Analysis

  • max time kernel
    166s
  • max time network
    215s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-06-2024 18:42

General

  • Target

    Debug/Crystal.exe

  • Size

    144KB

  • MD5

    9e353bbaf855fd44edba02d747b6e9f4

  • SHA1

    289146c6c89604690048b018638e147e8a53cbed

  • SHA256

    2d0efe812711be404787e0c6832284bbacb0e16e35d241cb29d88f44e8bc336e

  • SHA512

    13ebe39c7665b2d17d83f2df9d4241bcc2ddc7e086ab8b7b031ed56f8356611b92901f70e202d44e2d2d349e9c135202592dcc0ce3a45017576e0cde7d7760e5

  • SSDEEP

    3072:kjWWh/jzNFzkIbdb3gAp4bTv4A8D625U7N4MDaAiDmbUaXVNXa6fm:kjXzFzZdbQTbj4+PZ3DaAiDmbUUVN

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla payload 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Themida packer 8 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Debug\Crystal.exe
    "C:\Users\Admin\AppData\Local\Temp\Debug\Crystal.exe"
    1⤵
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1548
    • C:\Users\Admin\AppData\Local\Temp\Api.Solara\cd57e4c171d6e8f5ea8b8f824a6a7316.exe
      "C:\Users\Admin\AppData\Local\Temp\Api.Solara\cd57e4c171d6e8f5ea8b8f824a6a7316.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3876
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Api.Solara\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=3876.1604.2394548109547511807
        3⤵
        • Enumerates system info in registry
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of WriteProcessMemory
        PID:4516
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\Api.Solara\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\Api.Solara\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.52 --initial-client-data=0x15c,0x160,0x164,0x138,0x170,0x7ffae3442e98,0x7ffae3442ea4,0x7ffae3442eb0
          4⤵
            PID:2412
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Api.Solara\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1744 --field-trial-handle=1752,i,7683810579171379737,14329383726418416877,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2
            4⤵
              PID:2592
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Api.Solara\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1940 --field-trial-handle=1752,i,7683810579171379737,14329383726418416877,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3
              4⤵
                PID:4180
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Api.Solara\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2312 --field-trial-handle=1752,i,7683810579171379737,14329383726418416877,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8
                4⤵
                  PID:4312
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Api.Solara\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3604 --field-trial-handle=1752,i,7683810579171379737,14329383726418416877,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:1
                  4⤵
                    PID:5568
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Crystal.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Debug\Crystal.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=0 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1548.1136.13707563944614693613
                2⤵
                • Drops file in Program Files directory
                • Enumerates system info in registry
                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                • Suspicious use of WriteProcessMemory
                PID:2432
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\Debug\Crystal.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\Debug\Crystal.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.52 --initial-client-data=0x164,0x168,0x16c,0x140,0x104,0x7ffae3442e98,0x7ffae3442ea4,0x7ffae3442eb0
                  3⤵
                    PID:1568
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Debug\Crystal.exe.WebView2\EBWebView" --webview-exe-name=Crystal.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1736 --field-trial-handle=1740,i,4194730337516025619,6350338870146985399,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2
                    3⤵
                      PID:3964
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Debug\Crystal.exe.WebView2\EBWebView" --webview-exe-name=Crystal.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2060 --field-trial-handle=1740,i,4194730337516025619,6350338870146985399,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3
                      3⤵
                        PID:3168
                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe
                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Debug\Crystal.exe.WebView2\EBWebView" --webview-exe-name=Crystal.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2312 --field-trial-handle=1740,i,4194730337516025619,6350338870146985399,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8
                        3⤵
                          PID:4276
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Debug\Crystal.exe.WebView2\EBWebView" --webview-exe-name=Crystal.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3544 --field-trial-handle=1740,i,4194730337516025619,6350338870146985399,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:1
                          3⤵
                            PID:5580
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Debug\Crystal.exe.WebView2\EBWebView" --webview-exe-name=Crystal.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2152 --field-trial-handle=1740,i,4194730337516025619,6350338870146985399,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8
                            3⤵
                              PID:1200
                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe
                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Debug\Crystal.exe.WebView2\EBWebView" --webview-exe-name=Crystal.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2156 --field-trial-handle=1740,i,4194730337516025619,6350338870146985399,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8
                              3⤵
                                PID:1140
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3704 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
                            1⤵
                              PID:3092

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Program Files\chrome_Unpacker_BeginUnzipping2432_282884019\manifest.json
                              Filesize

                              108B

                              MD5

                              763e003bcbb80f3c81522cb052addfa0

                              SHA1

                              fa672c6fa9ce939d607a1526ca13ec245514b43d

                              SHA256

                              e1d24c2bfb4bc07717aa5833146ed55b67c41ef17fb61ef276eff923bb1ec20f

                              SHA512

                              41062cf02794548d6df38205fb369d1aa614ac67030cd909b66a23735473f76de1a3c0bcf0895c932bf9b5c506c1d9659745ec84ec52e361881eb474e92e3fea

                            • C:\Program Files\chrome_Unpacker_BeginUnzipping2432_346920265\keys.json
                              Filesize

                              6KB

                              MD5

                              2d4de461500a8828a8f9f788973c891b

                              SHA1

                              044b9052a3e463dde9d8d8a3fdb56085fcc4c6f6

                              SHA256

                              53a6e5dc368a54486f7580bdefeef06cd8c940f4e697343d774a59f679422320

                              SHA512

                              4a21c8baa20d899f45a0b6e545bf3d6d07b2421c5e5ccb547a8554734b8a51457a953c67afb9897a0baaf3e6d3c69d05e9f698b590b0f522d1a6d8e6109c2011

                            • C:\Program Files\chrome_Unpacker_BeginUnzipping2432_346920265\manifest.json
                              Filesize

                              79B

                              MD5

                              9f334804d984c140e3eb9644171ce6de

                              SHA1

                              3f24cca85f25517e9ee9cc6bfcee4f10169f5376

                              SHA256

                              4fe9e95540546ad31adbe93bc4780aeb381acc9c769422a8f8aec9a1a5376c79

                              SHA512

                              dec0efd18a63abf3368ccd0122d4d461b68c92c20961416c22f28c5b9d85d8f06779436b1b992e315fe649557f65e51512a74e7642a5a5dcbba9a69c6317ef8d

                            • C:\Users\Admin\AppData\Local\Temp\Api.Solara\Microsoft.Web.WebView2.Core.dll
                              Filesize

                              488KB

                              MD5

                              851fee9a41856b588847cf8272645f58

                              SHA1

                              ee185a1ff257c86eb19d30a191bf0695d5ac72a1

                              SHA256

                              5e7faee6b8230ca3b97ce9542b914db3abbbd1cb14fd95a39497aaad4c1094ca

                              SHA512

                              cf5c70984cf33e12cf57116da1f282a5bd6433c570831c185253d13463b0b9a0b9387d4d1bf4dddab3292a5d9ba96d66b6812e9d7ebc5eb35cb96eea2741348f

                            • C:\Users\Admin\AppData\Local\Temp\Api.Solara\Microsoft.Web.WebView2.Wpf.dll
                              Filesize

                              35KB

                              MD5

                              0be1da3ff37f50fd3b3e9af672823566

                              SHA1

                              6613d92e19bd889e0c330686526ea0fc9596bd33

                              SHA256

                              aaeff04c720c3c7df94beb7f670a0f992dcbb23a1f5283980084462a7f6e65a8

                              SHA512

                              600381e32ac6b379ee34beb5a938b4a4a2f69cfbd8cf086a1c57bb84876b02db050506a9fdac7fa028957a7ff21d911e15e8b85c4c0db1803d038f04efd3b2b8

                            • C:\Users\Admin\AppData\Local\Temp\Api.Solara\Monaco\fileaccess\node_modules\get-intrinsic\.nycrc
                              Filesize

                              139B

                              MD5

                              d0104f79f0b4f03bbcd3b287fa04cf8c

                              SHA1

                              54f9d7adf8943cb07f821435bb269eb4ba40ccc2

                              SHA256

                              997785c50b0773e5e18bf15550fbf57823c634fefe623cd37b3c83696402ad0a

                              SHA512

                              daf9b5445cfc02397f398adfa0258f2489b70699dfec6ca7e5b85afe5671fdcabe59edee332f718f5e5778feb1e301778dffe93bb28c1c0914f669659bad39c6

                            • C:\Users\Admin\AppData\Local\Temp\Api.Solara\Monaco\fileaccess\node_modules\hasown\.eslintrc
                              Filesize

                              43B

                              MD5

                              c28b0fe9be6e306cc2ad30fe00e3db10

                              SHA1

                              af79c81bd61c9a937fca18425dd84cdf8317c8b9

                              SHA256

                              0694050195fc694c5846b0a2a66b437ac775da988f0a779c55fb892597f7f641

                              SHA512

                              e3eca17804522ffa4f41e836e76e397a310a20e8261a38115b67e8b644444153039d04198fb470f45be2997d2c7a72b15bd4771a02c741b3cbc072ea6ef432e9

                            • C:\Users\Admin\AppData\Local\Temp\Api.Solara\Monaco\fileaccess\node_modules\hasown\.nycrc
                              Filesize

                              216B

                              MD5

                              c2ab942102236f987048d0d84d73d960

                              SHA1

                              95462172699187ac02eaec6074024b26e6d71cff

                              SHA256

                              948366fea3b423a46366326d0bb2e54b08abd1cf0b243678ba6625740c40da5a

                              SHA512

                              e36b20c16ceeb090750f3865efc8d7fd983ae4e8b41c30cc3865d2fd4925bf5902627e1f1ed46c0ff2453f076ef9de34be899ef57754b29cd158440071318479

                            • C:\Users\Admin\AppData\Local\Temp\Api.Solara\Monaco\fileaccess\node_modules\vary\LICENSE
                              Filesize

                              1KB

                              MD5

                              13babc4f212ce635d68da544339c962b

                              SHA1

                              4881ad2ec8eb2470a7049421047c6d076f48f1de

                              SHA256

                              bd47ce7b88c7759630d1e2b9fcfa170a0f1fde522be09e13fb1581a79d090400

                              SHA512

                              40e30174433408e0e2ed46d24373b12def47f545d9183b7bce28d4ddd8c8bb528075c7f20e118f37661db9f1bba358999d81a14425eb3e0a4a20865dfcb53182

                            • C:\Users\Admin\AppData\Local\Temp\Api.Solara\WebView2Loader.dll
                              Filesize

                              133KB

                              MD5

                              a0bd0d1a66e7c7f1d97aedecdafb933f

                              SHA1

                              dd109ac34beb8289030e4ec0a026297b793f64a3

                              SHA256

                              79d7e45f8631e8d2541d01bfb5a49a3a090be72b3d465389a2d684680fee2e36

                              SHA512

                              2a50ae5c7234a44b29f82ebc2e3cfed37bf69294eb00b2dc8905c61259975b2f3a059c67aeab862f002752454d195f7191d9b82b056f6ef22d6e1b0bb3673d50

                            • C:\Users\Admin\AppData\Local\Temp\Api.Solara\Wpf.Ui.dll
                              Filesize

                              5.2MB

                              MD5

                              aead90ab96e2853f59be27c4ec1e4853

                              SHA1

                              43cdedde26488d3209e17efff9a51e1f944eb35f

                              SHA256

                              46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed

                              SHA512

                              f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d

                            • C:\Users\Admin\AppData\Local\Temp\Api.Solara\bin\path.txt
                              Filesize

                              33B

                              MD5

                              7207978deac3d2df817c0efb6de01f45

                              SHA1

                              1b547cb35c2e709dcf4132452cdb5b6ccd66044f

                              SHA256

                              14056051c638d943e3f6cd8ae99b7b8b8b4419f6e6193861081e519eeb4dc808

                              SHA512

                              d38226a5eb755aafe7e8e3d707b00841aea985bd8dedf20556800f1bb7ac7c807fa195bdd1e21014087f89b319ab278bec922951b7c682e9edd3fbee147834ed

                            • C:\Users\Admin\AppData\Local\Temp\Api.Solara\cd57e4c171d6e8f5ea8b8f824a6a7316.dll
                              Filesize

                              3.9MB

                              MD5

                              0df8e80fd47cee0af8a6fb8ae2fd2237

                              SHA1

                              3780465816d176d162dc32895284aeb631efefd0

                              SHA256

                              2bf8ee57bc984b47d8662dc580c4aa97aa48807b5f7d5953d72c14e7277da045

                              SHA512

                              1864cc3cdea3ff3262bac5f1e308f9c937f329516b9f48c1a69eda9246d3ed0c8cdc51b4129c73bd766166327060eb4002d96a28f9e7ed361210b4a869aa1194

                            • C:\Users\Admin\AppData\Local\Temp\Api.Solara\cd57e4c171d6e8f5ea8b8f824a6a7316.exe
                              Filesize

                              86KB

                              MD5

                              d213a75b1956398e4c36bcc2f93339bf

                              SHA1

                              6a2739cc0e67f5593c744fbcbc8f00f12eef9954

                              SHA256

                              ece75d080f94df4b3699389021337b1536cfed229d1325f09b03f0b0d6d85ab4

                              SHA512

                              d32ddaf4c6f8f8df6c390d683e6c039f3b0d8f35f68f690b28bf88b17caedf0e11abd3aeb2e46238d0cd0a91b2db095cca0782b4e27f04453ea4cb6db38f4dd7

                            • C:\Users\Admin\AppData\Local\Temp\Api.Solara\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Crashpad\settings.dat
                              Filesize

                              280B

                              MD5

                              72130a2aab34ce59e2f4a1cca7b10790

                              SHA1

                              bc605c365884a01f2044597cebd53510b3803bb2

                              SHA256

                              8f84800e126cd62a9971e5694dc212ea97d161212d608f87547e6d880f021f6e

                              SHA512

                              0484ea864b08be78580d45c092aaf08df2d905cf84993add37f73b3b38a3f11bba37ccd6a6fd5982a4a37144ebe78df60c50f9b9b3f749366cb1fe567e738ed1

                            • C:\Users\Admin\AppData\Local\Temp\Api.Solara\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Crashpad\settings.dat
                              Filesize

                              280B

                              MD5

                              ad877eb3ffb40144bf283d2f6914f8dd

                              SHA1

                              c06eb07958476d60719250b5b792b95be9a4eeec

                              SHA256

                              377360ef4e279427e5a41d23b96d068c0323f2adb7b47f0d2274ed03f8d40006

                              SHA512

                              d670d8984f85a071530e8e18cbc7a9b1d81c66186bb79228b3d386ee89839018fa30c31ae342af99a86c0290f85436c87f96f269135a19049523c262041e36fb

                            • C:\Users\Admin\AppData\Local\Temp\Api.Solara\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
                              Filesize

                              20B

                              MD5

                              9e4e94633b73f4a7680240a0ffd6cd2c

                              SHA1

                              e68e02453ce22736169a56fdb59043d33668368f

                              SHA256

                              41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

                              SHA512

                              193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

                            • C:\Users\Admin\AppData\Local\Temp\Api.Solara\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
                              Filesize

                              41B

                              MD5

                              5af87dfd673ba2115e2fcf5cfdb727ab

                              SHA1

                              d5b5bbf396dc291274584ef71f444f420b6056f1

                              SHA256

                              f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                              SHA512

                              de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                            • C:\Users\Admin\AppData\Local\Temp\Api.Solara\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\GPUCache\data_0
                              Filesize

                              8KB

                              MD5

                              cf89d16bb9107c631daabf0c0ee58efb

                              SHA1

                              3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

                              SHA256

                              d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

                              SHA512

                              8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

                            • C:\Users\Admin\AppData\Local\Temp\Api.Solara\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\GPUCache\data_1
                              Filesize

                              264KB

                              MD5

                              f50f89a0a91564d0b8a211f8921aa7de

                              SHA1

                              112403a17dd69d5b9018b8cede023cb3b54eab7d

                              SHA256

                              b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                              SHA512

                              bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                            • C:\Users\Admin\AppData\Local\Temp\Api.Solara\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\GPUCache\data_2
                              Filesize

                              8KB

                              MD5

                              0962291d6d367570bee5454721c17e11

                              SHA1

                              59d10a893ef321a706a9255176761366115bedcb

                              SHA256

                              ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

                              SHA512

                              f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

                            • C:\Users\Admin\AppData\Local\Temp\Api.Solara\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\GPUCache\data_3
                              Filesize

                              8KB

                              MD5

                              41876349cb12d6db992f1309f22df3f0

                              SHA1

                              5cf26b3420fc0302cd0a71e8d029739b8765be27

                              SHA256

                              e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

                              SHA512

                              e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

                            • C:\Users\Admin\AppData\Local\Temp\Api.Solara\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
                              Filesize

                              16B

                              MD5

                              46295cac801e5d4857d09837238a6394

                              SHA1

                              44e0fa1b517dbf802b18faf0785eeea6ac51594b

                              SHA256

                              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                              SHA512

                              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                            • C:\Users\Admin\AppData\Local\Temp\Api.Solara\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local State
                              Filesize

                              2KB

                              MD5

                              28f60aa64f5553beb11dc0490f2c4ccb

                              SHA1

                              491c86e0254a8e6f5c14997c0dbcaf5a6eafe8aa

                              SHA256

                              1e3a7fd144697d17767c27c1c55ebfa855b3a24e9795e72647d5719831d7157f

                              SHA512

                              17af8059685076553891fd0e977ae3b07a89d2684a1d501d741d7763717a5ef21452aefa154bcab253d49ee50332b465914f7886b3a2bfd670d771b343fe6ba8

                            • C:\Users\Admin\AppData\Local\Temp\Api.Solara\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local State
                              Filesize

                              3KB

                              MD5

                              4f823e0921cf77fc50bbffb4db9a62e4

                              SHA1

                              137a97de9e46f1a4adf9d655633bcc079c488be9

                              SHA256

                              c92ece0602a1dd91d56c1a094bcf305bdec0396159b75458a1ad715564217703

                              SHA512

                              80ea94573fd22559f3256faab2d9e5e5792b767d13a3f3dd2c9623956a91fc36ffe9edf96b2442643811615e88681b2453093d3e3dd59147eeecdcd202d2e6b1

                            • C:\Users\Admin\AppData\Local\Temp\Api.Solara\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local State
                              Filesize

                              3KB

                              MD5

                              56fc8b2588bf4b514420d319def58e32

                              SHA1

                              870ff16bf06b246a5bbb57915c58980e703a0f1c

                              SHA256

                              788d723a72b7039357fd81150bdc302af54166f04c9ff544acfa30d20f128a35

                              SHA512

                              2b60f02ca6979933dc3b393244227126e31d30fa0a9e68ebdc7c0675e226f1997fd4d43aeee72fab2be4c47e02c56b503dfb90bbe9c4a3ba8c74be17d2ca3d16

                            • C:\Users\Admin\AppData\Local\Temp\Api.Solara\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local State~RFe59afaf.TMP
                              Filesize

                              1KB

                              MD5

                              1e3fbea7a72eb5c5327607d30674ac15

                              SHA1

                              38915821e33c4a2e1eefe15b44d7fc24554f1379

                              SHA256

                              d391b2c5afa85e102a8f3e57cae3c260bf048d2b9d4887545157092c65edaeef

                              SHA512

                              0733ed78046eb18ee6a0e8fc5356ebb23ae7fde911ce318543368b8af0b63533e4df89f66f8f16dcaac135da48d05660ed1e26944c80a59be8fb7ff6724d036e

                            • C:\Users\Admin\AppData\Local\Temp\Api.Solara\libcurl.dll
                              Filesize

                              522KB

                              MD5

                              e31f5136d91bad0fcbce053aac798a30

                              SHA1

                              ee785d2546aec4803bcae08cdebfd5d168c42337

                              SHA256

                              ee94e2201870536522047e6d7fe7b903a63cd2e13e20c8fffc86d0e95361e671

                              SHA512

                              a1543eb1d10d25efb44f9eaa0673c82bfac5173055d04c0f3be4792984635a7c774df57a8e289f840627754a4e595b855d299070d469e0f1e637c3f35274abe6

                            • C:\Users\Admin\AppData\Local\Temp\Api.Solara\vcruntime140.dll
                              Filesize

                              99KB

                              MD5

                              7a2b8cfcd543f6e4ebca43162b67d610

                              SHA1

                              c1c45a326249bf0ccd2be2fbd412f1a62fb67024

                              SHA256

                              7d7ca28235fba5603a7f40514a552ac7efaa67a5d5792bb06273916aa8565c5f

                              SHA512

                              e38304fb9c5af855c1134f542adf72cde159fab64385533eafa5bb6e374f19b5a29c0cb5516fc5da5c0b5ac47c2f6420792e0ac8ddff11e749832a7b7f3eb5c8

                            • C:\Users\Admin\AppData\Local\Temp\Api.Solara\zlib1.dll
                              Filesize

                              113KB

                              MD5

                              75365924730b0b2c1a6ee9028ef07685

                              SHA1

                              a10687c37deb2ce5422140b541a64ac15534250f

                              SHA256

                              945e7f5d09938b7769a4e68f4ef01406e5af9f40db952cba05ddb3431dd1911b

                              SHA512

                              c1e31c18903e657203ae847c9af601b1eb38efa95cb5fa7c1b75f84a2cba9023d08f1315c9bb2d59b53256dfdb3bac89930252138475491b21749471adc129a1

                            • C:\Users\Admin\AppData\Local\Temp\Debug\Crystal.exe.WebView2\EBWebView\Crashpad\settings.dat
                              Filesize

                              280B

                              MD5

                              3c5c5443e8187ee344e8b22af02be1e7

                              SHA1

                              6f3942d9cc851c1e5a4940128f91ec5a45cb08e7

                              SHA256

                              a7e1ceaa8e223070e06d7001da65de4440ba5d9679325042be3c884f2ff989c8

                              SHA512

                              581ab8f470b0a71a71f7855ebd3a061cf66e0a73730fc9634d959fb0fcfef6b04512f951606075f263990a2e0dc625c00062cde8304386bb862c3f37d353f2f8

                            • C:\Users\Admin\AppData\Local\Temp\Debug\Crystal.exe.WebView2\EBWebView\Crashpad\settings.dat
                              Filesize

                              280B

                              MD5

                              a705762f7c4d93c75f5ce1c41665b0f9

                              SHA1

                              daeae50102424567bb51666232da62a83441bdfb

                              SHA256

                              a380668e555c22c3218a75aa06fa11a907fef51de355080ff71925b38ed1f852

                              SHA512

                              e6e15a65fdad170ebc53060ef933bbceb9cda13123be1339ca53aded63393ef822a5fc087312095b7f250ad93288f46b02bfdd661f83252f41f0df9b3998085d

                            • C:\Users\Admin\AppData\Local\Temp\Debug\Crystal.exe.WebView2\EBWebView\Crashpad\settings.dat
                              Filesize

                              280B

                              MD5

                              1bbd8a13069a8ca58e4a531e9b53ab99

                              SHA1

                              803086e779223589d3f35eaa05cd4cad7ccfc748

                              SHA256

                              b158946ff877a58d1bf730e88b9a9da4e10d26cd2c7678de2b13cfe7b7d573bc

                              SHA512

                              3308442a6e5766a75758a09dc302a725e850c24a631de6fc776102ebfe62f5f4e24352a864d7ef5fad0c561eaf38d903ffff1f66b5242d40c40d22605780d08d

                            • C:\Users\Admin\AppData\Local\Temp\Debug\Crystal.exe.WebView2\EBWebView\Default\Network\9c1aee44-8582-472d-b622-0009a9ad5a8e.tmp
                              Filesize

                              40B

                              MD5

                              20d4b8fa017a12a108c87f540836e250

                              SHA1

                              1ac617fac131262b6d3ce1f52f5907e31d5f6f00

                              SHA256

                              6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

                              SHA512

                              507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

                            • C:\Users\Admin\AppData\Local\Temp\Debug\Crystal.exe.WebView2\EBWebView\Default\Network\Network Persistent State
                              Filesize

                              1KB

                              MD5

                              7eba753fd180484b9f14b6a37f8aaa41

                              SHA1

                              95dab8de129f1ceeff0ddbb7304e8831d246af83

                              SHA256

                              a842701dc07e1ab272cbc26722b98fc57e2c5a9321bd8e88e526cf2490883f38

                              SHA512

                              996b9f3bfd72694c6c84738df6b237de7c9b2e2813308d66aee70dba6dc7e67a90f80bacdda26cfd95bf88a6e49ff9d38862de3ebdf7f8660c92de3c290e6b2a

                            • C:\Users\Admin\AppData\Local\Temp\Debug\Crystal.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
                              Filesize

                              2B

                              MD5

                              d751713988987e9331980363e24189ce

                              SHA1

                              97d170e1550eee4afc0af065b78cda302a97674c

                              SHA256

                              4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                              SHA512

                              b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                            • C:\Users\Admin\AppData\Local\Temp\Debug\Crystal.exe.WebView2\EBWebView\Default\Network\TransportSecurity
                              Filesize

                              859B

                              MD5

                              a13a17c730ad5d4327bef30d04f31e7b

                              SHA1

                              ff93663181f54442e8000be8febab055338b2cf4

                              SHA256

                              783f67db3c6b8af9bb00b9bdfb26cdcd3133ff2beab0dcdf9d290f76b2514dec

                              SHA512

                              19e7f2b3c745d4e456a8474de908b2da0ff32131408ef07f95d7f837d7e0361c32ab7bfbd1dd3bc1fb8b42cd1324aa4c15899795c654e99849632d1e25851833

                            • C:\Users\Admin\AppData\Local\Temp\Debug\Crystal.exe.WebView2\EBWebView\Default\Preferences
                              Filesize

                              8KB

                              MD5

                              356b2f1987f520012da89f0feccd6b26

                              SHA1

                              79753d66ae49d0d8d7649c49e6ed14032cf2e992

                              SHA256

                              c01ae4082b7c22933edf81dc22f79e46c0648298108784198e016ad5eb57a226

                              SHA512

                              f599dcb9f546dc7fc8980cb9a88a29ebf35e027a13463f8f14314fa6f22990de4e7d258d854a734a67b954d996f24e4249a0f1f5dc062fbb23f73dcc3db46e7e

                            • C:\Users\Admin\AppData\Local\Temp\Debug\Crystal.exe.WebView2\EBWebView\Default\Secure Preferences
                              Filesize

                              6KB

                              MD5

                              facd4b1e37285d542ac46542af884745

                              SHA1

                              9e4efff12db388ded11d5d0925d4597bfce89ed0

                              SHA256

                              19784efcfbdeaac005e2f05994d33e63b7c69874829793e168f4600d983b41e6

                              SHA512

                              9d93c6cb7836daa55abc8b652a991ce4deaab40e9239e27b1a6a03c018b505682e7120221963b3e00d3741385dbe4f47dc4588ec35a015256893bb38d9f2f537

                            • C:\Users\Admin\AppData\Local\Temp\Debug\Crystal.exe.WebView2\EBWebView\Local State
                              Filesize

                              20KB

                              MD5

                              45f20bac0729b60f657543863cd693e1

                              SHA1

                              e4a6f79ffee2e5a5322e559b6395ecd6b6ed5e1f

                              SHA256

                              654b7237515460ddd8aa6519eb88686781acd35a15a74a1e073a4685b1611aa3

                              SHA512

                              2229414e5451f0b731dc42b19f55047af982b63b447e446eecd5250b8020b3d93f24fe6e97e9181be158410dcc8ffe8ec103e189b82cd78e46782f5a39e1e527

                            • C:\Users\Admin\AppData\Local\Temp\Debug\Crystal.exe.WebView2\EBWebView\TpcdMetadata\2024.4.29.1\metadata.pb
                              Filesize

                              31KB

                              MD5

                              7b9001fd6a5786c7b7edfa104a1eca5b

                              SHA1

                              462bafeca182a3e600ba22eaa1cab15c1a70831c

                              SHA256

                              779726531d52eff63d46df72ddcd421921b2e6bb918147a18c2adc28f45e693c

                              SHA512

                              f16d79a093c55408b6c118a743c5d77057dc899f5303c55003298fd67256f58200e085d03471f421065db1d3b131393f2e3a96ca71e35c94f1ba7a0569029918

                            • \??\pipe\crashpad_2432_UKABWJJIJEHCECSM
                              MD5

                              d41d8cd98f00b204e9800998ecf8427e

                              SHA1

                              da39a3ee5e6b4b0d3255bfef95601890afd80709

                              SHA256

                              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                              SHA512

                              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                            • memory/1548-1481-0x0000000074DD0000-0x0000000075580000-memory.dmp
                              Filesize

                              7.7MB

                            • memory/1548-1891-0x0000000005540000-0x0000000005550000-memory.dmp
                              Filesize

                              64KB

                            • memory/1548-1-0x0000000000A90000-0x0000000000ABC000-memory.dmp
                              Filesize

                              176KB

                            • memory/1548-2-0x0000000002DA0000-0x0000000002DB6000-memory.dmp
                              Filesize

                              88KB

                            • memory/1548-3-0x0000000074DD0000-0x0000000075580000-memory.dmp
                              Filesize

                              7.7MB

                            • memory/1548-4-0x000000000B130000-0x000000000B6D4000-memory.dmp
                              Filesize

                              5.6MB

                            • memory/1548-5-0x000000000AC60000-0x000000000ACF2000-memory.dmp
                              Filesize

                              584KB

                            • memory/1548-1936-0x0000000005800000-0x0000000005900000-memory.dmp
                              Filesize

                              1024KB

                            • memory/1548-6-0x000000000ABD0000-0x000000000ABDE000-memory.dmp
                              Filesize

                              56KB

                            • memory/1548-1518-0x0000000005540000-0x0000000005550000-memory.dmp
                              Filesize

                              64KB

                            • memory/1548-1925-0x0000000005540000-0x0000000005550000-memory.dmp
                              Filesize

                              64KB

                            • memory/1548-1494-0x0000000005800000-0x0000000005900000-memory.dmp
                              Filesize

                              1024KB

                            • memory/1548-7-0x000000000B6E0000-0x000000000B770000-memory.dmp
                              Filesize

                              576KB

                            • memory/1548-8-0x000000000B080000-0x000000000B08A000-memory.dmp
                              Filesize

                              40KB

                            • memory/1548-9-0x000000000B990000-0x000000000BBA2000-memory.dmp
                              Filesize

                              2.1MB

                            • memory/1548-1489-0x0000000005540000-0x0000000005550000-memory.dmp
                              Filesize

                              64KB

                            • memory/1548-1898-0x0000000005540000-0x0000000005550000-memory.dmp
                              Filesize

                              64KB

                            • memory/1548-10-0x0000000074DD0000-0x0000000075580000-memory.dmp
                              Filesize

                              7.7MB

                            • memory/1548-1569-0x0000000005540000-0x0000000005550000-memory.dmp
                              Filesize

                              64KB

                            • memory/1548-11-0x000000000E280000-0x000000000E28A000-memory.dmp
                              Filesize

                              40KB

                            • memory/1548-12-0x000000000E390000-0x000000000E39A000-memory.dmp
                              Filesize

                              40KB

                            • memory/1548-1487-0x0000000005540000-0x0000000005550000-memory.dmp
                              Filesize

                              64KB

                            • memory/1548-14-0x000000000ED20000-0x000000000ED32000-memory.dmp
                              Filesize

                              72KB

                            • memory/1548-1484-0x0000000074DD0000-0x0000000075580000-memory.dmp
                              Filesize

                              7.7MB

                            • memory/1548-1468-0x0000000074DDE000-0x0000000074DDF000-memory.dmp
                              Filesize

                              4KB

                            • memory/1548-0-0x0000000074DDE000-0x0000000074DDF000-memory.dmp
                              Filesize

                              4KB

                            • memory/1548-1482-0x0000000005540000-0x0000000005550000-memory.dmp
                              Filesize

                              64KB

                            • memory/2592-1563-0x00007FFB08D40000-0x00007FFB08D41000-memory.dmp
                              Filesize

                              4KB

                            • memory/3876-1486-0x00000257C0490000-0x00000257C09CC000-memory.dmp
                              Filesize

                              5.2MB

                            • memory/3876-1516-0x00000257C55D0000-0x00000257C55DE000-memory.dmp
                              Filesize

                              56KB

                            • memory/3876-1895-0x0000000180000000-0x0000000180A63000-memory.dmp
                              Filesize

                              10.4MB

                            • memory/3876-1668-0x00000257A7790000-0x00000257A77A0000-memory.dmp
                              Filesize

                              64KB

                            • memory/3876-1483-0x00000257A7790000-0x00000257A77A0000-memory.dmp
                              Filesize

                              64KB

                            • memory/3876-1480-0x00000257A5A40000-0x00000257A5A5A000-memory.dmp
                              Filesize

                              104KB

                            • memory/3876-1509-0x0000000180000000-0x0000000180A63000-memory.dmp
                              Filesize

                              10.4MB

                            • memory/3876-1511-0x0000000180000000-0x0000000180A63000-memory.dmp
                              Filesize

                              10.4MB

                            • memory/3876-1488-0x00000257C0200000-0x00000257C02BA000-memory.dmp
                              Filesize

                              744KB

                            • memory/3876-1490-0x00000257A7790000-0x00000257A77A0000-memory.dmp
                              Filesize

                              64KB

                            • memory/3876-1479-0x00007FFAE80A3000-0x00007FFAE80A5000-memory.dmp
                              Filesize

                              8KB

                            • memory/3876-1510-0x0000000180000000-0x0000000180A63000-memory.dmp
                              Filesize

                              10.4MB

                            • memory/3876-1508-0x0000000180000000-0x0000000180A63000-memory.dmp
                              Filesize

                              10.4MB

                            • memory/3876-1492-0x00000257C0150000-0x00000257C0160000-memory.dmp
                              Filesize

                              64KB

                            • memory/3876-1493-0x00000257A7790000-0x00000257A77A0000-memory.dmp
                              Filesize

                              64KB

                            • memory/3876-1517-0x0000000180000000-0x0000000180A63000-memory.dmp
                              Filesize

                              10.4MB

                            • memory/3876-1667-0x0000000180000000-0x0000000180A63000-memory.dmp
                              Filesize

                              10.4MB

                            • memory/3876-1515-0x00000257C5600000-0x00000257C5638000-memory.dmp
                              Filesize

                              224KB

                            • memory/3876-1514-0x00000257C4FC0000-0x00000257C4FC8000-memory.dmp
                              Filesize

                              32KB

                            • memory/3876-1496-0x00000257C0400000-0x00000257C047E000-memory.dmp
                              Filesize

                              504KB

                            • memory/4312-1583-0x00007FFB076B0000-0x00007FFB076B1000-memory.dmp
                              Filesize

                              4KB

                            • memory/4312-1582-0x00007FFB08F60000-0x00007FFB08F61000-memory.dmp
                              Filesize

                              4KB

                            • memory/5568-1705-0x00007FFB08D40000-0x00007FFB08D41000-memory.dmp
                              Filesize

                              4KB