Analysis

  • max time kernel
    30s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/07/2024, 02:29

General

  • Target

    c03f161f2c5d8492263cd0a59e3cd3cd5582a8e4fbfcf8bef793ac0c1b1e07cf.exe

  • Size

    1.8MB

  • MD5

    e588bd7ef23ba44220fcde6c23088bec

  • SHA1

    83c8e778f099520e7cd2a03efb610f4d33bf3f1e

  • SHA256

    c03f161f2c5d8492263cd0a59e3cd3cd5582a8e4fbfcf8bef793ac0c1b1e07cf

  • SHA512

    f6004fb6cf5c3915e094aa16765ede1f50babb7a75d47ea79e1ca90dac29ca02754d99a712c948dd2ec1ad64e64c7f3318c22212bd95fac9a6fab5c39362de06

  • SSDEEP

    49152:MrnKOYuAY/mf/m8o8/jMDFlMWiZ97YwhNJY:GnKOYs+f/Ho0M859R

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

C2

http://185.215.113.19

Attributes
  • install_dir

    0d8f5eb8a7

  • install_file

    explorti.exe

  • strings_key

    6c55a5f34bb433fbd933a168577b1838

  • url_paths

    /Vi9leo/index.php

rc4.plain

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

stealc

Botnet

valenciga

C2

http://45.158.12.58

Attributes
  • url_path

    /e47233787df7c9a6.php

Extracted

Family

lumma

C2

https://stimultaionsppzv.shop/api

https://horizonvxjis.shop/api

https://effectivedoxzj.shop/api

https://parntorpkxzlp.shop/api

https://grassytaisol.shop/api

https://broccoltisop.shop/api

https://shellfyyousdjz.shop/api

https://bravedreacisopm.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Identifies Wine through registry keys 2 TTPs 3 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c03f161f2c5d8492263cd0a59e3cd3cd5582a8e4fbfcf8bef793ac0c1b1e07cf.exe
    "C:\Users\Admin\AppData\Local\Temp\c03f161f2c5d8492263cd0a59e3cd3cd5582a8e4fbfcf8bef793ac0c1b1e07cf.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2332
    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3480
      • C:\Users\Admin\AppData\Local\Temp\1000020001\63ef288fd3.exe
        "C:\Users\Admin\AppData\Local\Temp\1000020001\63ef288fd3.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4704
        • C:\Windows\system32\cmd.exe
          "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\E7A1.tmp\E7A2.tmp\E7B2.bat C:\Users\Admin\AppData\Local\Temp\1000020001\63ef288fd3.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2480
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
            5⤵
            • Enumerates system info in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:2796
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7fff80cbcc40,0x7fff80cbcc4c,0x7fff80cbcc58
              6⤵
                PID:4976
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1916,i,14795560458351677002,17841151693435565437,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=1912 /prefetch:2
                6⤵
                  PID:1776
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2164,i,14795560458351677002,17841151693435565437,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2176 /prefetch:3
                  6⤵
                    PID:3872
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2224,i,14795560458351677002,17841151693435565437,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2404 /prefetch:8
                    6⤵
                      PID:1904
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3128,i,14795560458351677002,17841151693435565437,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3164 /prefetch:1
                      6⤵
                        PID:5356
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3136,i,14795560458351677002,17841151693435565437,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3196 /prefetch:1
                        6⤵
                          PID:5364
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3608,i,14795560458351677002,17841151693435565437,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4476 /prefetch:8
                          6⤵
                            PID:2900
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4788,i,14795560458351677002,17841151693435565437,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4832 /prefetch:8
                            6⤵
                              PID:5912
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2176,i,14795560458351677002,17841151693435565437,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4556 /prefetch:3
                              6⤵
                                PID:6524
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4940,i,14795560458351677002,17841151693435565437,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=1172 /prefetch:8
                                6⤵
                                  PID:7148
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
                                5⤵
                                • Enumerates system info in registry
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                • Suspicious use of WriteProcessMemory
                                PID:4780
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7fff80b746f8,0x7fff80b74708,0x7fff80b74718
                                  6⤵
                                    PID:3252
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,12016731066675817041,421812428083772731,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
                                    6⤵
                                      PID:812
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2240,12016731066675817041,421812428083772731,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
                                      6⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2064
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2240,12016731066675817041,421812428083772731,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2616 /prefetch:8
                                      6⤵
                                        PID:3020
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,12016731066675817041,421812428083772731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
                                        6⤵
                                          PID:5156
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,12016731066675817041,421812428083772731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
                                          6⤵
                                            PID:5164
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,12016731066675817041,421812428083772731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4456 /prefetch:1
                                            6⤵
                                              PID:6116
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,12016731066675817041,421812428083772731,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5100 /prefetch:2
                                              6⤵
                                                PID:1924
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
                                              5⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:1456
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                                6⤵
                                                • Checks processor information in registry
                                                • Modifies registry class
                                                • Suspicious use of FindShellTrayWindow
                                                • Suspicious use of SendNotifyMessage
                                                • Suspicious use of SetWindowsHookEx
                                                • Suspicious use of WriteProcessMemory
                                                PID:4316
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1976 -parentBuildID 20240401114208 -prefsHandle 1892 -prefMapHandle 1884 -prefsLen 25755 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d0e6fce-bd72-4f4d-b3c9-50914d6b84b0} 4316 "\\.\pipe\gecko-crash-server-pipe.4316" gpu
                                                  7⤵
                                                    PID:4292
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2452 -parentBuildID 20240401114208 -prefsHandle 2420 -prefMapHandle 2416 -prefsLen 26675 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1501cb81-ca99-4b39-bc55-c9b80bd284bc} 4316 "\\.\pipe\gecko-crash-server-pipe.4316" socket
                                                    7⤵
                                                      PID:1928
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3472 -childID 1 -isForBrowser -prefsHandle 3464 -prefMapHandle 3460 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 884 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d625dd36-797e-4871-abce-c0d2f9fb0442} 4316 "\\.\pipe\gecko-crash-server-pipe.4316" tab
                                                      7⤵
                                                        PID:6020
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4160 -childID 2 -isForBrowser -prefsHandle 4204 -prefMapHandle 4116 -prefsLen 23305 -prefMapSize 244658 -jsInitHandle 884 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6c8789f-10b2-402a-80be-162ac80bfd6b} 4316 "\\.\pipe\gecko-crash-server-pipe.4316" tab
                                                        7⤵
                                                          PID:6832
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4356 -childID 3 -isForBrowser -prefsHandle 4364 -prefMapHandle 4368 -prefsLen 23305 -prefMapSize 244658 -jsInitHandle 884 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e3ce1bba-4258-4bf6-b042-42d6e9abc3aa} 4316 "\\.\pipe\gecko-crash-server-pipe.4316" tab
                                                          7⤵
                                                            PID:6900
                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4424 -childID 4 -isForBrowser -prefsHandle 4432 -prefMapHandle 4436 -prefsLen 23305 -prefMapSize 244658 -jsInitHandle 884 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {15102d76-74ea-4d32-a711-95e0641819df} 4316 "\\.\pipe\gecko-crash-server-pipe.4316" tab
                                                            7⤵
                                                              PID:6920
                                                    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
                                                      3⤵
                                                        PID:5424
                                                      • C:\Users\Admin\1000029002\ca61a3abae.exe
                                                        "C:\Users\Admin\1000029002\ca61a3abae.exe"
                                                        3⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:4788
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 1372
                                                          4⤵
                                                          • Program crash
                                                          PID:780
                                                      • C:\Users\Admin\AppData\Local\Temp\1000030001\74980e5032.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\1000030001\74980e5032.exe"
                                                        3⤵
                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                        • Checks BIOS information in registry
                                                        • Executes dropped EXE
                                                        • Identifies Wine through registry keys
                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                        • Drops file in Windows directory
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:6008
                                                        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
                                                          4⤵
                                                            PID:1428
                                                            • C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe"
                                                              5⤵
                                                                PID:5460
                                                              • C:\Users\Admin\AppData\Local\Temp\1000047001\postbox.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\1000047001\postbox.exe"
                                                                5⤵
                                                                  PID:6552
                                                                  • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                                                                    C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                                                                    6⤵
                                                                      PID:2420
                                                          • C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
                                                            "C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
                                                            1⤵
                                                              PID:5896
                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                              1⤵
                                                                PID:5928
                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                1⤵
                                                                  PID:5392
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                  1⤵
                                                                    PID:6152
                                                                  • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                                    1⤵
                                                                      PID:2936
                                                                    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                                                                      1⤵
                                                                        PID:7028
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4788 -ip 4788
                                                                        1⤵
                                                                          PID:5864
                                                                        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                                          1⤵
                                                                            PID:6448
                                                                          • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                                                                            1⤵
                                                                              PID:2748

                                                                            Network

                                                                            MITRE ATT&CK Enterprise v15

                                                                            Replay Monitor

                                                                            Loading Replay Monitor...

                                                                            Downloads

                                                                            • C:\ProgramData\mozglue.dll

                                                                              Filesize

                                                                              593KB

                                                                              MD5

                                                                              c8fd9be83bc728cc04beffafc2907fe9

                                                                              SHA1

                                                                              95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                              SHA256

                                                                              ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                              SHA512

                                                                              fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                            • C:\ProgramData\nss3.dll

                                                                              Filesize

                                                                              2.0MB

                                                                              MD5

                                                                              1cc453cdf74f31e4d913ff9c10acdde2

                                                                              SHA1

                                                                              6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                                              SHA256

                                                                              ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                                              SHA512

                                                                              dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                                            • C:\Users\Admin\1000029002\ca61a3abae.exe

                                                                              Filesize

                                                                              2.5MB

                                                                              MD5

                                                                              b7677aad5399636a95eb6994e115916d

                                                                              SHA1

                                                                              e2d4dcd2ebc1027245d2103a0fd9606f9bd2c5d6

                                                                              SHA256

                                                                              88edcb330179b6d28b755308b2c06b9a9ee4adb10ea7e4185d0af1697ad89761

                                                                              SHA512

                                                                              d0b8024ade74ccd107d3e85cb3bcb1d164121097f75fbea5b74c657763d01ae58275a860e39f32fa2cc7e7064c551cce6e68c7bec2ce4f81ffd4b4f74dceca87

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                                                              Filesize

                                                                              649B

                                                                              MD5

                                                                              2ee0deb81f2b6bcdd4a9cc9424db614a

                                                                              SHA1

                                                                              31121f353b9e2022872fa953e9717f651c1d56bc

                                                                              SHA256

                                                                              039b4522aea02c70bbaff99bb94af242de85638103dca7879e85f5ad01213a84

                                                                              SHA512

                                                                              f2c30987807dc4e679661c0176a5219dd8df618ea6a041cc6bf2dbb2c803974c14ac2aecc1e60eb1c969a9fb0a3b89ff52083ca1b025e679f60e64439359f6cb

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0

                                                                              Filesize

                                                                              44KB

                                                                              MD5

                                                                              16af9d7773f1a3239e599eb36e3d4542

                                                                              SHA1

                                                                              e96083420901d20a0f90a5599475e5a42d5fd29c

                                                                              SHA256

                                                                              f12f9f28567674269a31c4a76aec788aaba9d9fccfed1d78021531d580dd9b2c

                                                                              SHA512

                                                                              ef2d17a9a86cb7e64e174841d1fac2b3a90bb50e04d8a60fa644220e72c5796579c50e1baab1f51ef5bcb14594a1af2caa940d6f6e5503614b4cd2c87689c6aa

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1

                                                                              Filesize

                                                                              264KB

                                                                              MD5

                                                                              890bbddbd0e3387c11f4e449e9a97435

                                                                              SHA1

                                                                              c27f8ae670af467cc6d329cac6cdfb8276c5f683

                                                                              SHA256

                                                                              4324280c7bf4e2dc61b0b23141151122714f56767307d32ffbdbf0d51639760f

                                                                              SHA512

                                                                              070d129409c2aa2494c61ebd38f13d534f14245085bbe7ec31427e62dbd2e79c749b4dad826d0edd7cfdea96c8222bc8cb0bd4d4ea76bc9ec4f33ec84c37b6e4

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2

                                                                              Filesize

                                                                              1.0MB

                                                                              MD5

                                                                              bf7601c66d1ec739fa324b1ce8f3cc27

                                                                              SHA1

                                                                              0c37f1eaf7b38b3503e844d818009f0a1c4e704b

                                                                              SHA256

                                                                              0c7f75886d5361cc961c479523e098014f04662f25a6a005d1a4173b9d4b3d94

                                                                              SHA512

                                                                              1e531c65045729f53bfb0a8de4dde4ddfd2b47537592c017ad5d63202a82e6aa81ea6ccb305413e505ec89e3fc14c772d84b0700fa7617cc804a251c5bb03662

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3

                                                                              Filesize

                                                                              4.0MB

                                                                              MD5

                                                                              6b434940d0d12cd4a306f89481494cdf

                                                                              SHA1

                                                                              84bb9cdffe567b8671d74bbd25f0b4c4ac38816a

                                                                              SHA256

                                                                              be3ef1eb8ece84cc5540f8514a67276adadd1575e0004e2a0b0ac02b8781b669

                                                                              SHA512

                                                                              a0463a400463bd294aa4749f5e9ab18f2f5d7eebcb4acd41315fb4f12188ba47f2f0f1e8125701f01842a1a110c5069dd0a246944c3e95e7e4d8a4d7c3cf7192

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

                                                                              Filesize

                                                                              68KB

                                                                              MD5

                                                                              fbf0911ebe4f2e508ac2ed235d00e55e

                                                                              SHA1

                                                                              bc4c28796a860bfd36c99e64b495682518f86896

                                                                              SHA256

                                                                              60a59803330f9e762c90793daf5ea396085b794d2f51ed1a730a838a4ad49767

                                                                              SHA512

                                                                              72f39b423285cec8f462995459c05a9a30e408652f72f06477ddef0f504c06d6cf8a0336cf0ac0984b9cbee85e611eb1c785d9e75dfe6b961c880bc943a8de1e

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000002

                                                                              Filesize

                                                                              51KB

                                                                              MD5

                                                                              f61f0d4d0f968d5bba39a84c76277e1a

                                                                              SHA1

                                                                              aa3693ea140eca418b4b2a30f6a68f6f43b4beb2

                                                                              SHA256

                                                                              57147f08949ababe7deef611435ae418475a693e3823769a25c2a39b6ead9ccc

                                                                              SHA512

                                                                              6c3bd90f709bcf9151c9ed9ffea55c4f6883e7fda2a4e26bf018c83fe1cfbe4f4aa0db080d6d024070d53b2257472c399c8ac44eefd38b9445640efa85d5c487

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000003

                                                                              Filesize

                                                                              33KB

                                                                              MD5

                                                                              daa6948a37ac312342600f2b96db15ea

                                                                              SHA1

                                                                              0bfa2e04bf51480baf1fc7e7819f65cd3b0c90ba

                                                                              SHA256

                                                                              de7cf820e8eb0aa51d82aff3a848fd853dfa878674cc67094aee0ac115c85fee

                                                                              SHA512

                                                                              5af3ceb0a4c56b767792ad349b83a179191d9fe6dca8e3795cb48edb87ae6a8b89e51a64ebedd68857c674befd71dc1664a2e8380ac21abacc9566329d8c2e14

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004

                                                                              Filesize

                                                                              85KB

                                                                              MD5

                                                                              533028bc88b8c919df8015a5530b2619

                                                                              SHA1

                                                                              d0525738835505ff9d73ba26e3f7d3fe67805221

                                                                              SHA256

                                                                              174bc924860e66e957fce675f42e342f3ea8c16daa14854d4a33cdaf592fbbe9

                                                                              SHA512

                                                                              3a51ad22fc22beb0e7ccb8ee000c9ab4146e81f91791c59e6134572ba51ec543382bd3f17456ee9aec3ecefecb11f3dfd41ae2660ae3b06723f135f4ccfb23bc

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

                                                                              Filesize

                                                                              38KB

                                                                              MD5

                                                                              a1cbc8600fb0e0b668df61bb5d1737f9

                                                                              SHA1

                                                                              65aaea9cf40ee7aafcf033f35980aac172b0a267

                                                                              SHA256

                                                                              b0324009cc7d496245d763710959284dbc9eb3c4aa93227cd6fa82772ff5a2bb

                                                                              SHA512

                                                                              c731cbc3fd2397fea0afdb98ad7e0a2624dfdd9da00da2032cbb425ff653291bd3e9290514d6aac2761923a055c0666b521a61524595c5ab1aa2b56ce18b2338

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                              Filesize

                                                                              264B

                                                                              MD5

                                                                              03b5e0bb5fca86f9d082f50fda9159ed

                                                                              SHA1

                                                                              2fb34116be125f272a37df77091da42df15bbeab

                                                                              SHA256

                                                                              8589b788f559f7253ee8cbe4b3edf6f55bf950fdc13c018c7b7b3a1fa7345e71

                                                                              SHA512

                                                                              6f1dd9324dd4d1f14fba61ec29e9eb620c603a3ddda96398c9a1c791e4ed5bfe4c24efa1af3b1afcdd8a38959a1307045b99c162f6a5e2db75941765f31931bd

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History

                                                                              Filesize

                                                                              160KB

                                                                              MD5

                                                                              e32563656b63702f321e022b3e184c7b

                                                                              SHA1

                                                                              9ae4a3b353b03fa8e790632b320fea327b4bb6af

                                                                              SHA256

                                                                              bfbf7f19d455624d07b6cfc72d37298e7c503becc092306a6b6fd802c1b7ecc4

                                                                              SHA512

                                                                              b937a47778df0d9c5697b7b39eee4c44f78348309c99c4f8df909cfead7334939594de3c35a66da6e73c739f2fd3932ecb09cd790e9aeeeb1af06d772ec66ae9

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              f62be53019300ecaba275e4c500079ef

                                                                              SHA1

                                                                              58b2432816404892c8320e4eab20879958b610a7

                                                                              SHA256

                                                                              e06f9e5c55404409f4d8ec635ee7a87ddcde1697883aaf83dcc623710391d526

                                                                              SHA512

                                                                              1566acc7417478677f7181dec8d33f27cdfe98639b29be9eb7dd78142159b15ebb1d11e0dbb20be84b9dbe34812d213d0c04c48b67d78920a135e32f590f06d9

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                                              Filesize

                                                                              2B

                                                                              MD5

                                                                              d751713988987e9331980363e24189ce

                                                                              SHA1

                                                                              97d170e1550eee4afc0af065b78cda302a97674c

                                                                              SHA256

                                                                              4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                              SHA512

                                                                              b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                              Filesize

                                                                              354B

                                                                              MD5

                                                                              c5796475c46aeb0df6c1d828bde900da

                                                                              SHA1

                                                                              d0af653228cf34cc2a167ed21d89a2c3ef764130

                                                                              SHA256

                                                                              8c691938e4983c81f77f7c55017c575be3ad8caf3e6ede31b24b794f87b45f17

                                                                              SHA512

                                                                              f0a2d5585372a6b83c4f3424b080b323d9a073b7bdc6e0899cae029d9a2bff56ac6eda47faf54db7254477dc1170550f3aa8001647a022f4304a468fad55464e

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\eb085220-55da-4c1b-94c8-c1e1ade11d82.tmp

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              d1c29720e93206e2770772b44ec767c7

                                                                              SHA1

                                                                              26f162592dab6df83cc6475c9109f4ff4ca32b08

                                                                              SHA256

                                                                              c47fc55d7593572f4635fe93bb21a8fe488c91763b14d1144907989cf02eb6d2

                                                                              SHA512

                                                                              6327706231a3ab6e52e1a8d6fdde7313ef49c8f792b2194fc82ac8a6668fd20d273729e866144757522943100b11c6257f06771e5ee3c53325a487ffd47002ac

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                              Filesize

                                                                              9KB

                                                                              MD5

                                                                              e761c385111a4eb475805e2b0c7d23a7

                                                                              SHA1

                                                                              c37afb680cbb52ff3f5dd43e093a68ae3e3b3202

                                                                              SHA256

                                                                              d6725254d398cd82fd62422e0b0f67ba3cd622d2cc6cf4487f72f36ca0a27f71

                                                                              SHA512

                                                                              90f9fa95d0a37269360767802bb76a114a3256818645564b9138570720010f7dd2c2f25de13a1cc6bf7173f87146fdd1b9e013985a1f8806b4b91e4dbef93b8d

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                              Filesize

                                                                              9KB

                                                                              MD5

                                                                              393a54637ee08c588f69b9945091041f

                                                                              SHA1

                                                                              9a8cfa3e0dfd20b4343fe720f41a0440dcd6a355

                                                                              SHA256

                                                                              21521556ae4eaf3c14fe571992c46561ddcefdc50817126708b7889c123ddbe5

                                                                              SHA512

                                                                              02d681b920fae1be50c4ce46f5307aef7b2b73c812d7293c463d3a4cb3fffcf98e103c0c47c986144a3fe24cb57685e5ac2c6a76937078f062bbf68baa5ae9bb

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                              Filesize

                                                                              9KB

                                                                              MD5

                                                                              585cf978644c939776361d250495f99a

                                                                              SHA1

                                                                              866e24a40433c8c42d5f95ea39344d6be0db0c8d

                                                                              SHA256

                                                                              d5d1efcfb8986be8afdf1f905b92e2c89e07289f56a6d0b463ee1b3f47bb8aed

                                                                              SHA512

                                                                              034e88ec9ce6032d2fa327991bbfb4e245bd2338606d39e786b31c8242fd2e74592f1f9de0c11a0f053818b0227ba349b66e103a4cc35632a52bee81a20f6b93

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                              Filesize

                                                                              9KB

                                                                              MD5

                                                                              8e5684cd4becf8b077fbc01aed8609c5

                                                                              SHA1

                                                                              5a3e422b58c1691583d02daf4caec227ee24ba24

                                                                              SHA256

                                                                              95a7bcfec3517002f89f664cf7f66081c618a2064eedd79270684cf4f04d096c

                                                                              SHA512

                                                                              7c7882d95f5b0f30419b54db89f6f76b1f268fe704cdab2fd415bb46716842dd951add84ae01b8b6906410be796ec05c14ca9fc3769f10818d8bc965fc19dacf

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                              Filesize

                                                                              9KB

                                                                              MD5

                                                                              7b36befc4792a87360c88cedd0d871b9

                                                                              SHA1

                                                                              a88df3211a1af413689c8ba2b8d9574561e578e3

                                                                              SHA256

                                                                              7b1374598a130919de2b3df4cb875e942f252285ca7293b0d60b8813a01f9957

                                                                              SHA512

                                                                              cee248578bf1937ca5defb69212091883372eb7d0b9a16103a085f8d0451339cf9bab811fc260f6948bc3eebfd69d22a2e1e4389a72a7fe282161a70731f1397

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                              Filesize

                                                                              9KB

                                                                              MD5

                                                                              823ec0497cd12d05033cf4f8507ed92a

                                                                              SHA1

                                                                              ce6004db284e34a570c9a5995c662add21b6abc5

                                                                              SHA256

                                                                              073bccd4f0dd1cd7f113ea6f1d37f9bcd209df052a4d4a1078bf59faa864723f

                                                                              SHA512

                                                                              fe18de93f8597db4b2fd12a8ec1e1e83188ea5e13690ae6cb76031b7db6361615bf82c00fbccef2bb23c3e54b426a7e6de30bb8748b9de9149bf423ac016d732

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                              Filesize

                                                                              9KB

                                                                              MD5

                                                                              c4ff9e831753d66edb8901dafc1f0e16

                                                                              SHA1

                                                                              a77b2a56be14c854709b62f8bed4461a86b692e6

                                                                              SHA256

                                                                              6bd27e34b37504bd9a6081ea85d23044d75a2b3dd19122e1ba078484371781de

                                                                              SHA512

                                                                              193d7b5f28479f4e6942680baef011ab77ef75da41702591812126e39ab848a0ad07fd91cedeb4e9c9797f621f8d60db232216aed2d0062a9876d6037c3807b7

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                              Filesize

                                                                              9KB

                                                                              MD5

                                                                              2decb480e9f9059736ed2ca014d2b2e9

                                                                              SHA1

                                                                              058c1a2e37b749960d27609d4a1a97d1702eee87

                                                                              SHA256

                                                                              9c3270f1ab71f26af7ded4e37b9bcb5b63df2e68932f234abb9f79983b3fe6e3

                                                                              SHA512

                                                                              04f64cc9f42b428a786370862028903ce9dad8b8a7c913d35fa77138f7ef230759e0b12e35501267cb669f0a39953ef33a1ddade761cc7ce09e045fef67b13df

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                              Filesize

                                                                              9KB

                                                                              MD5

                                                                              7d73043e496551d6924d70ecbefd8e38

                                                                              SHA1

                                                                              a4f00feefe14283e5f8520910e3d658c9a958adb

                                                                              SHA256

                                                                              ce75def9ea9da611b8636bef631500dd7122ed404fed54a7457533940d5a8cad

                                                                              SHA512

                                                                              9eceeee6804474987fd34c29f4e33952849b160674e62f2dfba3a00fef1201e134fd0565935716b2cfd091d378fe82a3ff3afc7f61829404ae57a19798951c4c

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                              Filesize

                                                                              15KB

                                                                              MD5

                                                                              f09e68aefced6cc8a5a44da1cc75a57f

                                                                              SHA1

                                                                              7b5dec49adaf217a129433bf1f26dcfe435c4951

                                                                              SHA256

                                                                              08c65a75f64268ca3f465d15b9d9a01f9989b557b6a2e9c9c49a937a476d8293

                                                                              SHA512

                                                                              ee28bd695a45914b2627d1dfe5d4448a117da71c992872e7e434bcd1cadc4c09b8f9dc73844fdd7c35f10f19f3b30329ce3d729c0ea90ce8da652147d40b743c

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                              Filesize

                                                                              189KB

                                                                              MD5

                                                                              0b02322cbcfad4c491d428c76cfdd601

                                                                              SHA1

                                                                              0a35151894f983a78403736f74c75e39351d0b86

                                                                              SHA256

                                                                              ea5d44002a5b65daeee1816019811fdbd2248099ae3052c8e49787433140f95c

                                                                              SHA512

                                                                              f747a1dd95b9be0b911fcacda5854364fd9edb6f44c9e9d52466efc0f430ef792a4f7e5e72e80368c07a559e86c95eb26b189d874304c482f52fd80e029ef2e7

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                              Filesize

                                                                              92KB

                                                                              MD5

                                                                              d0a1cce9f79200dfcedd6a0f8a53f8c1

                                                                              SHA1

                                                                              6518aa32a57a03645c6e719a04ffcdcecc66f2c4

                                                                              SHA256

                                                                              8d0b91f1d308763d8dc7365b2a337ac3380f1dccf74fb6a1688af5f85e1aced0

                                                                              SHA512

                                                                              06f76685d80e0784b3dfa880cb21630533bfb002da2b0cb5ae2bc3a4bde90407fd6fb7a785a71452f15df0ebc89bc347c6fa2f9e48f7e0949e48d52d6b5b35e6

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                              Filesize

                                                                              152B

                                                                              MD5

                                                                              a499254d6b5d91f97eb7a86e5f8ca573

                                                                              SHA1

                                                                              03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1

                                                                              SHA256

                                                                              fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499

                                                                              SHA512

                                                                              d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                              Filesize

                                                                              152B

                                                                              MD5

                                                                              bafce9e4c53a0cb85310891b6b21791b

                                                                              SHA1

                                                                              5d70027cc137a7cbb38f5801b15fd97b05e89ee2

                                                                              SHA256

                                                                              71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00

                                                                              SHA512

                                                                              c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                              Filesize

                                                                              216B

                                                                              MD5

                                                                              5d0154685d0c758a7677b09d254deccd

                                                                              SHA1

                                                                              5bf5208421f07c8af0239c0b80396d76c47eeb87

                                                                              SHA256

                                                                              23a31b816461645fa62261fe8f9793b34646d3e2b7dee8bbea7af8a5eb0f2805

                                                                              SHA512

                                                                              49f727333e0028d26fcfe0340795ebe279cbf6f03379080b6b9b81b334f18685f10e7e600d29e9a9d2d51a2285eaacc41a9e643fea8bc79c89fdf1a192e4acb8

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

                                                                              Filesize

                                                                              124KB

                                                                              MD5

                                                                              96e880a59ee40ca5cb89e24111c26a0e

                                                                              SHA1

                                                                              e96a22d47f3a1ef8f84391e1b75068bbe8fab816

                                                                              SHA256

                                                                              7e5b4e35f12bdba1f59b35dfc14aff42fbe3474a3e10d5c1a64f61d9962a6016

                                                                              SHA512

                                                                              55bbcaea4dfac56d6efda917988ca60618d5f69ddd60da75f3ed9ed308b64d1ace2df40ea346d22e1be8e081351d2382a2ea892e5fcfadb701a980b82952899e

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              6f9843c988c2f416dda63db03a07b632

                                                                              SHA1

                                                                              ea284b49cbaa5b9c4136c8ce868f38335f81712c

                                                                              SHA256

                                                                              17a761118aa2b2c81757298ff84cfc9141ac524527d3509ed82964a803e52e38

                                                                              SHA512

                                                                              4ffd361d7d0198a384d4d0bca480a349562bead7fd3a6b94d235e59c9743f3c4512941c3b8476c7b89e2b171b9d7f4a3fceb32bf8c7a5f850c4c779cf9465038

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                              Filesize

                                                                              6KB

                                                                              MD5

                                                                              cffd6c814ec00f928c7fbfc1715bbe39

                                                                              SHA1

                                                                              7b585f06c47cad62bc1bcbfe7c37aec4f6aadd81

                                                                              SHA256

                                                                              7578f250507c37726a0757794d2b8987b3e3e7558a43df057beee47d75d0c2d1

                                                                              SHA512

                                                                              4993e2d98326819ebd0ab1c76f3c8266b12c6c4a0f92370d4b15a3fbeaf192296d60cf77c0c835035f617c7fd9321da4250b4ce566e594df328c2619a333c3c3

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                              Filesize

                                                                              6KB

                                                                              MD5

                                                                              21ab26c498c9789b699254352f5b54eb

                                                                              SHA1

                                                                              5f7e5f8b0636833aff79e4287334cfd064841f9c

                                                                              SHA256

                                                                              881c0646204ecd1a2b2b810e9032e9a298b57d1be6ff07d298b1c45f56632080

                                                                              SHA512

                                                                              3bd8e2bb6335cd512069418c22b02893c8e9d7f7fa82e9635667543bde9bf2c3a37fc7ffd0bceb4f01c07c49c749196c04b08d491709f0b94aa203488ab89e29

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                              Filesize

                                                                              5KB

                                                                              MD5

                                                                              d4e5efe236e2cc4c224b2e6e5f787c03

                                                                              SHA1

                                                                              17c92686ff208d8b15a184f6f323a89e705b00c3

                                                                              SHA256

                                                                              82e10bd2d5ce85b00ce1cbfdf5379f074d4cadf2d770e0dbfe7e672c6525bca5

                                                                              SHA512

                                                                              fcc282ca367308414e5ed6ae70e9f653134f5754c9cd5e87962787a3c6632f527d2454f8b7a00c6f38b99e13965e6544394079bc7c05157042156d964629121a

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                              Filesize

                                                                              372B

                                                                              MD5

                                                                              710907b5dd0bc9598cd495b5a219a0b9

                                                                              SHA1

                                                                              ef54558370dd9029d6c962494dbc080324cc70d9

                                                                              SHA256

                                                                              7739458315c61960e57d2a0d543257a28a64aec55a9cbae1c160955c674f723c

                                                                              SHA512

                                                                              0aa27805f8c4b5e664df08c99fe212bb9918babb0b87cfa4f521bab15dfa5d52e2354657cf97bbe356008392ab58bb23baf772bf97059758ed422d69115dc79c

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587edf.TMP

                                                                              Filesize

                                                                              204B

                                                                              MD5

                                                                              1b3f1ffa302c8b323d80fc3fa73a15a2

                                                                              SHA1

                                                                              e223fc9c6ec835536e735d87a516145e110ebd7f

                                                                              SHA256

                                                                              729e088d5677f3de95d9e95f214c7452de653c428b75c760950efc5e6f8472f3

                                                                              SHA512

                                                                              8f748c6668d528b881dbef7c9254dc2643e3c0519817d3db9d7cba81f1bff10ad854f1032aaac118c1915c8392af775bf9576bc1b594cad94f94721ae44bc7f5

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                              Filesize

                                                                              10KB

                                                                              MD5

                                                                              38619085217c45cf70aec710a06e5f7f

                                                                              SHA1

                                                                              ec208d4f36e88efbbbf2adbbe5768dc5d788578d

                                                                              SHA256

                                                                              fa9ae59fcd4366b826118ec39c2caf864bddc13420f40b04f9dd492ec05cc116

                                                                              SHA512

                                                                              bdbd9d9bffa5a36f146abecbc3bbbd91a53f63a4208e23e3533aa66ab8f561e12c32f943b0eeb6faf8bb029d7722598a9b1383cd31d1c90713517adc5225e62b

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                              Filesize

                                                                              10KB

                                                                              MD5

                                                                              9e509cb64f41dbf76a192096d80d7fa0

                                                                              SHA1

                                                                              3eee85c13c666cf2fdf4d46b3b6939e4863a3032

                                                                              SHA256

                                                                              0ef5344742b96b814fd8d7a6a8d8a0bac4037e29a16818977b5191091cc36dd8

                                                                              SHA512

                                                                              24e5de31ed75a4131b5d274550a50faf1fad8f66112a2b58c44c6970944921b76aa9852c26867bc7687105f6b508023906819f89cc5e5d1041dcd5c74cd0125a

                                                                            • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

                                                                              Filesize

                                                                              1.8MB

                                                                              MD5

                                                                              e588bd7ef23ba44220fcde6c23088bec

                                                                              SHA1

                                                                              83c8e778f099520e7cd2a03efb610f4d33bf3f1e

                                                                              SHA256

                                                                              c03f161f2c5d8492263cd0a59e3cd3cd5582a8e4fbfcf8bef793ac0c1b1e07cf

                                                                              SHA512

                                                                              f6004fb6cf5c3915e094aa16765ede1f50babb7a75d47ea79e1ca90dac29ca02754d99a712c948dd2ec1ad64e64c7f3318c22212bd95fac9a6fab5c39362de06

                                                                            • C:\Users\Admin\AppData\Local\Temp\1000020001\63ef288fd3.exe

                                                                              Filesize

                                                                              89KB

                                                                              MD5

                                                                              fb384b3a9547a5a88d4c79fbbbbd9e77

                                                                              SHA1

                                                                              079c97bb8c11a273af4be603c9f62eb62f2e1197

                                                                              SHA256

                                                                              0cdaf032535980f3c5cc7eebb661608ad5713677b2d54eaac584892916598e73

                                                                              SHA512

                                                                              8f28a21a4ebcc9745941647e7900c884077e4abb7066b861c187ece6e5270ac5d42d77d8275aca9a6bbf95bcfa3cad8da8a831cd73fd6f3a28b8affee8fb1261

                                                                            • C:\Users\Admin\AppData\Local\Temp\1000030001\74980e5032.exe

                                                                              Filesize

                                                                              1.8MB

                                                                              MD5

                                                                              e6d4fd57bdfa0329696464bddc309084

                                                                              SHA1

                                                                              5ceff1d78f31ab36fb919d4caeca3e0d0aa275f7

                                                                              SHA256

                                                                              18f51fc7520d98dbfa8a51275600c2d9e3665f56a0aeb4d2c9c381a021f65dfc

                                                                              SHA512

                                                                              2817c9c5075015d53130399be4e86458f3c1536732c67cb5d173ab16891482d89b63abf56554b8a0f42a1fd72a2a417795b994611da1647fe33c3fbf95e1e622

                                                                            • C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe

                                                                              Filesize

                                                                              187KB

                                                                              MD5

                                                                              dc4df67829d076c9c33c0d728a9a6ddb

                                                                              SHA1

                                                                              8362b7c722fcd493a473c0ad12c38c381f0c3e90

                                                                              SHA256

                                                                              b11d77860541c64edc90ba2b3841ce41913aada626bc56d6c10a9214f3040da8

                                                                              SHA512

                                                                              03da0637bf30b8d01591629b501b339b77e57b920e0cfd406222b0b28d81399e950da58f0088b7b7cf80cda49084b611056812618a586328232f9697f56e2ea2

                                                                            • C:\Users\Admin\AppData\Local\Temp\1000047001\postbox.exe

                                                                              Filesize

                                                                              22.0MB

                                                                              MD5

                                                                              c53bb047b93851b66fead144d7c46ff3

                                                                              SHA1

                                                                              42ef9d0a7efe477fabd290d16c30c63f5f576cd1

                                                                              SHA256

                                                                              54092d2fb30f9258ab9817de3b886997dbefdee2963b4d051b70c0309aea99e6

                                                                              SHA512

                                                                              7060e10d60d0699c7c06012a3e2be44f859ec06ec00bbd51331b5ac5169e88d14baf7949d2cd40bcebe42016f8a7d5a28a11c755a54675f5715dbee34cfc11a6

                                                                            • C:\Users\Admin\AppData\Local\Temp\E7A1.tmp\E7A2.tmp\E7B2.bat

                                                                              Filesize

                                                                              2KB

                                                                              MD5

                                                                              de9423d9c334ba3dba7dc874aa7dbc28

                                                                              SHA1

                                                                              bf38b137b8d780b3d6d62aee03c9d3f73770d638

                                                                              SHA256

                                                                              a1e1b422c40fb611a50d3f8bf34f9819f76ddb304aa2d105fb49f41f57752698

                                                                              SHA512

                                                                              63f13acd904378ad7de22053e1087d61a70341f1891ada3b671223fec8f841b42b6f1060a4b18c8bb865ee4cd071cadc7ff6bd6d549760945bf1645a1086f401

                                                                            • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                                              Filesize

                                                                              479KB

                                                                              MD5

                                                                              09372174e83dbbf696ee732fd2e875bb

                                                                              SHA1

                                                                              ba360186ba650a769f9303f48b7200fb5eaccee1

                                                                              SHA256

                                                                              c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                                              SHA512

                                                                              b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                                            • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                                              Filesize

                                                                              13.8MB

                                                                              MD5

                                                                              0a8747a2ac9ac08ae9508f36c6d75692

                                                                              SHA1

                                                                              b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                                              SHA256

                                                                              32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                                              SHA512

                                                                              59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\AlternateServices.bin

                                                                              Filesize

                                                                              8KB

                                                                              MD5

                                                                              9d0017f0e7cb8eacb67c4a2a96f3b90d

                                                                              SHA1

                                                                              e0ad711b34ae9b01fc064965737a0631b31e0104

                                                                              SHA256

                                                                              98c62b401554661d03ab1f5e3ab21de4aaa1eaba9219783b24a258a7a7b3865e

                                                                              SHA512

                                                                              0162c627f5a73495e9f8487d047127ca74d82eed3efd6488bcaa0f8d37d031d5a444a1e6fe09c414d87026b0ee8e3506586518a0cfab43235590d8664cb136a3

                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                                                                              Filesize

                                                                              1.1MB

                                                                              MD5

                                                                              842039753bf41fa5e11b3a1383061a87

                                                                              SHA1

                                                                              3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                                              SHA256

                                                                              d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                                              SHA512

                                                                              d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                                                                              Filesize

                                                                              116B

                                                                              MD5

                                                                              2a461e9eb87fd1955cea740a3444ee7a

                                                                              SHA1

                                                                              b10755914c713f5a4677494dbe8a686ed458c3c5

                                                                              SHA256

                                                                              4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                                              SHA512

                                                                              34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                                                                              Filesize

                                                                              372B

                                                                              MD5

                                                                              bf957ad58b55f64219ab3f793e374316

                                                                              SHA1

                                                                              a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                                              SHA256

                                                                              bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                                              SHA512

                                                                              79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                                                                              Filesize

                                                                              17.8MB

                                                                              MD5

                                                                              daf7ef3acccab478aaa7d6dc1c60f865

                                                                              SHA1

                                                                              f8246162b97ce4a945feced27b6ea114366ff2ad

                                                                              SHA256

                                                                              bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                                              SHA512

                                                                              5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\prefs-1.js

                                                                              Filesize

                                                                              9KB

                                                                              MD5

                                                                              6e21420eeb5a32cac17a9a2170118bd8

                                                                              SHA1

                                                                              403c50437414ec3c9b1e2c8c017e5cedb8534095

                                                                              SHA256

                                                                              69e010206145aec89290532b191238d2ed7b631063b2e0f05dbda7b34a8cca48

                                                                              SHA512

                                                                              41191e9c1a4c096f07d5cd7cd8e3560d9d969669838db857045bef4e2b43f4d765b2079b0ab3a56877ee93d2e5433df72470389f4886b23dc1c7af65ba1edb94

                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\prefs.js

                                                                              Filesize

                                                                              8KB

                                                                              MD5

                                                                              45fd0a4e7543bbe333bce2060a2a3be8

                                                                              SHA1

                                                                              1ebd055ce3ac24fb33093aa6e3449b983da5d396

                                                                              SHA256

                                                                              1c0eb531db8fbece255fe3d623eea9e377655dd0503b6675ebbb36750faaec81

                                                                              SHA512

                                                                              6183eedc18a0331457517ecd23970221ee4862ee50930ff9745d07d073a1beacf23a67a4cc3b9d594f5ea03adf859565593d1fab8e0f534bbca5c986b0ea1690

                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3mrom4gn.default-release\prefs.js

                                                                              Filesize

                                                                              9KB

                                                                              MD5

                                                                              d76340f9c8b43e0e335195565f6e3537

                                                                              SHA1

                                                                              a7825995ed45ec865d362f23bd86f408b2b39af2

                                                                              SHA256

                                                                              2d243e17dd93e5d8be05ba19f602adb61da44e01122c2eda81c0fd2ffa5fbadb

                                                                              SHA512

                                                                              f2b82e6a526e342fc2904ffc21612c70a7e26bf4e83d27ed7afd57de2633fd1c1e431e9f8df7c5cab05c777f6b8dfd5bbcb0700b93c6dc71f8ab99297cdeae2f

                                                                            • memory/1428-193-0x00000000004A0000-0x000000000094A000-memory.dmp

                                                                              Filesize

                                                                              4.7MB

                                                                            • memory/1428-506-0x00000000004A0000-0x000000000094A000-memory.dmp

                                                                              Filesize

                                                                              4.7MB

                                                                            • memory/1428-548-0x00000000004A0000-0x000000000094A000-memory.dmp

                                                                              Filesize

                                                                              4.7MB

                                                                            • memory/1428-645-0x00000000004A0000-0x000000000094A000-memory.dmp

                                                                              Filesize

                                                                              4.7MB

                                                                            • memory/1428-631-0x00000000004A0000-0x000000000094A000-memory.dmp

                                                                              Filesize

                                                                              4.7MB

                                                                            • memory/1428-244-0x00000000004A0000-0x000000000094A000-memory.dmp

                                                                              Filesize

                                                                              4.7MB

                                                                            • memory/1428-547-0x00000000004A0000-0x000000000094A000-memory.dmp

                                                                              Filesize

                                                                              4.7MB

                                                                            • memory/1428-391-0x00000000004A0000-0x000000000094A000-memory.dmp

                                                                              Filesize

                                                                              4.7MB

                                                                            • memory/1428-573-0x00000000004A0000-0x000000000094A000-memory.dmp

                                                                              Filesize

                                                                              4.7MB

                                                                            • memory/1428-496-0x00000000004A0000-0x000000000094A000-memory.dmp

                                                                              Filesize

                                                                              4.7MB

                                                                            • memory/1428-609-0x00000000004A0000-0x000000000094A000-memory.dmp

                                                                              Filesize

                                                                              4.7MB

                                                                            • memory/1428-586-0x00000000004A0000-0x000000000094A000-memory.dmp

                                                                              Filesize

                                                                              4.7MB

                                                                            • memory/1428-592-0x00000000004A0000-0x000000000094A000-memory.dmp

                                                                              Filesize

                                                                              4.7MB

                                                                            • memory/2332-0-0x0000000000D40000-0x0000000001201000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/2332-4-0x0000000000D40000-0x0000000001201000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/2332-16-0x0000000000D40000-0x0000000001201000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/2332-3-0x0000000000D40000-0x0000000001201000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/2332-2-0x0000000000D41000-0x0000000000D6F000-memory.dmp

                                                                              Filesize

                                                                              184KB

                                                                            • memory/2332-1-0x00000000779B4000-0x00000000779B6000-memory.dmp

                                                                              Filesize

                                                                              8KB

                                                                            • memory/2420-605-0x0000000000690000-0x00000000006E7000-memory.dmp

                                                                              Filesize

                                                                              348KB

                                                                            • memory/2420-607-0x0000000000690000-0x00000000006E7000-memory.dmp

                                                                              Filesize

                                                                              348KB

                                                                            • memory/2748-613-0x0000000000710000-0x0000000000BD1000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/2748-615-0x0000000000710000-0x0000000000BD1000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/2936-501-0x00000000004A0000-0x000000000094A000-memory.dmp

                                                                              Filesize

                                                                              4.7MB

                                                                            • memory/2936-576-0x00000000004A0000-0x000000000094A000-memory.dmp

                                                                              Filesize

                                                                              4.7MB

                                                                            • memory/3480-19-0x0000000000710000-0x0000000000BD1000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/3480-589-0x0000000000710000-0x0000000000BD1000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/3480-655-0x0000000000710000-0x0000000000BD1000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/3480-21-0x0000000000710000-0x0000000000BD1000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/3480-528-0x0000000000710000-0x0000000000BD1000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/3480-20-0x0000000000710000-0x0000000000BD1000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/3480-505-0x0000000000710000-0x0000000000BD1000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/3480-354-0x0000000000710000-0x0000000000BD1000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/3480-644-0x0000000000710000-0x0000000000BD1000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/3480-18-0x0000000000711000-0x000000000073F000-memory.dmp

                                                                              Filesize

                                                                              184KB

                                                                            • memory/3480-567-0x0000000000710000-0x0000000000BD1000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/3480-17-0x0000000000710000-0x0000000000BD1000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/3480-502-0x0000000000710000-0x0000000000BD1000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/3480-243-0x0000000000710000-0x0000000000BD1000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/3480-575-0x0000000000710000-0x0000000000BD1000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/3480-621-0x0000000000710000-0x0000000000BD1000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/3480-435-0x0000000000710000-0x0000000000BD1000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/3480-436-0x0000000000710000-0x0000000000BD1000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/3480-608-0x0000000000710000-0x0000000000BD1000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/3480-81-0x0000000000710000-0x0000000000BD1000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/3480-161-0x0000000000710000-0x0000000000BD1000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/4788-497-0x0000000000400000-0x00000000031D3000-memory.dmp

                                                                              Filesize

                                                                              45.8MB

                                                                            • memory/4788-434-0x0000000000400000-0x00000000031D3000-memory.dmp

                                                                              Filesize

                                                                              45.8MB

                                                                            • memory/4788-519-0x0000000000400000-0x00000000031D3000-memory.dmp

                                                                              Filesize

                                                                              45.8MB

                                                                            • memory/4788-360-0x0000000000400000-0x00000000031D3000-memory.dmp

                                                                              Filesize

                                                                              45.8MB

                                                                            • memory/4788-136-0x0000000000400000-0x00000000031D3000-memory.dmp

                                                                              Filesize

                                                                              45.8MB

                                                                            • memory/4788-214-0x0000000000400000-0x00000000031D3000-memory.dmp

                                                                              Filesize

                                                                              45.8MB

                                                                            • memory/5460-230-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                              Filesize

                                                                              972KB

                                                                            • memory/5460-499-0x0000000000E40000-0x0000000001083000-memory.dmp

                                                                              Filesize

                                                                              2.3MB

                                                                            • memory/5460-215-0x0000000000E40000-0x0000000001083000-memory.dmp

                                                                              Filesize

                                                                              2.3MB

                                                                            • memory/6008-172-0x0000000000430000-0x00000000008DA000-memory.dmp

                                                                              Filesize

                                                                              4.7MB

                                                                            • memory/6008-194-0x0000000000430000-0x00000000008DA000-memory.dmp

                                                                              Filesize

                                                                              4.7MB

                                                                            • memory/6448-611-0x00000000004A0000-0x000000000094A000-memory.dmp

                                                                              Filesize

                                                                              4.7MB

                                                                            • memory/6448-614-0x00000000004A0000-0x000000000094A000-memory.dmp

                                                                              Filesize

                                                                              4.7MB

                                                                            • memory/6552-587-0x00007FF671520000-0x00007FF672B98000-memory.dmp

                                                                              Filesize

                                                                              22.5MB

                                                                            • memory/6552-593-0x00007FF671520000-0x00007FF672B98000-memory.dmp

                                                                              Filesize

                                                                              22.5MB

                                                                            • memory/6552-606-0x00007FF671520000-0x00007FF672B98000-memory.dmp

                                                                              Filesize

                                                                              22.5MB

                                                                            • memory/6552-574-0x00007FF671520000-0x00007FF672B98000-memory.dmp

                                                                              Filesize

                                                                              22.5MB

                                                                            • memory/7028-503-0x0000000000710000-0x0000000000BD1000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/7028-504-0x0000000000710000-0x0000000000BD1000-memory.dmp

                                                                              Filesize

                                                                              4.8MB