b082b61738a65d9a6fadd2eae1e5a2dcd225efc35e84d9d886b0b662f433a2b01c4ae985f861aa0b6d1800eaca62a3d8a7e5dcc1

                                                              Download Submit

                                                            • C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll
                                                              Filesize

                                                              109KB

                                                              MD5

                                                              67573e80163a00e588854452ee70347b

                                                              SHA1

                                                              8aa26b013321504a7f67e59e1ecfcce3667d20ed

                                                              SHA256

                                                              5cef5e9812c3923a48d92ab9ca120251cc678a44f209224e3d676b4063b532b7

                                                              SHA512

                                                              f0ec2b0ca97b4c38f6d6e3873137ecf087a5011bd7ec4d57666a5ec7f7025259bc321e0814b086adb02c97b331c3f25a033010c036b5abf7dba91b5e548dd7e0

                                                              Download Submit

                                                            • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ExplorerPatcher\Properties (ExplorerPatcher).lnk
                                                              Filesize

                                                              1KB

                                                              MD5

                                                              89c725c90f00f1952820e92fcf200e3d

                                                              SHA1

                                                              c1ba6dd7db321f481049cbae878ad04108fb7ed4

                                                              SHA256

                                                              354e1de2f0fdb70225469543a5b26b61b5c6950070d9f36956c6254ee2a06cdb

                                                              SHA512

                                                              9c2b20be76df7732979288ba0c094ff52016baea59a9eb8fa00668b9c8f5936b0685aee381c440fe2d719a29303bc4deffdcecd625cd59e07eac508a9abae94a

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                              Filesize

                                                              471B

                                                              MD5

                                                              08b0eaed5bacc4ccba435a1ef3df3456

                                                              SHA1

                                                              e0a3acaf0add55ca50978278cb4fd6e422e85975

                                                              SHA256

                                                              33670faaa69014d383b020e08562f82bdd5fd9a6b9d0d9845565c2ad910ec1fa

                                                              SHA512

                                                              2486dbce250cbb997a543ed95daae178525156d994535c0cbac2a2de1cfe59116fb8aa49165257b8206d4fd261295e3a365fa85918372454e770f85aa8f157f6

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                              Filesize

                                                              412B

                                                              MD5

                                                              316c85df92755baf345202143d9177e3

                                                              SHA1

                                                              13ee94861ddd3d5b88e1f42b798bc88a620d6d37

                                                              SHA256

                                                              2f44c7925cddf3ec61b1ebacaaffc83b6c778db15413a212dfdd18178bd98aeb

                                                              SHA512

                                                              612c81adbfa88bcc63b523df4d33612625c1029ab1d012e03ba4ae0bb4e4357bcaf941813fdaaa1dfbce805e1112e1a46ddf017df22360932cc11ab3415520d8

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                              Filesize

                                                              152B

                                                              MD5

                                                              36bb45cb1262fcfcab1e3e7960784eaa

                                                              SHA1

                                                              ab0e15841b027632c9e1b0a47d3dec42162fc637

                                                              SHA256

                                                              7c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae

                                                              SHA512

                                                              02c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                              Filesize

                                                              152B

                                                              MD5

                                                              1e3dc6a82a2cb341f7c9feeaf53f466f

                                                              SHA1

                                                              915decb72e1f86e14114f14ac9bfd9ba198fdfce

                                                              SHA256

                                                              a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c

                                                              SHA512

                                                              0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                              Filesize

                                                              265B

                                                              MD5

                                                              f5cd008cf465804d0e6f39a8d81f9a2d

                                                              SHA1

                                                              6b2907356472ed4a719e5675cc08969f30adc855

                                                              SHA256

                                                              fcea95cc39dc6c2a925f5aed739dbedaa405ee4ce127f535fcf1c751b2b8fb5d

                                                              SHA512

                                                              dc97034546a4c94bdaa6f644b5cfd1e477209de9a03a5b02a360c254a406c1d647d6f90860f385e27387b35631c41f0886cb543ede9116436941b9af6cd3285d

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                              Filesize

                                                              6KB

                                                              MD5

                                                              f11face48bf8494eff95c3e3dc89b21c

                                                              SHA1

                                                              047102c3d02abcabfc699bf0936c512d41ab1eb4

                                                              SHA256

                                                              e00d2791c92f23ba86c2c20eef53aa47b28a29d7c18cbf943908467224808044

                                                              SHA512

                                                              be4760317b07d37d87349d1e875fda68029b4f4e9dc757fc9fa637d19233007d750e142d5cfa6de01acc4fccfc2385b5d5f237cdacdefa47532a359af9a36f34

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                              Filesize

                                                              6KB

                                                              MD5

                                                              eef6929209b769cf8da0c7b212fc94d3

                                                              SHA1

                                                              610c15c71a6b83313d6d55b4fef52fd02e89884d

                                                              SHA256

                                                              bebdfe995bb377bc3f11b0615311f4c7896e84affd6ce237f93790c76289cd53

                                                              SHA512

                                                              d056727b6ffc81faa02687c687d4d3f06a856423216babc5b41d52d275833fa8489779e24c955c4d8744fa30d02e5995d79eda572a594acb92bec549fc2e4d7e

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                              Filesize

                                                              6KB

                                                              MD5

                                                              2b086bf61e2185d91e3290e967df2603

                                                              SHA1

                                                              ad7c12bae62bf94668a0a825fb233adbac8f37e6

                                                              SHA256

                                                              8c76893587ebef5d924f6ab5bcab6e5ef21d5676616a5fa64269eceb7ab54f1d

                                                              SHA512

                                                              96e99dd98d11f483959c95251d2d1dcd0b2ffabd90cca2590c15c6166f0597ee864b069c4fdcfa52aa7102eaded741ebe40411358c15a00a0ee68b78a90ed206

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                              Filesize

                                                              6KB

                                                              MD5

                                                              54f397f740a52fe1155741a026377152

                                                              SHA1

                                                              0291219c924bfc9baff4b3f6bd3a9563f759e201

                                                              SHA256

                                                              4e0b533ec0a9fc645f245bc0ba608f953132dda791b440db2b119e85e25c0df8

                                                              SHA512

                                                              1803d31d3d476d38ec824a74563c9dac527993203f04209aff262474adcf834114d896e0d2cb5977eb46d780747a56881e4ef7288fbe79c8f99d019a25eb9e84

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                              Filesize

                                                              16B

                                                              MD5

                                                              6752a1d65b201c13b62ea44016eb221f

                                                              SHA1

                                                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                              SHA256

                                                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                              SHA512

                                                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              Filesize

                                                              11KB

                                                              MD5

                                                              c5408dae5746130d792765663d5a7b16

                                                              SHA1

                                                              9b29f615cfbb351902ad82dcb5b6d68089a2ea3d

                                                              SHA256

                                                              72abfe065022928520d9879c9f612e11739824661f0535332137ae20d1ff61cc

                                                              SHA512

                                                              2e9138c161522519423b36afc5dfd77311b94ebea102804dc551f0439f9d3ee450eb5138cd297e439528fe32546cec8e3ad24b62d0a7e9f3b9804ea2d942bc83

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              Filesize

                                                              11KB

                                                              MD5

                                                              9fa375a0748dc3d9ac114e051fdef984

                                                              SHA1

                                                              e236b23507f58bc63f9a29d412a439927ac77c9b

                                                              SHA256

                                                              0ec5fa47d2bcbcf73f569d5c3aa477a410114f022e0129d5249d4ddcb5b54d8f

                                                              SHA512

                                                              8b7ea70755d328134ddd467f917d9d1caa8ca8b701c51a934d6d69a40d9a2673d28ed42fe189b23b88151269b071b5c91e039ade007b556daa1b5597619db2fe

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
                                                              Filesize

                                                              1022B

                                                              MD5

                                                              8da87e9808007b3fef83a9ca1ad4764b

                                                              SHA1

                                                              e20317197272ac0dd55a6d60c494e6ac2e21f63e

                                                              SHA256

                                                              77605516638607e85c28724b36805738ae70f87c20da27235a41e82e4bb263f0

                                                              SHA512

                                                              5daff93ad22b32c0c0b34b15ee83bb3bb5793d7f4010cb9f17a97064512c7b3c72ec076c4d65381aefdc2894bdb73e4c41119ca462f84aaff4bca28ea2fc0eb0

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133546588867262006.txt
                                                              Filesize

                                                              74KB

                                                              MD5

                                                              80dffedad36ef4c303579f8c9be9dbd7

                                                              SHA1

                                                              792ca2a83d616ca82d973ece361ed9e95c95a0d8

                                                              SHA256

                                                              590ca4d2f62a7864a62ccb1075c55191f7f9d5c5304ea3446961bb50f9e3916e

                                                              SHA512

                                                              826b97a4de7c765f8f5ebc520960f68381fd9f4bfe68c2fbe46c6118110c9c14a87dcb8ed8102e60a954b4b3c408f72e7a93fd96317be3d51120a2ddd2faa3ea

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133546588961636484.txt
                                                              Filesize

                                                              75KB

                                                              MD5

                                                              f3379feece7bbe303dece70d7c9fbef8

                                                              SHA1

                                                              16942e19c16ddd6dbddeb852ca55fff7d640be20

                                                              SHA256

                                                              30662578e222a601ff16bb2965d004c833dcf88b5480bfcfcd7e9602e67df964

                                                              SHA512

                                                              af7ea38176733a0e4c0913dfdbcf04c9fd234930f0551febc9161832d565e8cc795b08241d490f19570be43ddbbe67d86680a7cbd08759038ba15fb681f81cff

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Q5ROSPP2\microsoft.windows[1].xml
                                                              Filesize

                                                              97B

                                                              MD5

                                                              bdb8a591dda2dd9c96d20d4b44a5d041

                                                              SHA1

                                                              9e75f7deb9825c0cda7e25f66f0221f5c74c8d72

                                                              SHA256

                                                              7fcf82e6510873bad2d4687d21bc368fdc7e8576a8d54fc94284e1dbedda172f

                                                              SHA512

                                                              79166507556413e667d3bc7d5f24f1d87aed86d7b03e04b5591343cf307468b7b0446adfdf0452edbd657e97e840fa446314be0250d2b2966bff67d1261db439

                                                              Download Submit

                                                            • C:\Users\Admin\Downloads\Unconfirmed 852998.crdownload
                                                              Filesize

                                                              2.3MB

                                                              MD5

                                                              7ea3f1aacb347b9acd4a536197330eaa

                                                              SHA1

                                                              beab07dde096910d7214d82dc12f383df1fa399c

                                                              SHA256

                                                              e44790e25db09d1fdcaa1b4a8e868a31d646a260c9df4923aea7be8efa0d8e1d

                                                              SHA512

                                                              cf1f53481b6b9f723e6832f027dd496ba1e9bad3bd797ab8626f0d84a17a0e115d717d3d0915954044867b5eabb20936cba1c44afe5ae23c8d75fc1dcc963493

                                                              Download Submit

                                                            • C:\Windows\dxgi.dll
                                                              Filesize

                                                              619KB

                                                              MD5

                                                              c2b7c0292fff860897c99ce9260d1715

                                                              SHA1

                                                              cef060346dd189ae8da2c94eb21e0e4c1149f4b2

                                                              SHA256

                                                              60591d5eef5a3e79019f98c7e1ebd18a4b58f8b74909ce7236cd1bd93d8342ed

                                                              SHA512

                                                              ea005ed166da70f807f9e7caacaac9c0f9dd4d57267a1da6a34c33f1334511ae8f6bc4ed0de9759e119f1769a5dbeaa146cc789af3afffb71c840630c2961712

                                                              Download Submit

                                                            • memory/1660-346-0x00007FFF91FB0000-0x00007FFF926EF000-memory.dmp

                                                              Filesize

                                                              7.2MB

                                                              Download

                                                            • memory/1660-350-0x00007FFF7DA90000-0x00007FFF7DCB0000-memory.dmp

                                                              Filesize

                                                              2.1MB

                                                              Download

                                                            • memory/1660-349-0x00007FFF7DA90000-0x00007FFF7DCB0000-memory.dmp

                                                              Filesize

                                                              2.1MB

                                                              Download

                                                            • memory/1660-347-0x00007FFF91FB0000-0x00007FFF926EF000-memory.dmp

                                                              Filesize

                                                              7.2MB

                                                              Download

                                                            • memory/1660-348-0x00007FFF7DA90000-0x00007FFF7DCB0000-memory.dmp

                                                              Filesize

                                                              2.1MB

                                                              Download

                                                            • memory/1660-352-0x00007FFF7DA90000-0x00007FFF7DCB0000-memory.dmp

                                                              Filesize

                                                              2.1MB

                                                              Download

                                                            • memory/1660-351-0x00007FFF7DA90000-0x00007FFF7DCB0000-memory.dmp

                                                              Filesize

                                                              2.1MB

                                                              Download

                                                            • memory/1988-243-0x000001B6A0400000-0x000001B6A1D2F000-memory.dmp

                                                              Filesize

                                                              25.2MB

                                                              Download

                                                            • memory/1988-219-0x000001BEA3820000-0x000001BEA3840000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download

                                                            • memory/1988-217-0x000001BEA3180000-0x000001BEA31A0000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download

                                                            • memory/1988-215-0x000001BEA31C0000-0x000001BEA31E0000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download

                                                            • memory/2748-142-0x00007FFF7DA90000-0x00007FFF7DCB0000-memory.dmp

                                                              Filesize

                                                              2.1MB

                                                              Download

                                                            • memory/2748-153-0x00007FF6D6110000-0x00007FF6D65AD000-memory.dmp

                                                              Filesize

                                                              4.6MB

                                                              Download

                                                            • memory/2748-159-0x00007FF6D6110000-0x00007FF6D65AD000-memory.dmp

                                                              Filesize

                                                              4.6MB

                                                              Download

                                                            • memory/2748-160-0x00007FF6D6110000-0x00007FF6D65AD000-memory.dmp

                                                              Filesize

                                                              4.6MB

                                                              Download

                                                            • memory/2748-161-0x00007FF6D6110000-0x00007FF6D65AD000-memory.dmp

                                                              Filesize

                                                              4.6MB

                                                              Download

                                                            • memory/2748-162-0x00007FF6D6110000-0x00007FF6D65AD000-memory.dmp

                                                              Filesize

                                                              4.6MB

                                                              Download

                                                            • memory/2748-163-0x00007FF6D6110000-0x00007FF6D65AD000-memory.dmp

                                                              Filesize

                                                              4.6MB

                                                              Download

                                                            • memory/2748-164-0x00007FF6D6110000-0x00007FF6D65AD000-memory.dmp

                                                              Filesize

                                                              4.6MB

                                                              Download

                                                            • memory/2748-165-0x00007FFF7D3E0000-0x00007FFF7DA06000-memory.dmp

                                                              Filesize

                                                              6.1MB

                                                              Download

                                                            • memory/2748-157-0x00007FF6D6110000-0x00007FF6D65AD000-memory.dmp

                                                              Filesize

                                                              4.6MB

                                                              Download

                                                            • memory/2748-167-0x00007FFF7CA20000-0x00007FFF7D013000-memory.dmp

                                                              Filesize

                                                              5.9MB

                                                              Download

                                                            • memory/2748-168-0x00007FFF89EA0000-0x00007FFF89EF2000-memory.dmp

                                                              Filesize

                                                              328KB

                                                              Download

                                                            • memory/2748-169-0x00007FFF89EA0000-0x00007FFF89EF2000-memory.dmp

                                                              Filesize

                                                              328KB

                                                              Download

                                                            • memory/2748-170-0x00007FFF89EA0000-0x00007FFF89EF2000-memory.dmp

                                                              Filesize

                                                              328KB

                                                              Download

                                                            • memory/2748-171-0x00007FFF89EA0000-0x00007FFF89EF2000-memory.dmp

                                                              Filesize

                                                              328KB

                                                              Download

                                                            • memory/2748-172-0x00007FFF89E50000-0x00007FFF89E96000-memory.dmp

                                                              Filesize

                                                              280KB

                                                              Download

                                                            • memory/2748-173-0x00007FFF86E20000-0x00007FFF87039000-memory.dmp

                                                              Filesize

                                                              2.1MB

                                                              Download

                                                            • memory/2748-174-0x00007FFF86E20000-0x00007FFF87039000-memory.dmp

                                                              Filesize

                                                              2.1MB

                                                              Download

                                                            • memory/2748-175-0x00007FFF89E00000-0x00007FFF89E50000-memory.dmp

                                                              Filesize

                                                              320KB

                                                              Download

                                                            • memory/2748-180-0x00007FFF89E00000-0x00007FFF89E50000-memory.dmp

                                                              Filesize

                                                              320KB

                                                              Download

                                                            • memory/2748-181-0x00007FFF8EC60000-0x00007FFF8EC9B000-memory.dmp

                                                              Filesize

                                                              236KB

                                                              Download

                                                            • memory/2748-184-0x00007FF6D6110000-0x00007FF6D65AD000-memory.dmp

                                                              Filesize

                                                              4.6MB

                                                              Download

                                                            • memory/2748-185-0x00007FF6D6110000-0x00007FF6D65AD000-memory.dmp

                                                              Filesize

                                                              4.6MB

                                                              Download

                                                            • memory/2748-205-0x0000000003800000-0x0000000003801000-memory.dmp

                                                              Filesize

                                                              4KB

                                                              Download

                                                            • memory/2748-156-0x00007FF6D6110000-0x00007FF6D65AD000-memory.dmp

                                                              Filesize

                                                              4.6MB

                                                              Download

                                                            • memory/2748-155-0x00007FF6D6110000-0x00007FF6D65AD000-memory.dmp

                                                              Filesize

                                                              4.6MB

                                                              Download

                                                            • memory/2748-154-0x00007FF6D6110000-0x00007FF6D65AD000-memory.dmp

                                                              Filesize

                                                              4.6MB

                                                              Download

                                                            • memory/2748-158-0x00007FF6D6110000-0x00007FF6D65AD000-memory.dmp

                                                              Filesize

                                                              4.6MB

                                                              Download

                                                            • memory/2748-152-0x00007FF6D6110000-0x00007FF6D65AD000-memory.dmp

                                                              Filesize

                                                              4.6MB

                                                              Download

                                                            • memory/2748-151-0x00007FF6D6110000-0x00007FF6D65AD000-memory.dmp

                                                              Filesize

                                                              4.6MB

                                                              Download

                                                            • memory/2748-135-0x00007FFF91FB0000-0x00007FFF926EF000-memory.dmp

                                                              Filesize

                                                              7.2MB

                                                              Download

                                                            • memory/2748-136-0x00007FFF91FB0000-0x00007FFF926EF000-memory.dmp

                                                              Filesize

                                                              7.2MB

                                                              Download

                                                            • memory/2748-137-0x00007FFF7DA90000-0x00007FFF7DCB0000-memory.dmp

                                                              Filesize

                                                              2.1MB

                                                              Download

                                                            • memory/2748-150-0x00007FF6D6110000-0x00007FF6D65AD000-memory.dmp

                                                              Filesize

                                                              4.6MB

                                                              Download

                                                            • memory/2748-149-0x00007FF6D6110000-0x00007FF6D65AD000-memory.dmp

                                                              Filesize

                                                              4.6MB

                                                              Download

                                                            • memory/2748-138-0x00007FFF7DA90000-0x00007FFF7DCB0000-memory.dmp

                                                              Filesize

                                                              2.1MB

                                                              Download

                                                            • memory/2748-139-0x00007FFF7DA90000-0x00007FFF7DCB0000-memory.dmp

                                                              Filesize

                                                              2.1MB

                                                              Download

                                                            • memory/2748-140-0x00007FFF7DA90000-0x00007FFF7DCB0000-memory.dmp

                                                              Filesize

                                                              2.1MB

                                                              Download

                                                            • memory/2748-141-0x00007FFF7DA90000-0x00007FFF7DCB0000-memory.dmp

                                                              Filesize

                                                              2.1MB

                                                              Download

                                                            • memory/2748-143-0x00007FFF93770000-0x00007FFF93911000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                              Download

                                                            • memory/2748-148-0x00007FF6D6110000-0x00007FF6D65AD000-memory.dmp

                                                              Filesize

                                                              4.6MB

                                                              Download

                                                            • memory/2748-147-0x00007FF6D6110000-0x00007FF6D65AD000-memory.dmp

                                                              Filesize

                                                              4.6MB

                                                              Download

                                                            • memory/2748-146-0x00007FF6D6110000-0x00007FF6D65AD000-memory.dmp

                                                              Filesize

                                                              4.6MB

                                                              Download

                                                            • memory/2748-145-0x00007FF6D6110000-0x00007FF6D65AD000-memory.dmp

                                                              Filesize

                                                              4.6MB

                                                              Download

                                                            • memory/2748-144-0x00007FF6D6110000-0x00007FF6D65AD000-memory.dmp

                                                              Filesize

                                                              4.6MB

                                                              Download

                                                            • memory/4988-319-0x000001A253000000-0x000001A25492F000-memory.dmp

                                                              Filesize

                                                              25.2MB

                                                              Download

                                                            • memory/4988-310-0x000001AA55C60000-0x000001AA55C80000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download

                                                            • memory/4988-307-0x000001AA55850000-0x000001AA55870000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download

                                                            • memory/4988-304-0x000001AA55890000-0x000001AA558B0000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download

                                                            • memory/5532-279-0x0000023F0C600000-0x0000023F0DF2F000-memory.dmp

                                                              Filesize

                                                              25.2MB

                                                              Download

                                                            • memory/5532-265-0x000002470F480000-0x000002470F4A0000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download

                                                            • memory/5532-262-0x000002470F070000-0x000002470F090000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download

                                                            • memory/5532-260-0x000002470F0B0000-0x000002470F0D0000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download