Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-06-2024 06:51

General

  • Target

    2024-06-01_779a806e04aa81c1e6c9bbf738e7168a_ryuk.exe

  • Size

    5.5MB

  • MD5

    779a806e04aa81c1e6c9bbf738e7168a

  • SHA1

    e08c85714808c49862ebccb345580860a88d9051

  • SHA256

    1bc879c9975bc6cccb55150e682c84ca724811dd22332b6b8d2258b6239c0df4

  • SHA512

    180300a4d86a534534f2ff56d0f0b5b09665fe74983e1c47753635205c0c9f1d2382172b330ad4d7cb5f1d4091a5c00c17c42d777b4f19d2cc11566a7507fb62

  • SSDEEP

    49152:9EFbqzA/PvIGDFr9AtwA3PlpIgong0yTI+q47W1Ln9tJEUxDG0BYYrLA50IHLGf5:BAI5pAdVJn9tbnR1VgBVmCWAV7v

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 26 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 24 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-01_779a806e04aa81c1e6c9bbf738e7168a_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-01_779a806e04aa81c1e6c9bbf738e7168a_ryuk.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Users\Admin\AppData\Local\Temp\2024-06-01_779a806e04aa81c1e6c9bbf738e7168a_ryuk.exe
      C:\Users\Admin\AppData\Local\Temp\2024-06-01_779a806e04aa81c1e6c9bbf738e7168a_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2ac,0x2d4,0x140462458,0x140462468,0x140462478
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:1224
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
      2⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3052
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6f4cab58,0x7ffd6f4cab68,0x7ffd6f4cab78
        3⤵
          PID:3620
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1616 --field-trial-handle=1920,i,18217448109913988332,2504552526191930536,131072 /prefetch:2
          3⤵
            PID:3612
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1920,i,18217448109913988332,2504552526191930536,131072 /prefetch:8
            3⤵
              PID:2872
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2168 --field-trial-handle=1920,i,18217448109913988332,2504552526191930536,131072 /prefetch:8
              3⤵
                PID:828
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3080 --field-trial-handle=1920,i,18217448109913988332,2504552526191930536,131072 /prefetch:1
                3⤵
                  PID:2528
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3100 --field-trial-handle=1920,i,18217448109913988332,2504552526191930536,131072 /prefetch:1
                  3⤵
                    PID:1644
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4316 --field-trial-handle=1920,i,18217448109913988332,2504552526191930536,131072 /prefetch:1
                    3⤵
                      PID:5108
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4492 --field-trial-handle=1920,i,18217448109913988332,2504552526191930536,131072 /prefetch:8
                      3⤵
                        PID:5168
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4628 --field-trial-handle=1920,i,18217448109913988332,2504552526191930536,131072 /prefetch:8
                        3⤵
                          PID:5212
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4748 --field-trial-handle=1920,i,18217448109913988332,2504552526191930536,131072 /prefetch:8
                          3⤵
                            PID:5700
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4836 --field-trial-handle=1920,i,18217448109913988332,2504552526191930536,131072 /prefetch:8
                            3⤵
                              PID:5760
                            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                              "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
                              3⤵
                              • Executes dropped EXE
                              PID:5872
                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x26c,0x298,0x14044ae48,0x14044ae58,0x14044ae68
                                4⤵
                                • Executes dropped EXE
                                PID:5944
                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
                                4⤵
                                • Executes dropped EXE
                                • Modifies registry class
                                • Suspicious use of FindShellTrayWindow
                                PID:4108
                                • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                  "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x29c,0x294,0x298,0x290,0x2a0,0x14044ae48,0x14044ae58,0x14044ae68
                                  5⤵
                                  • Executes dropped EXE
                                  PID:5216
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 --field-trial-handle=1920,i,18217448109913988332,2504552526191930536,131072 /prefetch:8
                              3⤵
                                PID:6124
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2412 --field-trial-handle=1920,i,18217448109913988332,2504552526191930536,131072 /prefetch:2
                                3⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:1656
                          • C:\Windows\System32\alg.exe
                            C:\Windows\System32\alg.exe
                            1⤵
                            • Executes dropped EXE
                            PID:1356
                          • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                            C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                            1⤵
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            PID:404
                          • C:\Windows\System32\svchost.exe
                            C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
                            1⤵
                              PID:3452
                            • C:\Windows\system32\fxssvc.exe
                              C:\Windows\system32\fxssvc.exe
                              1⤵
                              • Executes dropped EXE
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2804
                            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:4116
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:2116
                            • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                              "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:3976
                            • C:\Windows\System32\msdtc.exe
                              C:\Windows\System32\msdtc.exe
                              1⤵
                              • Executes dropped EXE
                              • Drops file in System32 directory
                              • Drops file in Windows directory
                              PID:3532
                            • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                              "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                              1⤵
                              • Executes dropped EXE
                              PID:2368
                            • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                              C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                              1⤵
                              • Executes dropped EXE
                              PID:3692
                            • C:\Windows\SysWow64\perfhost.exe
                              C:\Windows\SysWow64\perfhost.exe
                              1⤵
                              • Executes dropped EXE
                              PID:208
                            • C:\Windows\system32\locator.exe
                              C:\Windows\system32\locator.exe
                              1⤵
                              • Executes dropped EXE
                              PID:5080
                            • C:\Windows\System32\SensorDataService.exe
                              C:\Windows\System32\SensorDataService.exe
                              1⤵
                              • Executes dropped EXE
                              • Checks SCSI registry key(s)
                              PID:536
                            • C:\Windows\System32\snmptrap.exe
                              C:\Windows\System32\snmptrap.exe
                              1⤵
                              • Executes dropped EXE
                              PID:2184
                            • C:\Windows\system32\spectrum.exe
                              C:\Windows\system32\spectrum.exe
                              1⤵
                              • Executes dropped EXE
                              • Checks SCSI registry key(s)
                              PID:4392
                            • C:\Windows\System32\OpenSSH\ssh-agent.exe
                              C:\Windows\System32\OpenSSH\ssh-agent.exe
                              1⤵
                              • Executes dropped EXE
                              PID:1496
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
                              1⤵
                                PID:2228
                              • C:\Windows\system32\TieringEngineService.exe
                                C:\Windows\system32\TieringEngineService.exe
                                1⤵
                                • Executes dropped EXE
                                • Checks processor information in registry
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2816
                              • C:\Windows\system32\AgentService.exe
                                C:\Windows\system32\AgentService.exe
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1064
                              • C:\Windows\System32\vds.exe
                                C:\Windows\System32\vds.exe
                                1⤵
                                • Executes dropped EXE
                                PID:3244
                              • C:\Windows\system32\vssvc.exe
                                C:\Windows\system32\vssvc.exe
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:5004
                              • C:\Windows\system32\wbengine.exe
                                "C:\Windows\system32\wbengine.exe"
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2492
                              • C:\Windows\system32\wbem\WmiApSrv.exe
                                C:\Windows\system32\wbem\WmiApSrv.exe
                                1⤵
                                • Executes dropped EXE
                                PID:3852
                              • C:\Windows\system32\SearchIndexer.exe
                                C:\Windows\system32\SearchIndexer.exe /Embedding
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1100
                                • C:\Windows\system32\SearchProtocolHost.exe
                                  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                  2⤵
                                  • Modifies data under HKEY_USERS
                                  PID:4564
                                • C:\Windows\system32\SearchFilterHost.exe
                                  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
                                  2⤵
                                  • Modifies data under HKEY_USERS
                                  PID:1664

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

                                Filesize

                                2.1MB

                                MD5

                                366fed501fc265272096511c96bc45c0

                                SHA1

                                7d8105f79657d731de438488defc14adb77cf9ee

                                SHA256

                                eb46455fb3e2bf6deab84a91820242afd47ad4f6068794d88e44bc043e958be3

                                SHA512

                                cb2a607b87ef99da9345902dc228404df93c03e755db680ac46db59d3e805265d6e9c3ee6dd2345cfc26ffca53e0143c91286042307f2976c0e4785c78f71788

                              • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

                                Filesize

                                797KB

                                MD5

                                5919bbaddb2a1a5c534bfdf92516dc9a

                                SHA1

                                ba1bd54c7acf04f43df3dceaba27cfe4d0c0713a

                                SHA256

                                c77a41531d5eac8a55e6746081cb45665437c2f93bb3e70d76085e17907faddf

                                SHA512

                                09ba3302ed6de059ee91ddba8cf6f3c62b2e8c32d8db4869d7c395d23443e01a4411d958686416fbdc32b7a6794a670b6aeece85ec42670239ace78be49a61f4

                              • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

                                Filesize

                                805KB

                                MD5

                                2eca4413809e47f9c29ec7fad68d282e

                                SHA1

                                b4852ef907f8fdf00a5de6cdb96fbbfad1fddbdf

                                SHA256

                                2483e3acb18d3c0198409caf8a5281531ada2dcb7f4bd6b57d639fd33de11577

                                SHA512

                                080c806c1e86a807eb91dd319b06ec1a097ba4c6f7db544b222ab7ee837413cc8c2e9266ad801fd2180c92d6bd79a52cc14dbb4c788314239312ae24d8dddc14

                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

                                Filesize

                                5.4MB

                                MD5

                                cb024d28b26b6e1c75b89710173600a6

                                SHA1

                                00a885d05df147dade66348581915d6d9db327c8

                                SHA256

                                e5f9a3818ac0f075642048d46d98b6caa6a2892d0aadaff5e094d227bbdf3054

                                SHA512

                                85dd52d7659ccaa56ca48a1f9e8e0a389381e13c8b91ca10b4150aee0f4edb6600fd6f090a97bb41956906424e41743323e03acaf45ccc2e8f1ef21d825b3f60

                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

                                Filesize

                                2.2MB

                                MD5

                                0c5013a5af3a8784d05594fc6acef872

                                SHA1

                                6d255289bf6a26887cf2cdbec88191f299c78c35

                                SHA256

                                6a8b4d1fdb84d0091ff1681155a256e279b792f1456b4ef4c68ef1608d4e3503

                                SHA512

                                5546041c74a4fe28ca4f08e0dca9bfdebc682b64d644d907dda41d4cab1cda4e8f6db5e2ae7894d892d35efe273608f0d74d299af0882cf91575c899e3fe27b9

                              • C:\Program Files\Google\Chrome\Application\SetupMetrics\20240601065139.pma

                                Filesize

                                488B

                                MD5

                                6d971ce11af4a6a93a4311841da1a178

                                SHA1

                                cbfdbc9b184f340cbad764abc4d8a31b9c250176

                                SHA256

                                338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783

                                SHA512

                                c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

                                Filesize

                                40B

                                MD5

                                d0df793c4e281659228b2837846ace2d

                                SHA1

                                ece0a5b1581f86b175ccbc7822483448ec728077

                                SHA256

                                4e5ceefae11a45c397cde5c6b725c18d8c63d80d2ce851fa94df1644169eafc9

                                SHA512

                                400a81d676e5c1e8e64655536b23dbae0a0dd47dc1e87e202e065903396e6a106770cec238093d748b9c71b5859edf097ffff2e088b5b79d6a449754140a52ad

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

                                Filesize

                                193KB

                                MD5

                                ef36a84ad2bc23f79d171c604b56de29

                                SHA1

                                38d6569cd30d096140e752db5d98d53cf304a8fc

                                SHA256

                                e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831

                                SHA512

                                dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                Filesize

                                1KB

                                MD5

                                98afa17c092dae13a5a532b471609750

                                SHA1

                                fc8544118f9833e6cb5cb62278d0405feb5d3b4a

                                SHA256

                                8d68f08e1ebea046a3be32ca4618ac951aaa544aa44a4640d52536a87dc0c869

                                SHA512

                                109a99183a671e611559a3c67a8c9094ecbe04411630bca4f38ac34f2e4c7716647e49b7c8a0b9d97274b7e088c0802af78c4701798cc3db3210589c02f56f41

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                Filesize

                                2B

                                MD5

                                d751713988987e9331980363e24189ce

                                SHA1

                                97d170e1550eee4afc0af065b78cda302a97674c

                                SHA256

                                4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                SHA512

                                b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                Filesize

                                354B

                                MD5

                                0f5183c7ade31ada1f53fc221c5ed4f0

                                SHA1

                                51005d222e8eceedbe1038db408ed5047f7834bf

                                SHA256

                                85523eedbf28736d74807a9f843dd0a63af71fd154741916ae4aad930d777199

                                SHA512

                                f80a4bea98130dc8b9cb1c829e1f45c2490fd0dc839c216470072259ee896916e5290faa44358f217ad9c09bc539f422765a316f96dd1be2450a2742438051ee

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                5KB

                                MD5

                                3e9135a222496566e7f3bd95f82611e7

                                SHA1

                                8baee4ac2fd5b89d04969d004057f7563d6094dc

                                SHA256

                                57d2012b06a51643b7e917f10a9b291de7056a03ee03b01a093eb2d11edea321

                                SHA512

                                ac77bdcb7f8ffc34dd6596bf6c4e6e7601ab896eeabfbe7c511c91b797df1a554ec76eeb9b84ca69804e095c2609724979e783932bfad087fa7774b63ad649bb

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe5781d2.TMP

                                Filesize

                                2KB

                                MD5

                                1d0245a0816fd932b1963600bab98460

                                SHA1

                                82d188a3a5fd107ed83000e16e41e0d67eed941b

                                SHA256

                                b9d8f68c1f5aeadb1748f8efa21c33a4235cca822bfdf19951d296b2f29944f6

                                SHA512

                                febc999100ab08b73d52fa2a08f7c09cf2281c420762d121150da6cecc922372a9591619163881a5d2956cc20a7bd6d1b5017b6f0575b55ca6baeeaa604632f6

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                Filesize

                                16KB

                                MD5

                                a62e2e7f87fcda56f4476e54ee297984

                                SHA1

                                b165c55335be41c5850afc074ef82d29217e7ad7

                                SHA256

                                cf0f4eb611c1977a12589be1ae01775efd8cd8af91285d588bf55e26f90b8e41

                                SHA512

                                14e11338fb45c10b06cd7e830e094c6974c5a04fb511f66171af30bd4b3fa43b225def0106f9c514eb9cc54a917a5dcf6d2284ab9ce69f85afdb580af08a81fb

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                261KB

                                MD5

                                52296a42e1f8f9cdc5534342ea5b1118

                                SHA1

                                58f5535bd65c0da408e0b8e884f733084698e2c1

                                SHA256

                                9cfbc05570c2fb8a7fafde754fe2f66ccc32a99367658f3c2a03a1944c60a656

                                SHA512

                                90739a170f1797e3274e0c02b816558dd47273eee545aa651a7c1aa20ee52b3387fa28645193da567cae04c7fe89fdfd79d4b51e69348d9787f91af5d9057620

                              • C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

                                Filesize

                                7KB

                                MD5

                                a938d514c295f842885050b981be7492

                                SHA1

                                c5f5404d2441a657d87d3886809cb3062ab6cf0a

                                SHA256

                                328ea88e39f148c3a8c8ee1b1409747ee769054b27fe824deca675d13d1dd4e6

                                SHA512

                                4d99b7442dedf50a23955109c2d9c12b20525cd0389e04affa4b8af6f19d6e23ab471cf7f572257fb1a10de46b8964ef429f046851d6b8894fb8ae5a241ba527

                              • C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

                                Filesize

                                8KB

                                MD5

                                35b4831c6fc5396a5196b8485cb59254

                                SHA1

                                e32884f4203e7da04abd76ed848a0875199cb59b

                                SHA256

                                87c81abc84c58b87ad84606c726f7010f3537139fa8a37e5f8f330eba0e86917

                                SHA512

                                b857fee216532dae8af1a9ebe217771bb12df173a45e16f7eb53beec0e48dd319d8b6c9bb77823a028cd981fa12c4d9ee69742c9546fa43ecbbf505810875e03

                              • C:\Users\Admin\AppData\Roaming\f1b9cb04e703f493.bin

                                Filesize

                                12KB

                                MD5

                                fe460da249870bf1e21a94ee19b9229a

                                SHA1

                                2215dfb5f849e503eda56219b2981ab0cde0fbd7

                                SHA256

                                3b0811d12366090231e9d628741d945099ea8e323431cb919800f4716ca1b59b

                                SHA512

                                3df27390cf3b71d315bb57cdec0b7813648ed12e32b52f3a9d7c5ad2212f8c27a97bda41c326664a2cc2b2fcb4d1da939c323c1076d3b4dcf71a8315b4ede8e5

                              • C:\Windows\SysWOW64\perfhost.exe

                                Filesize

                                588KB

                                MD5

                                b271cdac4a667534cebf9ce21daff1ff

                                SHA1

                                96d9b01592f5fa31d18548ea0e5ede6922bee26c

                                SHA256

                                c01a87a8d0b4540d72539430be4f31291f770c37c9866b45e173d183c30d7359

                                SHA512

                                c7618783dd0706e41c3d6f30655ac89c33d2dcd99b4e049d047ba389ce3e3525fc82fcda94bf2ead5bece5b3b01aa5b1b3a063339c1f0e870f795fcb9c58ffbb

                              • C:\Windows\System32\AgentService.exe

                                Filesize

                                1.7MB

                                MD5

                                588f19f46ea5a865ad15286d72689be4

                                SHA1

                                057bc61124f99d52a3acc4c690e28c7464e91fee

                                SHA256

                                5c63db4752670e3bdbd4ef02f94769b8577c606a16e129d7219081fd120adb41

                                SHA512

                                ee26667eff4a271fa37aa8be6624cf1f60963beef75590cf0457e24a78d1050a060d1f7e5b41f20aeb77089eb22d00b67c232256c66ead1eb633524f692e8b01

                              • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

                                Filesize

                                659KB

                                MD5

                                296747dc7e49b6a786a6e2461303e164

                                SHA1

                                fff6242a11390ead34e2604dd5e28b9872508628

                                SHA256

                                6b90643e2f89754fb1e2ea462869db96afe6eb106e3f19cdbac1a2496bf904b6

                                SHA512

                                c4b418c01888fea1a530516fdf4d2f52dd1450cf2f0efe7941ed2244ae5e61573c5acb07940e3973b0493e3f4e0583191e672430c892fe3abfe17ab20106c7ce

                              • C:\Windows\System32\FXSSVC.exe

                                Filesize

                                1.2MB

                                MD5

                                fbba8ee7ef1e2e22cdbc83653ffbdf47

                                SHA1

                                4299b2108e483e7756bf63f39b26bdd73b13fb19

                                SHA256

                                f03af112afa1204c74445f2a5189d7ef7d6beeb674a4b8352445300d4bcfba32

                                SHA512

                                95d6ff68443a90936c9e6c17b5f3fde963c6e2279b1938a9359ef2dddee1db4d9697d454514f03c2bd285263bc3d83787585f262670cca0a0b24e0321c62e2ad

                              • C:\Windows\System32\Locator.exe

                                Filesize

                                578KB

                                MD5

                                4c34c77fea862b78553afca3f1bab6c3

                                SHA1

                                8fe5beb89cb8efbb9c98c12ac3f8d207b0518aa8

                                SHA256

                                f43b300287876a4a64e62180e4889da23ba1bab53e277c5c46f8010920ee0934

                                SHA512

                                040d57731718140fd80c2ca39c657ccd91a9cf7798a4a7143b9cb4bf652ee8555c6f6d1b09f767a0d87315cfe624fd73805fd4002f28709190751b9a130e0b2b

                              • C:\Windows\System32\OpenSSH\ssh-agent.exe

                                Filesize

                                940KB

                                MD5

                                60302d0260150642d4f73d9c36da6e05

                                SHA1

                                9f8fd4ea87a1865ae46b7f1e48264c43d9f4abb3

                                SHA256

                                440dc41f602982c69353bb23abe8458b17205fa268552b9f1764d468432c0db2

                                SHA512

                                653170ea617d3cfc581d4bcaed0d5bfc7afebdf6a502da616d2587b34a17e5544b56cebc74203058b1f20d6488220c97554fd88e05d269d3b332cf9855bcc037

                              • C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

                                Filesize

                                671KB

                                MD5

                                8a3e398f37ab8203849bc62a66123503

                                SHA1

                                b2e3ea01337812a39f8b713483134a94f9bddfa1

                                SHA256

                                25b98c25bbec1b0c7137377ec192c1a3989095968eef5e66b18d84ed69277498

                                SHA512

                                113dca608b7426025ca127ba061bc68f3caa14edd73c4ace0a9831ea28999688e08ff07242ac7a5cb75949db3ae3e28c07ecd13ff06bdc27d664580fd13d7994

                              • C:\Windows\System32\SearchIndexer.exe

                                Filesize

                                1.4MB

                                MD5

                                7e2e1d5dafd6223dd8b98de580d3aa4e

                                SHA1

                                48d26b7dde35e8563072e42a759970251407c586

                                SHA256

                                250ff705aa9c898d8a80689bea5667a9fca536736fc17cfe2fa8faea2dfba881

                                SHA512

                                ddd85e8606b445b23aa7aabb2b818dee72ec82e006acf2e557db861d7095e3df5b2dbb3f9cf682b26781fa60be045eeee84cb5d4ee9acefb25b987b3f66a467b

                              • C:\Windows\System32\SensorDataService.exe

                                Filesize

                                1.8MB

                                MD5

                                41c8d4f3de5f10fc8bed1affff5dcef6

                                SHA1

                                7e95ff37bf40813eafb9b83f9f6d817fc6016867

                                SHA256

                                f306e86e247814e8ada7386f3badc1bcbd89a6a3916564a60b88c1a18df5c1ad

                                SHA512

                                72367df897c00f2b0d8470f72bc77080ae6444fbea0ff8b536974192617d90f2d658bab1cddec0a362b22d195c3761eca989ee2801db77b1437ec9b1b6f2a578

                              • C:\Windows\System32\Spectrum.exe

                                Filesize

                                1.4MB

                                MD5

                                a62ba4f7f0e153eceb73988deac415f0

                                SHA1

                                2e5753a31d47240017d14e22a85c614bc2f8543f

                                SHA256

                                3e475a46ccaf08d7821c60047ea4e529c4f03754ae4d23001b5d5940a46e4d83

                                SHA512

                                0946de876c602b13a65c3ae0fee9ecd0ba585d534bc1b1340ec9bddb1d95d7a5d79162fa7828837341a859bcf28da26e97ce9f16318c4da8b5bbd93239e81b40

                              • C:\Windows\System32\TieringEngineService.exe

                                Filesize

                                885KB

                                MD5

                                a4a25559841633c3a2d01ade083c2eb9

                                SHA1

                                fa5d6530e349ea195846797f0a83c67363287e44

                                SHA256

                                6915d46feabe93a3c961d23bd1a0eaff8d4a3db70328061bb4bd6ce0dd036201

                                SHA512

                                8e63b9c828703492625b82c831dfed49dee87265ad52ef1cbcc2ad49ee92407e1e1e867d7a278258167b9350ee8a978888ec1534db879726d37bdd262022ff9d

                              • C:\Windows\System32\VSSVC.exe

                                Filesize

                                2.0MB

                                MD5

                                d36129e2fd34e11df46ff6140dcf00b7

                                SHA1

                                fc47c3c3561ecefd8f12d9464698aa111ada1b4a

                                SHA256

                                e9ca47c37852d33d8582f2baf8ee80e3c8f40a1d08cc1c84a8b196f5aa3a346f

                                SHA512

                                df9c518cec97c54263f56ad69602bad7a111307d5f5d8ee4db27b6190aeddaf31db1f0e89deb0854e02a15ed058bf7485c70bacd1f3f9d7da27c7214c5000d06

                              • C:\Windows\System32\alg.exe

                                Filesize

                                661KB

                                MD5

                                54408885ba3e3e69912028d58c5fa442

                                SHA1

                                664d55a1633e48ce6d3d285cd72e1693a2217372

                                SHA256

                                139455b0ef077aa739450dff657a1eee83643482ea8183fd4e62e15d4d0cff98

                                SHA512

                                35fac82adffdc3210b20d5272a5e232e63dc8b2da1aee5ffa1cbd739be4f9a417038664da1d85bd3617ddb6cda3e5cf4ae4c4c65181fc21657a0f09311751e71

                              • C:\Windows\System32\msdtc.exe

                                Filesize

                                712KB

                                MD5

                                ea9bba895e6034cb5a0d497069cd3c26

                                SHA1

                                3cb470c9c52160e5407146d43ad8730a760d061c

                                SHA256

                                334570977fc26f798d20de3ee9ef36d5e574bb2bc305be1f7098b16c8c385ad4

                                SHA512

                                c64fc803a412e7bcc7be1dbcbae02c88972c3e270f477b58281723ae0dd6b62508ab7599104b3cbb0ac061d251e724c8139ff5c92bbd79fa0a651f5a982aded4

                              • C:\Windows\System32\snmptrap.exe

                                Filesize

                                584KB

                                MD5

                                1eef25df0dcb8e1d58f58fe770172ce4

                                SHA1

                                c3f113255ec638c859fafcd9eb00a320c94e3cfc

                                SHA256

                                6cf41ec9b1ac18948a29d3497496ca937c3ae08e47149169003d79584d3c7caf

                                SHA512

                                941a5ba08868f651d97e184605156daedaef2858306b2ce506bcb645bab5d71355e40f8560395556789c979dfaaf49f28032abbe2b637fe08a82ca5fd81f1835

                              • C:\Windows\System32\vds.exe

                                Filesize

                                1.3MB

                                MD5

                                f05c288b03a6fba92a52c4ddc2a40825

                                SHA1

                                2553e312dd881357f02d273db73b75fa1c05e0bf

                                SHA256

                                64ac9aae02136f0eca1fca67ef7d5111a9597e7cc18e12c0a97e6970a38fc754

                                SHA512

                                c2ff77ea1ac0d89364a76e429d76a336be30ed2414b5e66dc354ceef693048aab08981923a3c9a44db92a3a0740a9641e8a7b7ebf327963d5236e92c26ef291f

                              • C:\Windows\System32\wbem\WmiApSrv.exe

                                Filesize

                                772KB

                                MD5

                                8e17f7220be05022a10691ade344eb74

                                SHA1

                                2324c028d6196885b91dfba2ce82451e12e84f5e

                                SHA256

                                bbb819a694f70dda6fa12cd0cbdb8adbb27f3d1db7541b2d81ce2b9d18f34252

                                SHA512

                                1d69a612d543edd60405da16fb18ec49c0ef340be858eff860f79843513873a23ac9674d8e03c8ee53639d42656da1943287e9ab58be2134853c2007f2b3481e

                              • C:\Windows\System32\wbengine.exe

                                Filesize

                                2.1MB

                                MD5

                                54a4951de5496bb086ffb3d9fbe59a17

                                SHA1

                                001e5da726df2b0915cd81ed0fa3b18dfb082685

                                SHA256

                                38f1fcfef12b3eed42a6611b9db02751faeda15adda8da5ab71be9f600383fa4

                                SHA512

                                45bedbd62fc7c477bb73f17bb4898453c081ee41dd415c4f77fa964758cc852cdf77973459c621ea03524f163726519740b241974b216e6ffa255a5ad9b09883

                              • C:\Windows\TEMP\Crashpad\settings.dat

                                Filesize

                                40B

                                MD5

                                dd7a044bb22136e85285d21163fdef66

                                SHA1

                                1fcea0d904998de1bdea9cfa654a50c20b3dcc5b

                                SHA256

                                b918a44d48859b4ed705a9a7a23d4a816a368aa2161ad495a7a6d1c6992b61a0

                                SHA512

                                67afbad0468b8d5b405186c63a0960f5fcda15b2ab73767c292863e221265758001b2e110a3296f5d2ba1463863d556a535850a65a107344ade40a79c33bf358

                              • \??\pipe\crashpad_3052_SIVYHDNRXWPRJOGL

                                MD5

                                d41d8cd98f00b204e9800998ecf8427e

                                SHA1

                                da39a3ee5e6b4b0d3255bfef95601890afd80709

                                SHA256

                                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                SHA512

                                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                              • memory/208-271-0x0000000000400000-0x0000000000497000-memory.dmp

                                Filesize

                                604KB

                              • memory/404-36-0x0000000000680000-0x00000000006E0000-memory.dmp

                                Filesize

                                384KB

                              • memory/404-45-0x0000000140000000-0x00000001400A9000-memory.dmp

                                Filesize

                                676KB

                              • memory/404-42-0x0000000000680000-0x00000000006E0000-memory.dmp

                                Filesize

                                384KB

                              • memory/536-474-0x0000000140000000-0x00000001401D7000-memory.dmp

                                Filesize

                                1.8MB

                              • memory/536-273-0x0000000140000000-0x00000001401D7000-memory.dmp

                                Filesize

                                1.8MB

                              • memory/1064-154-0x0000000140000000-0x00000001401C0000-memory.dmp

                                Filesize

                                1.8MB

                              • memory/1100-326-0x0000000140000000-0x0000000140179000-memory.dmp

                                Filesize

                                1.5MB

                              • memory/1100-545-0x0000000140000000-0x0000000140179000-memory.dmp

                                Filesize

                                1.5MB

                              • memory/1224-12-0x00000000007F0000-0x0000000000850000-memory.dmp

                                Filesize

                                384KB

                              • memory/1224-511-0x0000000140000000-0x0000000140592000-memory.dmp

                                Filesize

                                5.6MB

                              • memory/1224-21-0x00000000007F0000-0x0000000000850000-memory.dmp

                                Filesize

                                384KB

                              • memory/1224-20-0x0000000140000000-0x0000000140592000-memory.dmp

                                Filesize

                                5.6MB

                              • memory/1356-28-0x0000000140000000-0x00000001400AA000-memory.dmp

                                Filesize

                                680KB

                              • memory/1356-533-0x0000000140000000-0x00000001400AA000-memory.dmp

                                Filesize

                                680KB

                              • memory/1496-281-0x0000000140000000-0x0000000140102000-memory.dmp

                                Filesize

                                1.0MB

                              • memory/1684-24-0x0000000000440000-0x00000000004A0000-memory.dmp

                                Filesize

                                384KB

                              • memory/1684-29-0x0000000140000000-0x0000000140592000-memory.dmp

                                Filesize

                                5.6MB

                              • memory/1684-9-0x0000000000440000-0x00000000004A0000-memory.dmp

                                Filesize

                                384KB

                              • memory/1684-8-0x0000000140000000-0x0000000140592000-memory.dmp

                                Filesize

                                5.6MB

                              • memory/1684-0-0x0000000000440000-0x00000000004A0000-memory.dmp

                                Filesize

                                384KB

                              • memory/2116-64-0x00000000001A0000-0x0000000000200000-memory.dmp

                                Filesize

                                384KB

                              • memory/2116-70-0x00000000001A0000-0x0000000000200000-memory.dmp

                                Filesize

                                384KB

                              • memory/2116-267-0x0000000140000000-0x000000014022B000-memory.dmp

                                Filesize

                                2.2MB

                              • memory/2116-543-0x0000000140000000-0x000000014022B000-memory.dmp

                                Filesize

                                2.2MB

                              • memory/2184-277-0x0000000140000000-0x0000000140096000-memory.dmp

                                Filesize

                                600KB

                              • memory/2368-91-0x0000000000830000-0x0000000000890000-memory.dmp

                                Filesize

                                384KB

                              • memory/2368-269-0x0000000140000000-0x00000001400CF000-memory.dmp

                                Filesize

                                828KB

                              • memory/2368-97-0x0000000000830000-0x0000000000890000-memory.dmp

                                Filesize

                                384KB

                              • memory/2492-291-0x0000000140000000-0x0000000140216000-memory.dmp

                                Filesize

                                2.1MB

                              • memory/2804-62-0x0000000140000000-0x0000000140135000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/2804-59-0x0000000140000000-0x0000000140135000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/2816-282-0x0000000140000000-0x00000001400E2000-memory.dmp

                                Filesize

                                904KB

                              • memory/3244-283-0x0000000140000000-0x0000000140147000-memory.dmp

                                Filesize

                                1.3MB

                              • memory/3532-268-0x0000000140000000-0x00000001400B9000-memory.dmp

                                Filesize

                                740KB

                              • memory/3692-270-0x0000000140000000-0x00000001400AB000-memory.dmp

                                Filesize

                                684KB

                              • memory/3692-101-0x0000000000B40000-0x0000000000BA0000-memory.dmp

                                Filesize

                                384KB

                              • memory/3852-544-0x0000000140000000-0x00000001400C6000-memory.dmp

                                Filesize

                                792KB

                              • memory/3852-320-0x0000000140000000-0x00000001400C6000-memory.dmp

                                Filesize

                                792KB

                              • memory/3976-86-0x0000000140000000-0x00000001400CF000-memory.dmp

                                Filesize

                                828KB

                              • memory/3976-80-0x0000000000CD0000-0x0000000000D30000-memory.dmp

                                Filesize

                                384KB

                              • memory/3976-84-0x0000000000CD0000-0x0000000000D30000-memory.dmp

                                Filesize

                                384KB

                              • memory/3976-74-0x0000000000CD0000-0x0000000000D30000-memory.dmp

                                Filesize

                                384KB

                              • memory/4108-458-0x0000000140000000-0x000000014057B000-memory.dmp

                                Filesize

                                5.5MB

                              • memory/4108-483-0x0000000140000000-0x000000014057B000-memory.dmp

                                Filesize

                                5.5MB

                              • memory/4116-353-0x0000000140000000-0x000000014024B000-memory.dmp

                                Filesize

                                2.3MB

                              • memory/4116-57-0x0000000000CA0000-0x0000000000D00000-memory.dmp

                                Filesize

                                384KB

                              • memory/4116-51-0x0000000000CA0000-0x0000000000D00000-memory.dmp

                                Filesize

                                384KB

                              • memory/4116-60-0x0000000140000000-0x000000014024B000-memory.dmp

                                Filesize

                                2.3MB

                              • memory/4392-278-0x0000000140000000-0x0000000140169000-memory.dmp

                                Filesize

                                1.4MB

                              • memory/5004-290-0x0000000140000000-0x00000001401FC000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/5080-272-0x0000000140000000-0x0000000140095000-memory.dmp

                                Filesize

                                596KB

                              • memory/5216-470-0x0000000140000000-0x000000014057B000-memory.dmp

                                Filesize

                                5.5MB

                              • memory/5216-614-0x0000000140000000-0x000000014057B000-memory.dmp

                                Filesize

                                5.5MB

                              • memory/5872-494-0x0000000140000000-0x000000014057B000-memory.dmp

                                Filesize

                                5.5MB

                              • memory/5872-433-0x0000000140000000-0x000000014057B000-memory.dmp

                                Filesize

                                5.5MB

                              • memory/5944-434-0x0000000140000000-0x000000014057B000-memory.dmp

                                Filesize

                                5.5MB

                              • memory/5944-612-0x0000000140000000-0x000000014057B000-memory.dmp

                                Filesize

                                5.5MB