Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
24-05-2024 21:49
General
-
Target
2024-05-24_f9b5d75c63f54c99d6325a717e76a5fe_ryuk.exe
-
Size
5.5MB
-
MD5
f9b5d75c63f54c99d6325a717e76a5fe
-
SHA1
9324f09d22c40340b6dc9e93dc0b3ef387fad538
-
SHA256
d87a1fd0dc1de166a2a5bef60285999001582e368f4b4c6acb467631ef7d4997
-
SHA512
8f5829442a48486e2f3247b4b57ef24eb2b78e0b6a021b0e1d9403e8450d5e49d4c1036585b4c74955222e3bac59a9420ce12c59b780a6caa53ad9c97dda44ee
-
SSDEEP
49152:4EFbqzA/PvIGDFr9AtwA3PlpIgong0yTI+q47W1Ln9tJEUxDG0BYYrLA50IHLGfM:WAI5pAdVJn9tbnR1VgBVmW8F1b6TwY
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 24 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies data under HKEY_USERS 64 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_f9b5d75c63f54c99d6325a717e76a5fe_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_f9b5d75c63f54c99d6325a717e76a5fe_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_f9b5d75c63f54c99d6325a717e76a5fe_ryuk.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_f9b5d75c63f54c99d6325a717e76a5fe_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2c8,0x2cc,0x2d0,0x29c,0x2d4,0x140462458,0x140462468,0x1404624782⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5429ab58,0x7ffe5429ab68,0x7ffe5429ab783⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1932,i,17196873777076832018,334186639555457871,131072 /prefetch:23⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=1932,i,17196873777076832018,334186639555457871,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2076 --field-trial-handle=1932,i,17196873777076832018,334186639555457871,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3032 --field-trial-handle=1932,i,17196873777076832018,334186639555457871,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3040 --field-trial-handle=1932,i,17196873777076832018,334186639555457871,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3508 --field-trial-handle=1932,i,17196873777076832018,334186639555457871,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4420 --field-trial-handle=1932,i,17196873777076832018,334186639555457871,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4564 --field-trial-handle=1932,i,17196873777076832018,334186639555457871,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4692 --field-trial-handle=1932,i,17196873777076832018,334186639555457871,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings3⤵
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff6946eae48,0x7ff6946eae58,0x7ff6946eae684⤵
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=04⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff6946eae48,0x7ff6946eae58,0x7ff6946eae685⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4760 --field-trial-handle=1932,i,17196873777076832018,334186639555457871,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4676 --field-trial-handle=1932,i,17196873777076832018,334186639555457871,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 --field-trial-handle=1932,i,17196873777076832018,334186639555457871,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4900 --field-trial-handle=1932,i,17196873777076832018,334186639555457871,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 --field-trial-handle=1932,i,17196873777076832018,334186639555457871,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5068 --field-trial-handle=1932,i,17196873777076832018,334186639555457871,131072 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 8962⤵
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exeFilesize
2.1MB
MD515afaa9238e278b5f13e50b4e6a19705
SHA1f206a490ba5d2f7189beef40bb368900529ab4e5
SHA2563f5c3137784914e4dc6fbb9cfef14388174192cac7d146d22f0b9df10cf301a0
SHA512c6c7740680f3245c969ff3731bc88613609402243110a7fb39cbc766510c8b9ca69aaf6f6448c2b25ea9279bf3a56c1cdaafc11d683f4cfdd62f04d3af601358
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exeFilesize
1.7MB
MD560d20f1854e7d77f03cabe078d98b80f
SHA1957ac5d9fffb53155ba4ff0a965b6be80a8104ec
SHA256f55cb7a4c413763c09e37297af16e6baa691ce0c180854d1241ec4eb87583f76
SHA5126cb0a15d876283b0d82c6c5c492346dcb6c01236364b14534e302d0e6872afad059b130f034ba6fa4c81d572df33933c70915b2f2a1ba5aba9ca04937f84c680
-
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXEFilesize
1.7MB
MD57f2b4eb2667b07a6ad3988cd7c6c4c0e
SHA1fa02e413028c5da9b6726b4b2d97046540ea768c
SHA256971f12e5ca12a3ea10bb1d395945e2097502cf383b1d729d02b1cbaf5c828390
SHA51256e3ff2ed5b36a664efb775d49f1f352eae546e48fdc0a3782cd9edb802dca41e7572dcfdcf95ee316f5915139f2876d407bdf1c85de2802f56b418bdc7422cf
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exeFilesize
2.2MB
MD5b9784f466fd58d3ee9475fb64293e570
SHA107ef96ae9f34fe858e0b69627a3a76a12c33285b
SHA2560c32a04012ffbbb6f3dd1c79c00d0c8c401a142ae12f13bf7076ceb450220499
SHA51263ee5d7de0390798c77a976dec28bbfa5a1cf6bfe504dc1298d40427f1aa794ff16c499719ed59f613c2104948ffa4458eedfdfee39594af83adfa726aed81b9
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\9921d4bd-5d92-4ae0-b994-cbcd65584b50.tmpFilesize
488B
MD56d971ce11af4a6a93a4311841da1a178
SHA1cbfdbc9b184f340cbad764abc4d8a31b9c250176
SHA256338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
SHA512c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datFilesize
40B
MD589f55681cd116518c116754e0407b2c8
SHA1f5d4aeb85e94ba181091d6a1ebca93915919c9c6
SHA256f36101d056932eba1217b54d3ee1c54e0c6c4120087bf1e1e0781625d2be6fc9
SHA5128db0dc249a77703508e63c8314af4bddcf54ac4f887b26409f743b344b94f9afe762d266cbac8b8097ffb28870d40841c7f64ed60acd087dbc1768db15b1c0cf
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.icoFilesize
193KB
MD5ef36a84ad2bc23f79d171c604b56de29
SHA138d6569cd30d096140e752db5d98d53cf304a8fc
SHA256e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
SHA512dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
1KB
MD544a8f4b3d5ac1d28bacb2356b3e16541
SHA18222a8aa3814044b50084f54b5117d95978365d9
SHA2569d94eec7101a6fac6bf8f001b736d805471443ee7dc038dd9c1a151c4ceffbd6
SHA512c788492a62649762dcae2d17f64112a6eb86e5a2dc9fd3974935446e83611d1ba48d3f8c71b5bce4152ea3b8814176c12e412319e234f360d9a7c1b22ef299dc
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
356B
MD549b4b4abc0a117f46b503153ee635043
SHA1630230e0f81d67dd1ad4f79fa0f984e2ef8243b9
SHA25629557cf07447a191b8451ae3262faf093c22af5f0457e3b65c9dcb0cf16957f6
SHA512e4351d86d78fc9230c91e3075053a2faa37f5f69dbd89104efca17d9ab4eec326e4ad0bc9586cb5339fdfb67baf07d6c67d1788f6becba7148bbfc57d3149914
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD5153fe4e53b4339e51a12aa984df99a35
SHA1819dca96c7f67204df9c821076352582c172dfd7
SHA2561ae2f92369508b2d873e695e777db7110a5ad1f24daac5d5e17134e7eff78a24
SHA5124f408f1d1eb96ec945e85d22a430b8ca5c822daf187bec02466fbc83c889da9af0aceadd8b8101ca3469a550e74475bdcfa611e505ab2d754e02642247893ca7
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe577995.TMPFilesize
2KB
MD58e5632bb5baca5f24f88c9e2a8eb2b6d
SHA171f7dee86640b602595b40c6a65d7ed4498cf00d
SHA25688575950e262396bd009db3c75b18b3a1cd44b7b869b90f9b2c961ce9b74c1ad
SHA512def476d83ba944f2fe83839108072677672a230218192751dd5e37305d42816e2db59b6f368fe8d3ca8848542ac3e3732dea3a58187c1e14f372ff2f721dffcc
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
16KB
MD552c0a1205f62c5db38dd0456b6ee4c7b
SHA17ac1c418998629c1d754c9354affd0b4acd22b29
SHA256ce3097efe7fdfec0984d80e68a3a07735e1d37385322707a4278721136a08eb1
SHA5129ceed29500769cc5cb6780e4483c8af52b7437769ccccab2c2620786d83624d69703926ec71a898e00922e794b5e223ab8ce0bbff273395062392537f40c133f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
257KB
MD5c0eabff2cc25079723db5b77bfe9085a
SHA188202d9d7e4d21e3b7997f1cd9d5d952dc188360
SHA256abdd6da7a5d7e81e096eaf82bfd4e0ab265a662057130dc018a54030d2224a3b
SHA512e4cf048323ab1a6a3887d3b6d17c225785cb04855d907fb78f1bf8857685bd11b3f19b86e19ec0bc74d5d4bb9fa1cb0cb95a584ea2383a8780768f90e0aca8bf
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
262KB
MD5d26183de54c0c816925848a07301abc1
SHA137b344c49a37ede733a03d07868119d5cd6285cc
SHA256ba28e918ce44cb4aae2b60e9c119cd188356c7f243c62b760fe3416c836ce9ac
SHA512fa93ff570295c7aaed91dd7fff61a3d1616de5b7536969ff0692d399bc756d8bceefd30e28d9379c984fd0dfc573ec5bf3f9ce5e7b259ec96e30b6b56bd1a213
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
262KB
MD50cd9e686790628acabbd3ac9d5cbd6ee
SHA13744593f72adf8ffac1b9f618c7897dcff5d379c
SHA256461cb9161ac6a9e0a8ebf3a26bccf5ef4e4e4a383dd54a9bb1b26caba011e4fd
SHA512e1189e932515767a3161cafa5b42b80a42ad34c4359539bb69a950d4ff35736a625533d86285b1d6775ed3829f75d7532eae02bc68e51527112721a39c897088
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
282KB
MD536e4c00f10ac481c7d2347f822108793
SHA11c3ec4d0bdb7c7f30fd45a6aac3bae011c5b4f6c
SHA25628167b6f70296d38027950659fbf479ccb4191105dfe62740b0f145722967364
SHA5124e1de73c8ddb93379556c724f13c52adb06b95012d35af90e9942eeac83de70a85109df7ea71cae836a1d2a95ee645028475eb8966bc841de508a78bae3372be
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info CacheFilesize
91KB
MD5f6c375ff7b05f29e351ef1d9e7eacc0d
SHA1c01433db0a9d6083f1ddf93ea197b94c3009ce15
SHA256fdff3ac59ebd3d741dfef77f8c98446ede940b81728d7fa70ad0b15c63635912
SHA5127c28dba63b1b119ea6efab3088838b71257d70d0dbd182bbaf174a01abb675106404604fb0b3388b98a2c0e4947960fb47f6e6c7a3dddbde67a14bc83213beaf
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57ef03.TMPFilesize
88KB
MD512cb0ab81ff24b822381934d112fea03
SHA1c38d28b7d8e1621676d46f829670e847c8ffc14d
SHA25696b3c69f660da51801bbc845c6f445aa8cde506ea602e6c0654fa0c25f29d518
SHA512993c4ac996315ea80fdc07d2a6ec5511d2fb7e4483d195346325730c24229869ca71ea607bb9ffcdefdb8708db3239a720586b71addee83928ad90a1e18323b2
-
C:\Users\Admin\AppData\Local\Temp\chrome_installer.logFilesize
7KB
MD5f0eeec3afde24596121cda38931ab7d2
SHA10db40649f62fa64cb4771a4ff6bc0c7a1324e310
SHA2566305b2f5b555a5c1e91770eaf82c7677afe76f70d40cfb2beafff2ca5be978fc
SHA512a01bca29a061d07d1faa72d21056deaf4c7ffeda42e7ab10e97e0b11146f3d9d09aeaa5fad36ed57881a18d1ec419ff3e50c122d52c9fab9ce12101be36817d4
-
C:\Users\Admin\AppData\Local\Temp\chrome_installer.logFilesize
8KB
MD598426ba5dfa1c6b7c54b1bf8bfec33ca
SHA1fe02c9b06108160d66211729741fb404b6a078f8
SHA2564734d9f6cc33ddfdba9da9ca562839ca1c4310cfb7cdfc117efc7add392c950e
SHA51228ee180186608cc29b0571284aa88c7dfcf8967a28658f0511443e4045fedf3aa11f14133c605b3293c3e6d2543c4a53af2b222e48c2e0971fa80b7b1cbf5e27
-
C:\Users\Admin\AppData\Roaming\b3a42c29c8648821.binFilesize
12KB
MD5859110e5ce9a78039b22988270b2dd9e
SHA1e5adda9068cfbf6fbb4c4c9f55cd62f34e37a6d3
SHA256dcae54469f484daf6edb7ee2eefb061d23c950ea8b6dcf1a46bdd0e935165eb3
SHA512609a1203c7788331568ead4f035e16fbbf393b37ed1bf5c9e4b4fa4202ef0f06237d258afac4c5b7c98964ebe4c60d58c3999c6cd81c44fcbc91d3e311b5cdcd
-
C:\Windows\SysWOW64\perfhost.exeFilesize
1.4MB
MD5438063f7253c3416bde00d28d67e7d1b
SHA157718e12e92e49d0d53870f7f4dd3786674ecf35
SHA2562ad22378c818f03fbf30a9da7059d061f8bb3d8924d41a44539c1d619e5fbec6
SHA5128588c8002e704cc3e930e1a8aff470ce83cc30077a447e9246e9658f793d49b433440e31e5ed8c26d94cab6b86997e4d5870e0d571909da9a6a17900c6813bf2
-
C:\Windows\System32\AgentService.exeFilesize
1.7MB
MD5c4348a57085137727da0fb00739ba55d
SHA1856bfee76f8f42506ef406472f218ed6bd0160f0
SHA256a313b28b044ae53cd2c60cd9e8962aba96bc7c7a9594fad3829a3a84fecc5369
SHA512c8faf6f8d6e30c3a5f055116ace8a0ff956b70ad06f2ba4f3307b7f6c44256baa74153f7324381dc6c548dea3c85aa21e26f5eae8255765673d3359a473507e9
-
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeFilesize
1.5MB
MD525e78dffa111150c2dad39d9b68004db
SHA17c0a2ce777140dd31c68bc1784922d0c3bdb8e46
SHA2562e864e8c50bf805e55b60d0cc0d687032f76e52bc3072fa213e42fdc03b4ceb7
SHA512bde9163bad9b2ebc1c7384ea5ef26b8daa31f20da89b0f3eb80519e8bd70dac0f9cbfc69d7ff71582b9edde75c784fa3958c4f48e07f123791bdebc113ee4579
-
C:\Windows\System32\FXSSVC.exeFilesize
1.2MB
MD55673e91d71466c4b1b596a5e36ff3e8b
SHA1eee904f6da255ba5ff6711d53d27328a69d2cf6a
SHA256adf88a17c3220020c18407b4082d9f0533fdc7582413fa5515a46a876e10be8e
SHA512106aa716bdcfbd4ff46bcc15bd52956dd5958324e111ad87b0d93f4751e60d652b8d4badbaa26073b272200c0e881fd49c4354d55cc2f145ad4cd0f1b2adaf17
-
C:\Windows\System32\Locator.exeFilesize
1.4MB
MD5fd50dabcff609c03c7105101d3f4a292
SHA182f69f17c594f67baa626468907ef7856acfb6ed
SHA2566e7453f8e536026b7cf2cb148fe043d03ccfa4463e2ff444e7e177f0bbea425a
SHA5128766d2e7c412eed247336ce670dffa47d1cddfa6650438fcc5aa94c17ced344e6128cbc36c3019445f7ae92becf91a58bca21f8b3e3d0836c5b4dcdeaab62838
-
C:\Windows\System32\OpenSSH\ssh-agent.exeFilesize
1.8MB
MD5b20eac845a752b2b59149a6a0f752044
SHA14d28366d5699285ed47048955f7fa5f1db549425
SHA2562bf25957fcf5792e9faa1c95652d4acd325f646cb7966399c4443bb48f4856e0
SHA512cc21f1ecfa0368f6a7049fbc9ffa7621f4b2e1d587da10a074c6740e01904fb2375d01bd77bf8ecd14f837e08f405e951f8e123e686f409520b29e32f90b48fe
-
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exeFilesize
1.5MB
MD5a1c29e5188bf170f17f634214f07d285
SHA1636e0a56f0edf757863b5a68d35c256fa797bfc2
SHA256dfa5b61a3e2b09e2736c284b25e7d6b44ff665e74956d1ee394e5b3831c45a33
SHA512c68d3494e6792114548cda0dbfb750db353f70492f519e9707271ea717fe00c2acf3f681ebe0a1d54363af6d177b18e4df4238d9641779da8f9bfa84d59efdd1
-
C:\Windows\System32\SearchIndexer.exeFilesize
1.4MB
MD533b0391c95f48f0f1bf0ed0ca0831f98
SHA13dfe5551f005d5b4b3933b0ac8f6810693301485
SHA25670d358daf0c53f9ae800c20e29cde814815808211de2cd3a5d79e50972beca03
SHA512fcebcea49020255eb150770660f612a8318135b7af48eb499e0510b8e8786714fb67d1deddbd1db4024b4c0186a2a4a786b18086ae2c9695c17e3cf643025f67
-
C:\Windows\System32\SensorDataService.exeFilesize
1.8MB
MD5c5c350f124393469f400e3cbd3ee9e08
SHA1dca21c1be17c49bdd5c969a60834d25f830d5665
SHA2561b8e2ae3b681bceb15be7c6a49b568ba5b0257d66657ac0cbabe1e2740fa77ed
SHA5129068ae23c7f5db06e163c855428f512880924f48decc27a7fdc4915bfb3aac1a31326368441ed8f5709d4fbd13555bfb77b32bc4f26c697fa24f18b46532cee4
-
C:\Windows\System32\Spectrum.exeFilesize
1.4MB
MD5fdb98503326592d7eb57ef77d9b3e670
SHA19bd90d6cf1cf2999b1101cdefd47d0bf0a430014
SHA25626ffff5c5e3107a40ac03aba14ced2701a7049f677deaf30abc314fde2297a34
SHA512521365cc5100fa2b1e797850712c70885fc0b47a2d851fc564c933a58a1135ebadedcd03e6cac31e8c0a6b65154d06332ca18d1017201623691ce4be0afb9f51
-
C:\Windows\System32\TieringEngineService.exeFilesize
1.7MB
MD526009581581bfa84639b9abdf2b7c497
SHA17a8aad2126425b9aa503d7d6f27f9104ec72a8ec
SHA25619f976a2eb7132b49b7afde8e3448c4d7fbe9142b3c1cd5f018f41b57450c830
SHA512cd013f7f3de77ea7543d3186c584b072b3630a560ebe0ab2b69b45fdf7ac4048c827aea7cc959c3c846f17cad3de4eadd7001fb2c097a0cc5f6842e830d3a8c3
-
C:\Windows\System32\VSSVC.exeFilesize
2.0MB
MD5f0b3e17b8e427857cd6dc25a829b0ffb
SHA1663e40ca0cb632e44f9247df47c25859d11cd4c2
SHA2561cbf1829ef4e99f7936d127ae25e01049969a8c1dc78862c82d632fd6568fb42
SHA512c7e895fc7f500b645401d9a675d8604338cf08ce972c6084cf6247643977dbbb6d946d91e2db7063d8987f61689b6df2a7016fb7b30bc8c7e107298438a5e52c
-
C:\Windows\System32\alg.exeFilesize
1.5MB
MD57246ec2cee75edeae1284d26afe577ff
SHA1e2281d00c816701a1509fa7c29477723bfc66c44
SHA256cb706b656327f12941ce2aea41c6cdde63fe441522a865c6ee112af9d6b73342
SHA51274f55bb980186b7d598e17600705c1998eb4a5df25215101e156250d9212367bbae2a5eb4bc5310675ea380b8aba4495a92c550833385c2438f557197e7da196
-
C:\Windows\System32\msdtc.exeFilesize
1.6MB
MD524ba2a126a69ef7fdf0837d2324c63e1
SHA13b7469b4b276c6019121eea9f51947fbd6660341
SHA256e6e91fa2a6e203bdc3f569f9c00220d220350f7ec9b873aa114932ebbf37c278
SHA5129df1f7588df135d0ca3dcb2dc5408f5a4e3d2a9a1ed48350eb2831e4e4befae14a07b74eb9d0e0bdbbc8dc30b586f15af7463cb361c23d6c3ab162f8130bce41
-
C:\Windows\System32\snmptrap.exeFilesize
1.4MB
MD5b79b0c1eb8fcbadb4f40d45fb5862c55
SHA1e4077949bb3f33e29da3ad2b594bacd79507e16c
SHA256ef0e65624c152db5fb88711502956fa52874b3c0529b7dfab7d3bf9eb296d6d4
SHA51283f724774350b0e0df197762ba74657247dfc769c147afe37669ac19e99f30e9570f657143e66734984ab2700e1afb63472488d3ea56b3ae32c45630a3978b09
-
C:\Windows\System32\vds.exeFilesize
1.3MB
MD5c722958f2b883eeb76b88d69ee190382
SHA154c8e767024865fc4d8941291f3c1453e4697c91
SHA25691b2d6b0690315ef927c551f91d7cd7ef66002018d9efae3e8576fe716447cc5
SHA512a5e2801780b7f66d0b9aefd79733b36d99958a0f1da048147a670f0ed1e8f8b7a43769028d8fa0b1ffcec60b86cedbcfb8acb3b1fd38731c51bd2c24ad6556e1
-
C:\Windows\System32\wbem\WmiApSrv.exeFilesize
1.6MB
MD5539db24b25dd7b956bee517359107a34
SHA139205f752577d33434f96ce049436cb7f90c9365
SHA2560174d17bd186e424263572b7b590dbc34432c743cc23e26dca0e4f834f53a683
SHA5129822aabb82c09d1e63f0dd738212a512f16ba7e90c7d2783824509597f9f76b8c4c004b1c8a27c022db5c3374fa0d38364a88dbe7810e16ae0ded762c10393c9
-
C:\Windows\System32\wbengine.exeFilesize
2.1MB
MD5d699f36651f541095f00915c85566663
SHA1fd5a1e46adc4c899e6bb1e03f5565fe7302df5d1
SHA2560c6306ceb1666b1ae290031ce4a8cfb4b8d4dcb35204b00776026ec77f2e977a
SHA512c0ab77066aa8679dd707e379dbc05e49358a805e77db02541c9b8afc014e4c6fe799967c8d4f4e1f5ca5c9a8f490c9d4b710f301685ec64af56e5f1ef9373c99
-
C:\Windows\TEMP\Crashpad\settings.datFilesize
40B
MD563c24fafa38c1b0109d7b33c1be0d22e
SHA19b3ae6d17378fa094069f9aef62df034089e3083
SHA2565928caa89b1d2b710b06e2032deeeb129c5844abc95bb506a96a2181663fdb20
SHA5121387ef7a3e1e729ec2d22463f44463c5645c772a8336127bbbc7532923abb04b62bbfadf10c12c2f6b50d1ffb567ae4059efe192f3fc0ffdd90ff0cafaacb6b0
-
\??\pipe\crashpad_1192_OOCKKCLXSDFKNCZNMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/884-288-0x0000000140000000-0x0000000140147000-memory.dmpFilesize
1.3MB
-
memory/884-608-0x0000000140000000-0x0000000140147000-memory.dmpFilesize
1.3MB
-
memory/1052-286-0x0000000140000000-0x00000001401C0000-memory.dmpFilesize
1.8MB
-
memory/1052-282-0x0000000140000000-0x00000001401C0000-memory.dmpFilesize
1.8MB
-
memory/1344-202-0x0000000140000000-0x00000001401D7000-memory.dmpFilesize
1.8MB
-
memory/1344-591-0x0000000140000000-0x00000001401D7000-memory.dmpFilesize
1.8MB
-
memory/1656-607-0x0000000140000000-0x00000001401C2000-memory.dmpFilesize
1.8MB
-
memory/1656-271-0x0000000140000000-0x00000001401C2000-memory.dmpFilesize
1.8MB
-
memory/1672-148-0x0000000140000000-0x00000001401AF000-memory.dmpFilesize
1.7MB
-
memory/1680-332-0x0000000140000000-0x00000001401A6000-memory.dmpFilesize
1.6MB
-
memory/1680-725-0x0000000140000000-0x00000001401A6000-memory.dmpFilesize
1.6MB
-
memory/1992-218-0x0000000140000000-0x0000000140169000-memory.dmpFilesize
1.4MB
-
memory/1992-588-0x0000000140000000-0x0000000140169000-memory.dmpFilesize
1.4MB
-
memory/2128-262-0x0000000140000000-0x000000014022B000-memory.dmpFilesize
2.2MB
-
memory/2128-101-0x0000000140000000-0x000000014022B000-memory.dmpFilesize
2.2MB
-
memory/2128-88-0x00000000001A0000-0x0000000000200000-memory.dmpFilesize
384KB
-
memory/2128-82-0x00000000001A0000-0x0000000000200000-memory.dmpFilesize
384KB
-
memory/2168-215-0x0000000140000000-0x0000000140176000-memory.dmpFilesize
1.5MB
-
memory/2168-532-0x0000000140000000-0x0000000140176000-memory.dmpFilesize
1.5MB
-
memory/2772-78-0x00000000007F0000-0x0000000000850000-memory.dmpFilesize
384KB
-
memory/2772-100-0x0000000140000000-0x000000014024B000-memory.dmpFilesize
2.3MB
-
memory/2772-189-0x0000000140000000-0x000000014024B000-memory.dmpFilesize
2.3MB
-
memory/2772-72-0x00000000007F0000-0x0000000000850000-memory.dmpFilesize
384KB
-
memory/2856-185-0x0000000140000000-0x0000000140175000-memory.dmpFilesize
1.5MB
-
memory/3284-249-0x0000000140000000-0x00000001401E2000-memory.dmpFilesize
1.9MB
-
memory/3284-597-0x0000000140000000-0x00000001401E2000-memory.dmpFilesize
1.9MB
-
memory/3360-28-0x0000000000500000-0x0000000000560000-memory.dmpFilesize
384KB
-
memory/3360-34-0x0000000000500000-0x0000000000560000-memory.dmpFilesize
384KB
-
memory/3360-210-0x0000000140000000-0x000000014018A000-memory.dmpFilesize
1.5MB
-
memory/3360-41-0x0000000140000000-0x000000014018A000-memory.dmpFilesize
1.5MB
-
memory/3844-160-0x0000000140000000-0x000000014018B000-memory.dmpFilesize
1.5MB
-
memory/3844-300-0x0000000140000000-0x000000014018B000-memory.dmpFilesize
1.5MB
-
memory/3876-0-0x0000000001FD0000-0x0000000002030000-memory.dmpFilesize
384KB
-
memory/3876-36-0x0000000140000000-0x0000000140592000-memory.dmpFilesize
5.6MB
-
memory/3876-9-0x0000000001FD0000-0x0000000002030000-memory.dmpFilesize
384KB
-
memory/3876-23-0x0000000001FD0000-0x0000000002030000-memory.dmpFilesize
384KB
-
memory/3876-8-0x0000000140000000-0x0000000140592000-memory.dmpFilesize
5.6MB
-
memory/3916-108-0x0000000140000000-0x00000001401AF000-memory.dmpFilesize
1.7MB
-
memory/3916-102-0x0000000140000000-0x00000001401AF000-memory.dmpFilesize
1.7MB
-
memory/3916-92-0x0000000001A50000-0x0000000001AB0000-memory.dmpFilesize
384KB
-
memory/4396-54-0x00000000006B0000-0x0000000000710000-memory.dmpFilesize
384KB
-
memory/4396-45-0x00000000006B0000-0x0000000000710000-memory.dmpFilesize
384KB
-
memory/4396-53-0x0000000140000000-0x0000000140189000-memory.dmpFilesize
1.5MB
-
memory/4424-130-0x0000000140000000-0x0000000140199000-memory.dmpFilesize
1.6MB
-
memory/4560-321-0x0000000140000000-0x0000000140216000-memory.dmpFilesize
2.1MB
-
memory/4560-724-0x0000000140000000-0x0000000140216000-memory.dmpFilesize
2.1MB
-
memory/4688-67-0x0000000140000000-0x0000000140135000-memory.dmpFilesize
1.2MB
-
memory/4688-58-0x0000000000E60000-0x0000000000EC0000-memory.dmpFilesize
384KB
-
memory/4688-64-0x0000000000E60000-0x0000000000EC0000-memory.dmpFilesize
384KB
-
memory/4688-70-0x0000000140000000-0x0000000140135000-memory.dmpFilesize
1.2MB
-
memory/4688-68-0x0000000000E60000-0x0000000000EC0000-memory.dmpFilesize
384KB
-
memory/4692-167-0x0000000000400000-0x0000000000577000-memory.dmpFilesize
1.5MB
-
memory/4692-312-0x0000000000400000-0x0000000000577000-memory.dmpFilesize
1.5MB
-
memory/4740-301-0x0000000140000000-0x00000001401FC000-memory.dmpFilesize
2.0MB
-
memory/4740-673-0x0000000140000000-0x00000001401FC000-memory.dmpFilesize
2.0MB
-
memory/4772-12-0x0000000000750000-0x00000000007B0000-memory.dmpFilesize
384KB
-
memory/4772-20-0x0000000140000000-0x0000000140592000-memory.dmpFilesize
5.6MB
-
memory/4772-21-0x0000000000750000-0x00000000007B0000-memory.dmpFilesize
384KB
-
memory/4772-201-0x0000000140000000-0x0000000140592000-memory.dmpFilesize
5.6MB
-
memory/5212-730-0x0000000140000000-0x0000000140179000-memory.dmpFilesize
1.5MB
-
memory/5212-344-0x0000000140000000-0x0000000140179000-memory.dmpFilesize
1.5MB