Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/05/2024, 14:25

General

  • Target

    2024-05-27_2aa28d25d747a12330c753887294a979_ryuk.exe

  • Size

    5.5MB

  • MD5

    2aa28d25d747a12330c753887294a979

  • SHA1

    e0e37e1f6d6b683c9a7e6e805943be1a2a3d9c06

  • SHA256

    580f25cc5f204caec104e807bfc9c3d154b1a46ae6d1cbd8e786a966114c70fa

  • SHA512

    fb32e44b20a7770f35bfe977b023da7485a9ecd12ecb4dc83075a25060ad97b2f8e14e68002813f555791a75d11331818839f91095da2480c2f0c592e4386482

  • SSDEEP

    49152:IEFbqzA/PvIGDFr9AtwA3PlpIgong0yTI+q47W1Ln9tJEUxDG0BYYrLA50IHLGf4:GAI5pAdVJn9tbnR1VgBVmveD5s0JXP

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 25 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 27 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-27_2aa28d25d747a12330c753887294a979_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-27_2aa28d25d747a12330c753887294a979_ryuk.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1784
    • C:\Users\Admin\AppData\Local\Temp\2024-05-27_2aa28d25d747a12330c753887294a979_ryuk.exe
      C:\Users\Admin\AppData\Local\Temp\2024-05-27_2aa28d25d747a12330c753887294a979_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2c8,0x2cc,0x2d0,0x29c,0x2d4,0x140462458,0x140462468,0x140462478
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:4700
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
      2⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3416
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa6ad6ab58,0x7ffa6ad6ab68,0x7ffa6ad6ab78
        3⤵
          PID:2948
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1604 --field-trial-handle=1916,i,13285473916639675206,18063586116173666611,131072 /prefetch:2
          3⤵
            PID:1052
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1860 --field-trial-handle=1916,i,13285473916639675206,18063586116173666611,131072 /prefetch:8
            3⤵
              PID:3580
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2128 --field-trial-handle=1916,i,13285473916639675206,18063586116173666611,131072 /prefetch:8
              3⤵
                PID:4964
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3068 --field-trial-handle=1916,i,13285473916639675206,18063586116173666611,131072 /prefetch:1
                3⤵
                  PID:1512
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3088 --field-trial-handle=1916,i,13285473916639675206,18063586116173666611,131072 /prefetch:1
                  3⤵
                    PID:4504
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4384 --field-trial-handle=1916,i,13285473916639675206,18063586116173666611,131072 /prefetch:1
                    3⤵
                      PID:2364
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4564 --field-trial-handle=1916,i,13285473916639675206,18063586116173666611,131072 /prefetch:8
                      3⤵
                        PID:4564
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4624 --field-trial-handle=1916,i,13285473916639675206,18063586116173666611,131072 /prefetch:8
                        3⤵
                          PID:5040
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4776 --field-trial-handle=1916,i,13285473916639675206,18063586116173666611,131072 /prefetch:8
                          3⤵
                            PID:2316
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4256 --field-trial-handle=1916,i,13285473916639675206,18063586116173666611,131072 /prefetch:8
                            3⤵
                              PID:5160
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5204 --field-trial-handle=1916,i,13285473916639675206,18063586116173666611,131072 /prefetch:8
                              3⤵
                                PID:5556
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4644 --field-trial-handle=1916,i,13285473916639675206,18063586116173666611,131072 /prefetch:8
                                3⤵
                                  PID:5776
                                • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                  "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
                                  3⤵
                                  • Executes dropped EXE
                                  PID:5844
                                  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae68
                                    4⤵
                                    • Executes dropped EXE
                                    PID:6008
                                  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
                                    4⤵
                                    • Executes dropped EXE
                                    • Modifies registry class
                                    • Suspicious use of FindShellTrayWindow
                                    PID:6100
                                    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x294,0x298,0x29c,0x290,0x2a0,0x14044ae48,0x14044ae58,0x14044ae68
                                      5⤵
                                      • Executes dropped EXE
                                      PID:5124
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 --field-trial-handle=1916,i,13285473916639675206,18063586116173666611,131072 /prefetch:8
                                  3⤵
                                    PID:4800
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5064 --field-trial-handle=1916,i,13285473916639675206,18063586116173666611,131072 /prefetch:2
                                    3⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:1076
                              • C:\Windows\System32\alg.exe
                                C:\Windows\System32\alg.exe
                                1⤵
                                • Executes dropped EXE
                                PID:3536
                              • C:\Windows\System32\svchost.exe
                                C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
                                1⤵
                                  PID:436
                                • C:\Windows\system32\fxssvc.exe
                                  C:\Windows\system32\fxssvc.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:684
                                • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                  "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  • Drops file in System32 directory
                                  PID:3008
                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  PID:4152
                                • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                  "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  PID:1052
                                • C:\Windows\System32\msdtc.exe
                                  C:\Windows\System32\msdtc.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Drops file in System32 directory
                                  • Drops file in Windows directory
                                  PID:4636
                                • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                  "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                  1⤵
                                  • Executes dropped EXE
                                  PID:4448
                                • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                  C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                  1⤵
                                  • Executes dropped EXE
                                  PID:4928
                                • C:\Windows\SysWow64\perfhost.exe
                                  C:\Windows\SysWow64\perfhost.exe
                                  1⤵
                                  • Executes dropped EXE
                                  PID:2784
                                • C:\Windows\system32\locator.exe
                                  C:\Windows\system32\locator.exe
                                  1⤵
                                  • Executes dropped EXE
                                  PID:1064
                                • C:\Windows\System32\SensorDataService.exe
                                  C:\Windows\System32\SensorDataService.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Checks SCSI registry key(s)
                                  PID:2780
                                • C:\Windows\System32\snmptrap.exe
                                  C:\Windows\System32\snmptrap.exe
                                  1⤵
                                  • Executes dropped EXE
                                  PID:4120
                                • C:\Windows\system32\spectrum.exe
                                  C:\Windows\system32\spectrum.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Checks SCSI registry key(s)
                                  PID:4476
                                • C:\Windows\System32\OpenSSH\ssh-agent.exe
                                  C:\Windows\System32\OpenSSH\ssh-agent.exe
                                  1⤵
                                  • Executes dropped EXE
                                  PID:4948
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
                                  1⤵
                                    PID:3552
                                  • C:\Windows\system32\TieringEngineService.exe
                                    C:\Windows\system32\TieringEngineService.exe
                                    1⤵
                                    • Executes dropped EXE
                                    • Checks processor information in registry
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1088
                                  • C:\Windows\system32\AgentService.exe
                                    C:\Windows\system32\AgentService.exe
                                    1⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3984
                                  • C:\Windows\System32\vds.exe
                                    C:\Windows\System32\vds.exe
                                    1⤵
                                    • Executes dropped EXE
                                    PID:388
                                  • C:\Windows\system32\vssvc.exe
                                    C:\Windows\system32\vssvc.exe
                                    1⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4276
                                  • C:\Windows\system32\wbengine.exe
                                    "C:\Windows\system32\wbengine.exe"
                                    1⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4580
                                  • C:\Windows\system32\wbem\WmiApSrv.exe
                                    C:\Windows\system32\wbem\WmiApSrv.exe
                                    1⤵
                                    • Executes dropped EXE
                                    PID:2256
                                  • C:\Windows\system32\SearchIndexer.exe
                                    C:\Windows\system32\SearchIndexer.exe /Embedding
                                    1⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3164
                                    • C:\Windows\system32\SearchProtocolHost.exe
                                      "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                      2⤵
                                      • Modifies data under HKEY_USERS
                                      PID:5348
                                    • C:\Windows\system32\SearchFilterHost.exe
                                      "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
                                      2⤵
                                      • Modifies data under HKEY_USERS
                                      PID:5648

                                  Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

                                          Filesize

                                          2.1MB

                                          MD5

                                          6cc9332ff95f73886844ccd531e66942

                                          SHA1

                                          861ab53ece58873a07fd9a5e824df575e8dae867

                                          SHA256

                                          a41eaf1f032470c448c69199c07c278bc33c29cc5590c2e65074064d00d3ea90

                                          SHA512

                                          c222257d5b92d7e3f6f89b7a9de56c1198b6200ea384574f09beb9629d34a1894f8b8bd3f4eaf23a1a3f9e3beb813cb1f0dd735a5068dee8359752c45591b079

                                        • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

                                          Filesize

                                          1.5MB

                                          MD5

                                          22da8ea2c3c4a6fd14090c44522c6ed4

                                          SHA1

                                          ee29e0b721c8744405d19b59459b4742ddbcef39

                                          SHA256

                                          20dea0454824b3f2a9aea1d3690747a88bf674833aa81b513a19cd960a42a159

                                          SHA512

                                          5a01084ee416daae47daaa8607dd7709f6c0ab4d035d10c5cc7e206bb97c15e795db7cbe90113bf5cea82322a645fea57affd08d7afd972ca91c08d67bd00f56

                                        • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

                                          Filesize

                                          1.5MB

                                          MD5

                                          7f422947f16547e98f5942476a79d5d3

                                          SHA1

                                          86acb2e55f12e245ac6e8f0385b291fa6260f6c1

                                          SHA256

                                          0ab5d1490a7207d8f137a624de7a2bfe2f8941602e852ad2406f2b83cb712317

                                          SHA512

                                          08c75915a47dc9e7f5b20c70dce9c0cd509a49e6639244ebdaea9b2ecd0fd34289131ed0e202e51344df1d5f639d0603329031ec7f44e43f9107adc347956441

                                        • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

                                          Filesize

                                          5.4MB

                                          MD5

                                          5a4fc283689a3015c3383477fca3e6a4

                                          SHA1

                                          13062ca1b5b6061dd753d4bfe78be4e41dea7fea

                                          SHA256

                                          cfd3e177db9a3d66e27a4e97fa87ab34402ee1b5853c2e5da4bb1894834955b9

                                          SHA512

                                          853957b9146a799f8dac58939800b732c120fdf00addc1d417bcd5316a997d1cdfbb35a1f3bdf98e9b882380f351bbbfd9a52f6f65e3d5c8183b8f07c273e4cd

                                        • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

                                          Filesize

                                          2.2MB

                                          MD5

                                          e5c4292eec5e74ea3b2f8c48f7d9f975

                                          SHA1

                                          9f0cc18ca7afad006c41d2f23cd7d16f2961782c

                                          SHA256

                                          f724891676b4f71f048bcd2bdfd1a66ed9bdac3b06ad5767d575b6f483f20fbb

                                          SHA512

                                          d171e39e1bc164a24412f54944679b758ccfb219edb4e7f04ec4caa4f16ba3fb4c8d8746c4e94ac2ab4cd8001a5d3ff10203979d8ea74a5bdb2b7e3c521d6de9

                                        • C:\Program Files\Google\Chrome\Application\SetupMetrics\795902d9-81d6-4c43-821c-c7e59c65b7c6.tmp

                                          Filesize

                                          488B

                                          MD5

                                          6d971ce11af4a6a93a4311841da1a178

                                          SHA1

                                          cbfdbc9b184f340cbad764abc4d8a31b9c250176

                                          SHA256

                                          338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783

                                          SHA512

                                          c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

                                          Filesize

                                          40B

                                          MD5

                                          d0df793c4e281659228b2837846ace2d

                                          SHA1

                                          ece0a5b1581f86b175ccbc7822483448ec728077

                                          SHA256

                                          4e5ceefae11a45c397cde5c6b725c18d8c63d80d2ce851fa94df1644169eafc9

                                          SHA512

                                          400a81d676e5c1e8e64655536b23dbae0a0dd47dc1e87e202e065903396e6a106770cec238093d748b9c71b5859edf097ffff2e088b5b79d6a449754140a52ad

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

                                          Filesize

                                          193KB

                                          MD5

                                          ef36a84ad2bc23f79d171c604b56de29

                                          SHA1

                                          38d6569cd30d096140e752db5d98d53cf304a8fc

                                          SHA256

                                          e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831

                                          SHA512

                                          dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                          Filesize

                                          1KB

                                          MD5

                                          4f6059909d147c8dfe69e1f3561e0839

                                          SHA1

                                          20feaf6c1b683d9408dc2b202551a03b0bbfd45b

                                          SHA256

                                          54e9d75bd947c13fd295b6e80c9de90c16f999317ebc96be0636bf01839eef42

                                          SHA512

                                          a282615c9eced25fba62c9fb180deb78e34a547bcb0372f75402005a027db95d260e428ddeb5472320e1b9e4c0cebaee23388e8d307cc8df633319accb900128

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                          Filesize

                                          2B

                                          MD5

                                          d751713988987e9331980363e24189ce

                                          SHA1

                                          97d170e1550eee4afc0af065b78cda302a97674c

                                          SHA256

                                          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                          SHA512

                                          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                          Filesize

                                          354B

                                          MD5

                                          ddac84a62b58cc7e7724041f032086b2

                                          SHA1

                                          0167e98f7d81089557cfad2283058a8d8547602a

                                          SHA256

                                          17c697568155b81568c26c656d86ec33b4e76c88f066489782e695065b78a6ae

                                          SHA512

                                          55d35f90b54c19d11c0d5df1228893a92e9292d9a2bdf571b4a4f9aff531a71e2625ddcbc64e83d9a945577d71e225747975bf4d2b0bde5afeac44b9b42eaeff

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                          Filesize

                                          5KB

                                          MD5

                                          6d2e852470406fa651faf4d54e61b07a

                                          SHA1

                                          77ddf31f0f983a33533884fb81523b6f5faca963

                                          SHA256

                                          0072154f9fddca9457d72bde05c90ea35214719e45b9ef6571dc4192a9357416

                                          SHA512

                                          6304dda6965683712bb8efbb152ba99f940bd4701546aadfe4806806a92355cf7fccbaca515fc31b35e7be0d501fed70577707503259820dd3478e9f6eceae38

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe578de8.TMP

                                          Filesize

                                          2KB

                                          MD5

                                          1d0245a0816fd932b1963600bab98460

                                          SHA1

                                          82d188a3a5fd107ed83000e16e41e0d67eed941b

                                          SHA256

                                          b9d8f68c1f5aeadb1748f8efa21c33a4235cca822bfdf19951d296b2f29944f6

                                          SHA512

                                          febc999100ab08b73d52fa2a08f7c09cf2281c420762d121150da6cecc922372a9591619163881a5d2956cc20a7bd6d1b5017b6f0575b55ca6baeeaa604632f6

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                          Filesize

                                          16KB

                                          MD5

                                          186e6953472a1dd4db4ba6a149c41fac

                                          SHA1

                                          51dcb80874300c247abe380fc785eed851c4afcc

                                          SHA256

                                          c82465c593f5c9f6f562c2820d3799952feec4ce190c0bb36bbd27e634c93800

                                          SHA512

                                          5b0235b7d2ded50ceaeaf6dbfe3d505bd789a54b8ac49afab4f40719b37615eacfe62b7793bb5edf476024c4f7a8d2b937c2d80a3a7acf7d2b9c68cb30a83718

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                          Filesize

                                          260KB

                                          MD5

                                          83cae2282933c8d7a3d3b9090ff8188e

                                          SHA1

                                          085daf080f8f0096026d7fbe8410113924705a2a

                                          SHA256

                                          4949c89ad70aa17b1f394296d0d9819db696cb4bcdc1f506eb77f2848bbcdae2

                                          SHA512

                                          7970582ccea397d1e1ade525b1267b8082199addd1a2ac4ba88e20fb25e11229ba9093ae0174054c8d51f1ba219ccf753773e545f122840af27ad27ff249c370

                                        • C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

                                          Filesize

                                          7KB

                                          MD5

                                          f96c39c4f51aff0b350f5e7c2a1268ea

                                          SHA1

                                          c02fd16c9762780d9aa41151977fe4008e44ab0d

                                          SHA256

                                          65aed71bf6ee8e78561aaaccd291e0573c299def60938ab9ad5c565ca4c42b31

                                          SHA512

                                          26a0bda699c5dd71ad5939407ae56549429b7f1516c44fc8b4b1ebe5da5b0e1d676dc65b8bf4f3eea335401acdffc2e99637c30f163775ef72cf46fa66ceb5f0

                                        • C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

                                          Filesize

                                          8KB

                                          MD5

                                          27e7f41d430aa91d2ca91bc31b96aeb4

                                          SHA1

                                          f7e5f59951c6d51ad7aaea2cf545518c7d0886aa

                                          SHA256

                                          908a7cf6e5db6f9a428331910fbf0b2b1417059b0c233b7b5229119cc96f6475

                                          SHA512

                                          e3218f6e4ed254b6881a1177f18f476a46923b050d1ea73af4e311f38636ab7caf27f33a371bcb97fada0bd3ee8998917dabf0e2f86f3632bbdefc1d028402cf

                                        • C:\Users\Admin\AppData\Roaming\4712c738e703f493.bin

                                          Filesize

                                          12KB

                                          MD5

                                          c9fe46dcd48d321bca644025af134877

                                          SHA1

                                          d6cbbff75c86c28199b0d5dedd3da2c1725fea98

                                          SHA256

                                          68c23fa194a0adc64b996dc93b5fed170d05ed7376766ecb4d43a172738b9c9e

                                          SHA512

                                          17542de7a4d035dd51790d385442d7056ce0b9f456aaf5ceff9f2d4df1d6959f7eacbcfc70390e2a8622a2468806e7e04c0106bfb72ea2a92cefa83169876d20

                                        • C:\Windows\SysWOW64\perfhost.exe

                                          Filesize

                                          1.2MB

                                          MD5

                                          f3316cabc1cf1c37078d40991f64dd09

                                          SHA1

                                          5a98ebe478bf4cd4395b510236239615337682e4

                                          SHA256

                                          02a4ec8230c20cdabf5c1ee154849d4499f34f78c50015672576abb68d65b018

                                          SHA512

                                          8b6022bad94c5bf4f90ccc74a6077e13961f3777ef3a53cc59e39e5b40dcbee72a665f817b4503ade582dacb2dc46193e63626cabb9574a731d0a5463f4e59f3

                                        • C:\Windows\System32\AgentService.exe

                                          Filesize

                                          1.7MB

                                          MD5

                                          0f6b7e2eca02ef0a193dcf4f4f65a196

                                          SHA1

                                          e4592f729673b56e176b2e6301c90e2d0ca24db9

                                          SHA256

                                          02653645e07566d04ee0aad9e899a89ede3e82fc5df6d348bcc56f4761a8b625

                                          SHA512

                                          e436caad3528b9542e59e98cf8364dad0f69a8f98e886e4f8c34c502e63688b7b0a9e32631a6629ae4b89c2b33570001283dd836eac540e9bf5e0bf7518a922b

                                        • C:\Windows\System32\FXSSVC.exe

                                          Filesize

                                          1.2MB

                                          MD5

                                          883e1bbb7e87e50094442677db042a82

                                          SHA1

                                          ba8f5f0156de73bdf5eb49dc09ab4aca6dc76c65

                                          SHA256

                                          4b9774f4d13edaa9ab69970a9721240aeaec481c2153a0d904d8f5108a7700f9

                                          SHA512

                                          242761d1846c31bc23d09d35006bf8b9efcf6d11a3eee28ba643e158d800665e8460eec84870451350ff9df341e73d20d99e83a2f04930d2573ba29d20e1d1db

                                        • C:\Windows\System32\Locator.exe

                                          Filesize

                                          1.2MB

                                          MD5

                                          500cb9b7c4e7c22393110e8658a4bd84

                                          SHA1

                                          5541ad28a25531ef3599ce1b61a857102e7d96d7

                                          SHA256

                                          6b63fad0f1b3514b89ee05e5b46fdd422b8c9221e4e0bc99f160249977b8163e

                                          SHA512

                                          2ad0d656f798304d0491c4d63357824b1ce38a32dc335ea50b5a03a094e8dc6b3810e9829a356ff2b3879042ad7f42c890c2e44004472af5f3c5d1f77227fe38

                                        • C:\Windows\System32\OpenSSH\ssh-agent.exe

                                          Filesize

                                          1.6MB

                                          MD5

                                          1cdaade4f005fbfae74b768f0f325fe7

                                          SHA1

                                          4d689dcaf2e0beeb75157b9c38bcf8defa619816

                                          SHA256

                                          36f8dc5ddb89e6bbdeb64c24d1b2f5c88ac1b82a83c1991c20487b596307877b

                                          SHA512

                                          522e3562803cea436b93652b45c2acd7f8fec3568321879f338fd6d48ad2e28cf80437364bd98bd4c27cf1bf809fb17c0d4c8873e72ef0caee0ff643f4048197

                                        • C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

                                          Filesize

                                          1.3MB

                                          MD5

                                          abb75647e05c5a56f2350ce562c91026

                                          SHA1

                                          0f7cff21ba9f7d0d38762fa8878ad4a9e59ad3ba

                                          SHA256

                                          2cf50c0b2b4b757ed161557c6db7b09c81fe840261a3aeb872f4b674703dbc40

                                          SHA512

                                          141c18af16aaac794b6aa2e421ed35b601a7054a74eb26c4e83a08c54d1e3dd3933b045de549d317b420723070c069d5ddae6b75754a014a52db639eed116c3c

                                        • C:\Windows\System32\SearchIndexer.exe

                                          Filesize

                                          1.4MB

                                          MD5

                                          479d106480b0906a24c4cdae0fa63250

                                          SHA1

                                          3e849f9911abd353b424b56a1c37f95f6fb3b1d0

                                          SHA256

                                          b005faeff0672030e9d67fbcfae49fb7a4a6c3a55ae056193634b49b15e24cae

                                          SHA512

                                          623ec4b21b6d19c269e9f03575f97c5a8767a32a99eca66a3d369a8c4a0ffec2be36d7fea9103caea1296d8cd574889ef72cc88ea4b16fb477f920f73a73f109

                                        • C:\Windows\System32\SensorDataService.exe

                                          Filesize

                                          1.8MB

                                          MD5

                                          516c36af818de7ea27665b69e17b67c2

                                          SHA1

                                          0e995a53099f937c5364f65ed6d87a4ff453b783

                                          SHA256

                                          a455a3ccc41b5fd1369b091c6b657dce97f8ab9db22e13742deb565d2368a3a6

                                          SHA512

                                          62dac4a21faf8fa5a8d5bf91d7ebc308dd0d003cb78d6e46596120667123d76676cac53db4171fc5987a5591f4815b620bc09c5d2afa5614b44f374d6d6566a8

                                        • C:\Windows\System32\Spectrum.exe

                                          Filesize

                                          1.4MB

                                          MD5

                                          c58b3ad96305a8dd669bfd67b5536ee6

                                          SHA1

                                          92aa8f4e53b7802c202f7fc824340ed0c6342e45

                                          SHA256

                                          04e869e8879b250aec73598b412f354990e8d9c8cd04b6517eb12cdbc6e515e2

                                          SHA512

                                          00260e1bb380287da0784e2f087d8dc4335193d3e54362a6526da304db26bcfb7584a2ade51b0fcfd1215159f734fbaf77976e7ec61822d263463930d6c00c7f

                                        • C:\Windows\System32\TieringEngineService.exe

                                          Filesize

                                          1.5MB

                                          MD5

                                          216cd54f3b9784b46dc7931466c9fc9f

                                          SHA1

                                          f1530d604649b5115359fd15a508c63b2df04050

                                          SHA256

                                          b2ce32969e6861f6234ce949304338597a723d3d44e747319c64662f4d3da61b

                                          SHA512

                                          2186e2cd8c9a8ccf55bd1656c8734cb698ce649793eeefb1c859572a362f8ea92aaeecfbff00c868e74f35f7874f0944b22ae0f098eb24344c6ed730e072f701

                                        • C:\Windows\System32\VSSVC.exe

                                          Filesize

                                          2.0MB

                                          MD5

                                          86da9a5bf761bbe427706c8aaf253aa5

                                          SHA1

                                          1388af130081d195835d61118bede20109243682

                                          SHA256

                                          7b07162e04ef416434adf703237e5261bd934cce66869da73d22e5b5e2b08046

                                          SHA512

                                          55cce8dacf314cb2b326d820a0ac0192223a264bc526556b3aa69eade5c9908b98826d06d541051cb635ee9effec57797e8cce933b4ac72ef688ce26173fbc9e

                                        • C:\Windows\System32\alg.exe

                                          Filesize

                                          1.3MB

                                          MD5

                                          554c8395f8acbdb30483440073ace3d8

                                          SHA1

                                          60bfba82a534727cec84af8754f16adb3f165fac

                                          SHA256

                                          50327fd693b52377b5b948e7e5619b7868e6020ac859e9c1892875d7e61638f9

                                          SHA512

                                          57d496cc5de9248739d377da8cebe3180f60188b81714523e7b4a82b825ab620adb500e551340ae92c7a1ccb2fc629e7d364b88ef132f127d9ab271c0c2c9084

                                        • C:\Windows\System32\msdtc.exe

                                          Filesize

                                          1.4MB

                                          MD5

                                          3815a44746df46b83ab2fd574d2c0cac

                                          SHA1

                                          73bf4ef5abd9f1775dc3d84b5ef7783f75e9c121

                                          SHA256

                                          b3be2f4634b7dbe94d08e11fc0281311b7718007c93b2c944e27e54ea84ec729

                                          SHA512

                                          5e9dc0740fa9e6f03f7d0e7df35d2ac897cc8877458b06b6bc6ef126d2b74fbea38a529159fba2b4a652f200e6404694eb2c3144784136a7be4210dcff6de419

                                        • C:\Windows\System32\snmptrap.exe

                                          Filesize

                                          1.2MB

                                          MD5

                                          8fd308bc4a4ffbfca86685bd384fa70c

                                          SHA1

                                          619d24ab17f1d688fc298cd2609b6e7debbf36db

                                          SHA256

                                          ef8a1765d05bd377467500f6a60e783657869525c5e8580e2537270bd0b7e917

                                          SHA512

                                          198adfd597f61ce09c1a63fbcfd614af048578882730d1b96b95f18ec18c68deed60241f399e31404b11ea272185f875add71c5be41b8563f27ee7091d72fe95

                                        • C:\Windows\System32\vds.exe

                                          Filesize

                                          1.3MB

                                          MD5

                                          1106e8d5e219e95c561fa9f41f2d1f18

                                          SHA1

                                          f4386ab373b4fd71b2a90c7d3317ebf5ed65885e

                                          SHA256

                                          d416bcab924e06a5244c11933700461ffb6fccce5210d8a056d8468f146b2ffb

                                          SHA512

                                          9dce1fb2e816db70dc8f4fccea95b4e2172fb0e73032edbfc4f63715e6f595e7c04614e99bdaa595e36eada8c6a16db9e90ffc01f3394d323dabaa7c78565808

                                        • C:\Windows\System32\wbem\WmiApSrv.exe

                                          Filesize

                                          1.4MB

                                          MD5

                                          98662621282357b652b5699ad0f23a5f

                                          SHA1

                                          579eb6c9c4ca6ac092e494a1123e3212572ff144

                                          SHA256

                                          b737e656928063454fb627692babc03748f54be3fe0761e106125f518b23ccfe

                                          SHA512

                                          3165dc5db23e9c1148eb0656837d42300ede5e833426b1183192996b24a9c09b74786f6ed4065e3a41cb36bdc791e2714e396b69061cf0c3766a5107a023bd04

                                        • C:\Windows\System32\wbengine.exe

                                          Filesize

                                          2.1MB

                                          MD5

                                          6ea13416d3c161df8fe501b7372eebc7

                                          SHA1

                                          5729511e32118723673cfaef8b0adf632fe45a76

                                          SHA256

                                          003b45e23fc705ebfefa9ff1b8995794865b914b4017c214de90e0a270545c92

                                          SHA512

                                          a5fc1c2cacee56dd81ca35cc46844efb305d63b60d21c7bc30c48508d133f4cab269b6531e76d16f1e1fedce5203d390f918fa77b7254d8cd5c98743662ff02e

                                        • C:\Windows\TEMP\Crashpad\settings.dat

                                          Filesize

                                          40B

                                          MD5

                                          dd7a044bb22136e85285d21163fdef66

                                          SHA1

                                          1fcea0d904998de1bdea9cfa654a50c20b3dcc5b

                                          SHA256

                                          b918a44d48859b4ed705a9a7a23d4a816a368aa2161ad495a7a6d1c6992b61a0

                                          SHA512

                                          67afbad0468b8d5b405186c63a0960f5fcda15b2ab73767c292863e221265758001b2e110a3296f5d2ba1463863d556a535850a65a107344ade40a79c33bf358

                                        • C:\Windows\system32\AppVClient.exe

                                          Filesize

                                          1.3MB

                                          MD5

                                          42a9b91ddf2fb96259d3e227423e6ab7

                                          SHA1

                                          8b38cd12ba2f4a95d211aa05dcbd30d14bba891a

                                          SHA256

                                          4de0526e7e37207218b2cd3364633ca75496485f0785040a72df981345de0f4d

                                          SHA512

                                          a9e1005af9563cb06a6a53fd849ad817698398a10348d336d1bce3be3fd4e61a6c8f30eace6d8762f0199b026ce168a3660e77f4759af7c8345203b636df73b6

                                        • C:\Windows\system32\config\systemprofile\AppData\Roaming\4712c738e703f493.bin

                                          Filesize

                                          12KB

                                          MD5

                                          9549d15ca20cb8396816185d3d753509

                                          SHA1

                                          8096858b82e5c51568c13081aff36ebbb1c9cea1

                                          SHA256

                                          7b52a40247b8ac16563c82241f7159f9e7d15ba083f4f492dee799f540bd29f8

                                          SHA512

                                          73c62c722c8d9d00b465e4e9ad719cb6f12a008750344501d4e6708fbbfb0df475eff4fe70a456d1fd15d83087281f96eb02b27dc62b7e5c78bca3f7037dc5ba

                                        • memory/388-309-0x0000000140000000-0x0000000140147000-memory.dmp

                                          Filesize

                                          1.3MB

                                        • memory/684-49-0x0000000140000000-0x0000000140135000-memory.dmp

                                          Filesize

                                          1.2MB

                                        • memory/1052-63-0x0000000000CD0000-0x0000000000D30000-memory.dmp

                                          Filesize

                                          384KB

                                        • memory/1052-71-0x0000000140000000-0x0000000140226000-memory.dmp

                                          Filesize

                                          2.1MB

                                        • memory/1052-76-0x0000000140000000-0x0000000140226000-memory.dmp

                                          Filesize

                                          2.1MB

                                        • memory/1052-74-0x0000000000CD0000-0x0000000000D30000-memory.dmp

                                          Filesize

                                          384KB

                                        • memory/1052-69-0x0000000000CD0000-0x0000000000D30000-memory.dmp

                                          Filesize

                                          384KB

                                        • memory/1064-301-0x0000000140000000-0x00000001401EC000-memory.dmp

                                          Filesize

                                          1.9MB

                                        • memory/1088-308-0x0000000140000000-0x0000000140239000-memory.dmp

                                          Filesize

                                          2.2MB

                                        • memory/1784-26-0x0000000000510000-0x0000000000570000-memory.dmp

                                          Filesize

                                          384KB

                                        • memory/1784-9-0x0000000000510000-0x0000000000570000-memory.dmp

                                          Filesize

                                          384KB

                                        • memory/1784-0-0x0000000000510000-0x0000000000570000-memory.dmp

                                          Filesize

                                          384KB

                                        • memory/1784-8-0x0000000140000000-0x0000000140592000-memory.dmp

                                          Filesize

                                          5.6MB

                                        • memory/1784-33-0x0000000140000000-0x0000000140592000-memory.dmp

                                          Filesize

                                          5.6MB

                                        • memory/2256-316-0x0000000140000000-0x000000014021D000-memory.dmp

                                          Filesize

                                          2.1MB

                                        • memory/2780-302-0x0000000140000000-0x00000001401D7000-memory.dmp

                                          Filesize

                                          1.8MB

                                        • memory/2780-472-0x0000000140000000-0x00000001401D7000-memory.dmp

                                          Filesize

                                          1.8MB

                                        • memory/2784-300-0x0000000000400000-0x00000000005EE000-memory.dmp

                                          Filesize

                                          1.9MB

                                        • memory/2784-104-0x00000000006C0000-0x0000000000726000-memory.dmp

                                          Filesize

                                          408KB

                                        • memory/3008-45-0x0000000000C60000-0x0000000000CC0000-memory.dmp

                                          Filesize

                                          384KB

                                        • memory/3008-359-0x0000000140000000-0x000000014024B000-memory.dmp

                                          Filesize

                                          2.3MB

                                        • memory/3008-61-0x0000000140000000-0x000000014024B000-memory.dmp

                                          Filesize

                                          2.3MB

                                        • memory/3008-39-0x0000000000C60000-0x0000000000CC0000-memory.dmp

                                          Filesize

                                          384KB

                                        • memory/3164-318-0x0000000140000000-0x0000000140179000-memory.dmp

                                          Filesize

                                          1.5MB

                                        • memory/3164-556-0x0000000140000000-0x0000000140179000-memory.dmp

                                          Filesize

                                          1.5MB

                                        • memory/3536-529-0x0000000140000000-0x0000000140201000-memory.dmp

                                          Filesize

                                          2.0MB

                                        • memory/3536-24-0x0000000140000000-0x0000000140201000-memory.dmp

                                          Filesize

                                          2.0MB

                                        • memory/3984-144-0x0000000140000000-0x00000001401C0000-memory.dmp

                                          Filesize

                                          1.8MB

                                        • memory/4120-303-0x0000000140000000-0x00000001401ED000-memory.dmp

                                          Filesize

                                          1.9MB

                                        • memory/4152-57-0x00000000001A0000-0x0000000000200000-memory.dmp

                                          Filesize

                                          384KB

                                        • memory/4152-537-0x0000000140000000-0x000000014022B000-memory.dmp

                                          Filesize

                                          2.2MB

                                        • memory/4152-51-0x00000000001A0000-0x0000000000200000-memory.dmp

                                          Filesize

                                          384KB

                                        • memory/4152-60-0x0000000140000000-0x000000014022B000-memory.dmp

                                          Filesize

                                          2.2MB

                                        • memory/4276-310-0x0000000140000000-0x00000001401FC000-memory.dmp

                                          Filesize

                                          2.0MB

                                        • memory/4448-298-0x0000000140000000-0x0000000140226000-memory.dmp

                                          Filesize

                                          2.1MB

                                        • memory/4448-87-0x00000000004F0000-0x0000000000550000-memory.dmp

                                          Filesize

                                          384KB

                                        • memory/4448-81-0x00000000004F0000-0x0000000000550000-memory.dmp

                                          Filesize

                                          384KB

                                        • memory/4476-304-0x0000000140000000-0x0000000140169000-memory.dmp

                                          Filesize

                                          1.4MB

                                        • memory/4580-315-0x0000000140000000-0x0000000140216000-memory.dmp

                                          Filesize

                                          2.1MB

                                        • memory/4636-297-0x0000000140000000-0x0000000140210000-memory.dmp

                                          Filesize

                                          2.1MB

                                        • memory/4700-455-0x0000000140000000-0x0000000140592000-memory.dmp

                                          Filesize

                                          5.6MB

                                        • memory/4700-22-0x0000000000510000-0x0000000000570000-memory.dmp

                                          Filesize

                                          384KB

                                        • memory/4700-21-0x0000000140000000-0x0000000140592000-memory.dmp

                                          Filesize

                                          5.6MB

                                        • memory/4928-99-0x0000000000B30000-0x0000000000B90000-memory.dmp

                                          Filesize

                                          384KB

                                        • memory/4928-299-0x0000000140000000-0x0000000140202000-memory.dmp

                                          Filesize

                                          2.0MB

                                        • memory/4928-93-0x0000000000B30000-0x0000000000B90000-memory.dmp

                                          Filesize

                                          384KB

                                        • memory/4948-305-0x0000000140000000-0x0000000140259000-memory.dmp

                                          Filesize

                                          2.3MB

                                        • memory/5124-464-0x0000000140000000-0x000000014057B000-memory.dmp

                                          Filesize

                                          5.5MB

                                        • memory/5124-590-0x0000000140000000-0x000000014057B000-memory.dmp

                                          Filesize

                                          5.5MB

                                        • memory/5844-489-0x0000000140000000-0x000000014057B000-memory.dmp

                                          Filesize

                                          5.5MB

                                        • memory/5844-429-0x0000000140000000-0x000000014057B000-memory.dmp

                                          Filesize

                                          5.5MB

                                        • memory/6008-442-0x0000000140000000-0x000000014057B000-memory.dmp

                                          Filesize

                                          5.5MB

                                        • memory/6008-589-0x0000000140000000-0x000000014057B000-memory.dmp

                                          Filesize

                                          5.5MB

                                        • memory/6100-477-0x0000000140000000-0x000000014057B000-memory.dmp

                                          Filesize

                                          5.5MB

                                        • memory/6100-452-0x0000000140000000-0x000000014057B000-memory.dmp

                                          Filesize

                                          5.5MB