Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1014s
  • max time network
    1054s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/04/2024, 17:57

General

  • Target

    https://github.com/BillasJS/Bypass-Byfron

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://directorryversionyju.shop/api

https://birdpenallitysydw.shop/api

https://cinemaclinicttanwk.shop/api

https://disagreemenywyws.shop/api

https://speedparticipatewo.shop/api

https://fixturewordbakewos.shop/api

https://colorprioritytubbew.shop/api

https://abuselinenaidwjuew.shop/api

https://methodgreenglassdatw.shop/api

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 55 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/BillasJS/Bypass-Byfron
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2556
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc51f46f8,0x7ffdc51f4708,0x7ffdc51f4718
      2⤵
        PID:464
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,6215528967717335601,10946973338930156966,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
        2⤵
          PID:3136
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,6215528967717335601,10946973338930156966,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:924
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,6215528967717335601,10946973338930156966,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
          2⤵
            PID:5024
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6215528967717335601,10946973338930156966,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
            2⤵
              PID:2664
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6215528967717335601,10946973338930156966,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
              2⤵
                PID:3644
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,6215528967717335601,10946973338930156966,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4140 /prefetch:8
                2⤵
                  PID:4532
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,6215528967717335601,10946973338930156966,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4140 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4624
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6215528967717335601,10946973338930156966,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
                  2⤵
                    PID:1724
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6215528967717335601,10946973338930156966,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
                    2⤵
                      PID:2268
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6215528967717335601,10946973338930156966,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
                      2⤵
                        PID:1428
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6215528967717335601,10946973338930156966,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
                        2⤵
                          PID:1960
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6215528967717335601,10946973338930156966,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
                          2⤵
                            PID:2504
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2132,6215528967717335601,10946973338930156966,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5604 /prefetch:8
                            2⤵
                              PID:5004
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6215528967717335601,10946973338930156966,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
                              2⤵
                                PID:872
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2132,6215528967717335601,10946973338930156966,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6140 /prefetch:8
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3584
                              • C:\Program Files\7-Zip\7zFM.exe
                                "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Ex3cut0r.7z"
                                2⤵
                                • Modifies registry class
                                • Suspicious behavior: GetForegroundWindowSpam
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of FindShellTrayWindow
                                PID:768
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,6215528967717335601,10946973338930156966,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4960 /prefetch:2
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:632
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:3164
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:3560
                                • C:\Windows\System32\rundll32.exe
                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                  1⤵
                                    PID:5084
                                  • C:\Users\Admin\Downloads\Executor.exe
                                    "C:\Users\Admin\Downloads\Executor.exe"
                                    1⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    PID:2108
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                      2⤵
                                        PID:3648
                                    • C:\Users\Admin\Downloads\Executor.exe
                                      "C:\Users\Admin\Downloads\Executor.exe"
                                      1⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:708
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                        2⤵
                                          PID:3904
                                      • C:\Windows\system32\rundll32.exe
                                        "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
                                        1⤵
                                          PID:2436
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k UnistackSvcGroup
                                          1⤵
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1060

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

                                          Filesize

                                          16KB

                                          MD5

                                          ccd990173e2ba86b3cfc1da39cf0e5ce

                                          SHA1

                                          4f83369af6ffa149f777cb4e32f578bee2875325

                                          SHA256

                                          7c31759196534dc2e7149f5612f53606cb12667a7604331e7f044f08d88dc473

                                          SHA512

                                          6ee40d06588d8252e2097838085e67d6bd86ef8bebeb334a553c80d770606055f787dcdc0a4709af50e105f89164777fb1ef932fa7c15898e220d205c3a9ebe8

                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Executor.exe.log

                                          Filesize

                                          425B

                                          MD5

                                          4eaca4566b22b01cd3bc115b9b0b2196

                                          SHA1

                                          e743e0792c19f71740416e7b3c061d9f1336bf94

                                          SHA256

                                          34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

                                          SHA512

                                          bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                          Filesize

                                          152B

                                          MD5

                                          47b2c6613360b818825d076d14c051f7

                                          SHA1

                                          7df7304568313a06540f490bf3305cb89bc03e5c

                                          SHA256

                                          47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac

                                          SHA512

                                          08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                          Filesize

                                          152B

                                          MD5

                                          e0811105475d528ab174dfdb69f935f3

                                          SHA1

                                          dd9689f0f70a07b4e6fb29607e42d2d5faf1f516

                                          SHA256

                                          c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c

                                          SHA512

                                          8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                          Filesize

                                          1KB

                                          MD5

                                          ef1102909883e615d393dedb63f3851c

                                          SHA1

                                          2fc62c7b3bb66515c63c806df70c4f0b8c5ac574

                                          SHA256

                                          1bc2a45515ca79a7b940cdb46db9dc41a28cef0419b4e1e356e7d0b30d1c64bd

                                          SHA512

                                          b4867b0dd30193847343665881480ebdc5f8f4da5fb42bb8d37facd3f0c0c068483e129caa66e280fe144066560ef4e381d309c3c2473ca68d398a8e8b1ff17e

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                          Filesize

                                          780B

                                          MD5

                                          391c0d6270e70547ebb9576a9cdc1387

                                          SHA1

                                          61cdbc2be72502bbedf766e26124425abf6338bb

                                          SHA256

                                          6d8a9c294759a223370eb2f3938ba4eeafa469e2759a83305cd8f7263189d888

                                          SHA512

                                          08511006151b3227313fb63879fc38a4e29a9a98fa2aaa2008248ebbc6b9981c144a6a3308cb39a7fb62ba70e8292911fe64fe2fbf18cd221b9fbe87f3d9030f

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          6KB

                                          MD5

                                          08b59e98e602ff01aee285294516b184

                                          SHA1

                                          962b2ab77116038fabf92f809f76e6537820a3de

                                          SHA256

                                          9494ba2a26e07db0aef586d67b8479bab2af9b81d72c90fb7bbf76bef0b79248

                                          SHA512

                                          84014c1efa496ed036f47c8c25f385954ca68eb7f7b76f15ad1beafc2b909b395cea13e223c71d1076b6a301c6b293b63c2c9366f2f1b2b475765b2bccdb715b

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          6KB

                                          MD5

                                          7b83bd01752fee040c1e0c1b03ec0332

                                          SHA1

                                          e306bb4baa7fd875191d6a4c51c146c031e71005

                                          SHA256

                                          11327151a71a56ffffa9cda97abcd6fb4d7b468c4b06737a963b87bf3c26d354

                                          SHA512

                                          260a95fb32877bb809e30207bf71b3bf0ad046a7d5fdfc69133b2911c8ee44598b1aa5ec0b9e997f4a128d2da69c77f7bcfbd3bf006d6500e9ebf9c84dabf6fd

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          6KB

                                          MD5

                                          9da11dab80f679987116b5ea376c4aba

                                          SHA1

                                          c57a4e551d77b5e4754551adfd3af2fa2151ee02

                                          SHA256

                                          be1a1088cd5ac9dd247192189c1d8858805fe0a81e164a0a435052752a4e2f5f

                                          SHA512

                                          3f55e1864a87cde0f4c4c998dbd0064b9990b695f7e14d355e87dec5cc9d3d1ed9eaf459633d4acfe19402172a5fddab1a23a6ff7727eccf5ce1f911543c2426

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                          Filesize

                                          16B

                                          MD5

                                          6752a1d65b201c13b62ea44016eb221f

                                          SHA1

                                          58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                          SHA256

                                          0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                          SHA512

                                          9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                          Filesize

                                          11KB

                                          MD5

                                          b2bf349f8eaeb720300a8cd2bcd0b5b9

                                          SHA1

                                          a447bc3410e1f8ddace52c5aa22ceb514cd59c2b

                                          SHA256

                                          0e636e31034e5867dc56326e9a349e4a1e9ccf6993cf16a5d21823441186cc57

                                          SHA512

                                          4a5a9bd454a6711f53d9799008fbe7a60e2ad8c2055440e52b045a7e969485ccb086ec9967e1cdf2e867dd8951dccb7424dcf1d9cf145136c587c47b97ac646c

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                          Filesize

                                          11KB

                                          MD5

                                          d9e2cd9d0a46df77d664a2c6ecf3e872

                                          SHA1

                                          23606c1422125b4192b6f6ec9ec9fc8a97e40170

                                          SHA256

                                          19478c52bfedb4595a572532c2f512c7185aaa78d6407bec942d4e388ffde6a9

                                          SHA512

                                          28aad5fd57d10e23e27517bbc5bee37a9ac639e1011cfa1598f40e3085f1990bac92026a699e90c3567cd52eb40ea3b4a22e92126478c41a3f1f5a1dc0f5dd3e

                                        • C:\Users\Admin\Downloads\Ex3cut0r.7z

                                          Filesize

                                          67.4MB

                                          MD5

                                          e3edb54a6009ee37be8ebae8eed63d60

                                          SHA1

                                          597a99082dc3b7d3426350e2573f57be284d2ef2

                                          SHA256

                                          73aaa65a9b223f160245231235036d96dc217667e3833e8cad65b434b4106208

                                          SHA512

                                          988c8ed93ac75fec84c15788b7d500b46f80b1a798ee15f92adf0fa9e81b38cefc737b8c6cdfabcecb782c7b63dd7523283204d10b26e7c79816e5daeda09fd7

                                        • C:\Users\Admin\Downloads\Executor.exe

                                          Filesize

                                          284KB

                                          MD5

                                          246558ed006f01b60498078cfa630990

                                          SHA1

                                          e8b28476ca22c13c7854d4977ae9a4fc0c6c0aaa

                                          SHA256

                                          85befba77a3bb1b50c1192d10fddd913ad927adbce5f404ea43e2be617a68543

                                          SHA512

                                          2d74dbb8f1e146ed0d77c87b711a7c452f483bfbde702956abff832cd5b96ba5984eeb3b2786e51e365f655ecfac146dba610cd9a898355d5bdf0f611311edcd

                                        • memory/708-329-0x0000000002830000-0x0000000004830000-memory.dmp

                                          Filesize

                                          32.0MB

                                        • memory/708-330-0x00000000750D0000-0x0000000075880000-memory.dmp

                                          Filesize

                                          7.7MB

                                        • memory/708-322-0x00000000750D0000-0x0000000075880000-memory.dmp

                                          Filesize

                                          7.7MB

                                        • memory/1060-420-0x0000028E5D6F0000-0x0000028E5D6F1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/1060-427-0x0000028E5D310000-0x0000028E5D311000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/1060-451-0x0000028E5D570000-0x0000028E5D571000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/1060-450-0x0000028E5D460000-0x0000028E5D461000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/1060-449-0x0000028E5D460000-0x0000028E5D461000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/1060-447-0x0000028E5D450000-0x0000028E5D451000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/1060-435-0x0000028E5D250000-0x0000028E5D251000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/1060-432-0x0000028E5D310000-0x0000028E5D311000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/1060-429-0x0000028E5D320000-0x0000028E5D321000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/1060-426-0x0000028E5D320000-0x0000028E5D321000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/1060-425-0x0000028E5D6F0000-0x0000028E5D6F1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/1060-424-0x0000028E5D6F0000-0x0000028E5D6F1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/1060-423-0x0000028E5D6F0000-0x0000028E5D6F1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/1060-422-0x0000028E5D6F0000-0x0000028E5D6F1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/1060-383-0x0000028E55040000-0x0000028E55050000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/1060-399-0x0000028E55140000-0x0000028E55150000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/1060-415-0x0000028E5D6D0000-0x0000028E5D6D1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/1060-416-0x0000028E5D6F0000-0x0000028E5D6F1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/1060-417-0x0000028E5D6F0000-0x0000028E5D6F1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/1060-418-0x0000028E5D6F0000-0x0000028E5D6F1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/1060-419-0x0000028E5D6F0000-0x0000028E5D6F1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/1060-421-0x0000028E5D6F0000-0x0000028E5D6F1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2108-312-0x0000000002A60000-0x0000000004A60000-memory.dmp

                                          Filesize

                                          32.0MB

                                        • memory/2108-303-0x00000000005B0000-0x00000000005FE000-memory.dmp

                                          Filesize

                                          312KB

                                        • memory/2108-313-0x0000000075340000-0x0000000075AF0000-memory.dmp

                                          Filesize

                                          7.7MB

                                        • memory/2108-304-0x0000000075340000-0x0000000075AF0000-memory.dmp

                                          Filesize

                                          7.7MB

                                        • memory/3648-307-0x0000000000400000-0x0000000000449000-memory.dmp

                                          Filesize

                                          292KB

                                        • memory/3648-310-0x0000000000400000-0x0000000000449000-memory.dmp

                                          Filesize

                                          292KB

                                        • memory/3648-315-0x00000000026A0000-0x00000000026D2000-memory.dmp

                                          Filesize

                                          200KB

                                        • memory/3648-316-0x00000000026A0000-0x00000000026D2000-memory.dmp

                                          Filesize

                                          200KB

                                        • memory/3648-314-0x0000000002820000-0x0000000002860000-memory.dmp

                                          Filesize

                                          256KB

                                        • memory/3648-317-0x00000000026A0000-0x00000000026D2000-memory.dmp

                                          Filesize

                                          200KB

                                        • memory/3648-319-0x0000000000400000-0x0000000000449000-memory.dmp

                                          Filesize

                                          292KB

                                        • memory/3648-318-0x00000000026A0000-0x00000000026D2000-memory.dmp

                                          Filesize

                                          200KB

                                        • memory/3904-331-0x0000000001660000-0x0000000001661000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/3904-332-0x0000000001660000-0x0000000001661000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/3904-333-0x0000000000400000-0x0000000000449000-memory.dmp

                                          Filesize

                                          292KB