Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2024, 21:29

General

  • Target

    https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbkFCMVhENUhhT3hJRksxT09hQVJtdWNJbGlrd3xBQ3Jtc0trbmxaRHM0akpmTjBWZ1J4QWNnUElmSDNKYnAtUENDSGVIaG95LTdBdlFxSXJiTExOSEM2Q2dvNnRUX3FObk5aZ2JLdW1aM3NYWE1vRWt1TDRtd0NkVFBZUGRTLXk5ZURIT1J6YkxVTTE0dFBJYldCNA&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2Fv6itahr4p07b1%2FFiles&v=OWFZQv-BxyU

Malware Config

Extracted

Family

vidar

C2

https://t.me/edm0d

https://steamcommunity.com/profiles/

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0

Signatures

  • Detect Vidar Stealer 17 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbkFCMVhENUhhT3hJRksxT09hQVJtdWNJbGlrd3xBQ3Jtc0trbmxaRHM0akpmTjBWZ1J4QWNnUElmSDNKYnAtUENDSGVIaG95LTdBdlFxSXJiTExOSEM2Q2dvNnRUX3FObk5aZ2JLdW1aM3NYWE1vRWt1TDRtd0NkVFBZUGRTLXk5ZURIT1J6YkxVTTE0dFBJYldCNA&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2Fv6itahr4p07b1%2FFiles&v=OWFZQv-BxyU
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2508
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa4b2446f8,0x7ffa4b244708,0x7ffa4b244718
      2⤵
        PID:4964
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,10257381102874678755,8048842998044151435,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:2
        2⤵
          PID:3840
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,10257381102874678755,8048842998044151435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2276
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1980,10257381102874678755,8048842998044151435,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
          2⤵
            PID:4652
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,10257381102874678755,8048842998044151435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
            2⤵
              PID:1744
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,10257381102874678755,8048842998044151435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
              2⤵
                PID:2264
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,10257381102874678755,8048842998044151435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
                2⤵
                  PID:3932
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,10257381102874678755,8048842998044151435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2964
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,10257381102874678755,8048842998044151435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
                  2⤵
                    PID:3644
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,10257381102874678755,8048842998044151435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
                    2⤵
                      PID:2376
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,10257381102874678755,8048842998044151435,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
                      2⤵
                        PID:3424
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,10257381102874678755,8048842998044151435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
                        2⤵
                          PID:1492
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,10257381102874678755,8048842998044151435,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
                          2⤵
                            PID:1944
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,10257381102874678755,8048842998044151435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
                            2⤵
                              PID:3160
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,10257381102874678755,8048842998044151435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
                              2⤵
                                PID:3528
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,10257381102874678755,8048842998044151435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6304 /prefetch:1
                                2⤵
                                  PID:1860
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,10257381102874678755,8048842998044151435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6440 /prefetch:1
                                  2⤵
                                    PID:4336
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,10257381102874678755,8048842998044151435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6732 /prefetch:1
                                    2⤵
                                      PID:2372
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,10257381102874678755,8048842998044151435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6996 /prefetch:1
                                      2⤵
                                        PID:1540
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,10257381102874678755,8048842998044151435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7116 /prefetch:1
                                        2⤵
                                          PID:2144
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,10257381102874678755,8048842998044151435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
                                          2⤵
                                            PID:4404
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,10257381102874678755,8048842998044151435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6616 /prefetch:1
                                            2⤵
                                              PID:3676
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1980,10257381102874678755,8048842998044151435,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7220 /prefetch:8
                                              2⤵
                                                PID:2536
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,10257381102874678755,8048842998044151435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7428 /prefetch:1
                                                2⤵
                                                  PID:3424
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,10257381102874678755,8048842998044151435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7832 /prefetch:1
                                                  2⤵
                                                    PID:6044
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1980,10257381102874678755,8048842998044151435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7604 /prefetch:8
                                                    2⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:5188
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,10257381102874678755,8048842998044151435,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2708 /prefetch:2
                                                    2⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:2192
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:3148
                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                    1⤵
                                                      PID:1028
                                                    • C:\Windows\System32\rundll32.exe
                                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                      1⤵
                                                        PID:5416
                                                      • C:\Program Files\7-Zip\7zG.exe
                                                        "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\S0FTWARE\" -ad -an -ai#7zMap17317:78:7zEvent2954
                                                        1⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:5576
                                                      • C:\Users\Admin\Downloads\S0FTWARE\S0FTWARE.exe
                                                        "C:\Users\Admin\Downloads\S0FTWARE\S0FTWARE.exe"
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:3676
                                                        • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                                                          "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
                                                          2⤵
                                                          • Loads dropped DLL
                                                          • System Location Discovery: System Language Discovery
                                                          • Checks processor information in registry
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:5864
                                                          • C:\ProgramData\BKKJKFBKKE.exe
                                                            "C:\ProgramData\BKKJKFBKKE.exe"
                                                            3⤵
                                                            • Executes dropped EXE
                                                            PID:4384

                                                      Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • C:\ProgramData\BKKJKFBKKE.exe

                                                        Filesize

                                                        5.2MB

                                                        MD5

                                                        1e5ab6d00e6b8d80c8789e2401467ce7

                                                        SHA1

                                                        74ea63cc923edb83d206a07bf482595f55ea9010

                                                        SHA256

                                                        4863b0973b798bdbc0e89cdbe4efb5462933f2d457148f43c82a12af89651147

                                                        SHA512

                                                        39aa35408498e4751c3d16364b6863ffc347df45252850a11d486dd7e36b0e4062276833762eaf2c15ed3229c67118d5e420cb1d5fc79f80aaa5e1137a31e701

                                                      • C:\ProgramData\mozglue.dll

                                                        Filesize

                                                        593KB

                                                        MD5

                                                        c8fd9be83bc728cc04beffafc2907fe9

                                                        SHA1

                                                        95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                        SHA256

                                                        ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                        SHA512

                                                        fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                      • C:\ProgramData\nss3.dll

                                                        Filesize

                                                        2.0MB

                                                        MD5

                                                        1cc453cdf74f31e4d913ff9c10acdde2

                                                        SHA1

                                                        6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                        SHA256

                                                        ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                        SHA512

                                                        dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                        Filesize

                                                        152B

                                                        MD5

                                                        ecf7ca53c80b5245e35839009d12f866

                                                        SHA1

                                                        a7af77cf31d410708ebd35a232a80bddfb0615bb

                                                        SHA256

                                                        882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

                                                        SHA512

                                                        706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                        Filesize

                                                        152B

                                                        MD5

                                                        4dd2754d1bea40445984d65abee82b21

                                                        SHA1

                                                        4b6a5658bae9a784a370a115fbb4a12e92bd3390

                                                        SHA256

                                                        183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

                                                        SHA512

                                                        92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003e

                                                        Filesize

                                                        20KB

                                                        MD5

                                                        87e8230a9ca3f0c5ccfa56f70276e2f2

                                                        SHA1

                                                        eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

                                                        SHA256

                                                        e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

                                                        SHA512

                                                        37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000047

                                                        Filesize

                                                        212KB

                                                        MD5

                                                        08ec57068db9971e917b9046f90d0e49

                                                        SHA1

                                                        28b80d73a861f88735d89e301fa98f2ae502e94b

                                                        SHA256

                                                        7a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1

                                                        SHA512

                                                        b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                        Filesize

                                                        3KB

                                                        MD5

                                                        e6da29f78cf71576f6057d6487ffa74f

                                                        SHA1

                                                        fd2f3aa8438380616c11b6d03f87483c6d2388da

                                                        SHA256

                                                        c8c4fc066391a3544ea14300316b99c37c4c38f4ca9520456b19167a9c24526e

                                                        SHA512

                                                        6cf77023b158bd161f65b2cb466a2f96767baffe3a9a18886618b8481c79dcaf44ed6b1449e9147d41ad8c778c1e32a7b38425203b9caabb639be9c6579360da

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                        Filesize

                                                        432B

                                                        MD5

                                                        94e75c7b5c1f98a8c76c820b7244c19a

                                                        SHA1

                                                        050df644f5c891858a364429f2123310354a01fa

                                                        SHA256

                                                        a01d8844577b103f1ca465638688428a903a967da427b79e9dae1cc014710d00

                                                        SHA512

                                                        e58fa5486d8328b2cc0d7f1a98220a610402692c7e3d242fb1e778a684a13a3502b067be136939d16f07e704038a5efc1118d8e328050a3e7aa953394fa32dc8

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                        Filesize

                                                        432B

                                                        MD5

                                                        b138d39246ccc026d2e0b5d2b176d719

                                                        SHA1

                                                        3e47f4c6e8bc6077b2cefbd4796dcbde262c4d13

                                                        SHA256

                                                        b7a841df95ba7df4c9b2682b8cbdd46eedb0e32e45a2d6d1d2053516579c4ed0

                                                        SHA512

                                                        108bdd65d662568e5275aa345dba0b3014c2e7f5920a498b0eefd838879fda967f638cdd6598bab8aa95bd47a19045c3c4cec21590a44ec38bbcbd5919c35eaf

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                        Filesize

                                                        3KB

                                                        MD5

                                                        0365e3697149756c29cbb3541563b125

                                                        SHA1

                                                        85faf6921cacc32bf144c2bbbeecf6cbf29b8911

                                                        SHA256

                                                        7a78580229c7c0464e2539dfe3b003381386a7b63d0cf103224699d0c1f1df8c

                                                        SHA512

                                                        9a7bb907a4040dfb9a4f2fc8f1b6983682a332fb118011bb55562dc428b8e073dde2f3d94f364ffe19ad5cc96ae6f5cc2f7e2046f2d4aec7abdd69589a45b53a

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

                                                        Filesize

                                                        44KB

                                                        MD5

                                                        ddf62a9a45805b9baa50024f4a4fb152

                                                        SHA1

                                                        ec584b60ad581b2e33edf25e59a2bb8b453ffbb8

                                                        SHA256

                                                        33b7cb1787c795f8434c7e452a20eb1e4b3f9646ab5801d4b464cd959568cbe3

                                                        SHA512

                                                        23ef5a7861f49ddb16c0b2d376f681349657ae0bcc908b9d1ad8c748aea7f43f23fc2044fae5ac52fbf2fe394d87d7ac2cff463f727f46caa5dd734745cb35fd

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

                                                        Filesize

                                                        128KB

                                                        MD5

                                                        a852ab806226126f64e38c7e784b0bb2

                                                        SHA1

                                                        ea900eea8c0d6c63d1cc60d190709ce01e9ac031

                                                        SHA256

                                                        5f093b21ba16906ebe45a733a9b35842695e4b311101bb95bf033550ae27129d

                                                        SHA512

                                                        c155df8223e7dc8dce63b85b0f8bb3d2fc6c8482c2fccfeedbfe77d255ef84e12b47da70f921cd374e85db5d8aa3d2c666cb1ad8ed110c3720a5a7b415e714b8

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                        Filesize

                                                        3KB

                                                        MD5

                                                        3619904b3984ca52b862869606f63378

                                                        SHA1

                                                        96e2a8ca3f6f6750eec4523d38bb0031bf94496b

                                                        SHA256

                                                        111ec178036c3825d604b56d8c97fee36e765a618edc96c4a069d9a8e7eb0ba6

                                                        SHA512

                                                        2354964e8182c951a7a13ac3e4ce1e1349af640702909cc38642577e6421320f2896067a881b073a719332bf089fec4fcac850e8b9172a190592b852dcb7ff0b

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                        Filesize

                                                        12KB

                                                        MD5

                                                        86c031126bd5a1049661227ed04d4666

                                                        SHA1

                                                        4498baddbf8c50fd6dc904cb9b31b075e32446f2

                                                        SHA256

                                                        e28e7d5116e4111addb95b3b9e7f335564ba82723fddee27f6071f38bd923c1a

                                                        SHA512

                                                        a65e9a3b366676bc3ccfaf8f325a9531daf7aca604d07501c5fff1532460dcef212bb48c9c1295affa7dca4b10ead570df2b1d06a43c3b3bf8567284bd1fa997

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                        Filesize

                                                        13KB

                                                        MD5

                                                        ce858c411027b3ff5bb6b343585be889

                                                        SHA1

                                                        160c4f326d4d215c79a92631cd89717af6c0edfa

                                                        SHA256

                                                        f9005a70809553a2e0c09d4fd5312177588e80737d5ec78327ed4f9de541ea0d

                                                        SHA512

                                                        846e06b3d98aa20cd76aa80815d0cadd471ca35a91cd34cb9ecbcd9f061cd23e4ce336107389ad3dc216dff8d6d93d9ec22ff5c53ad5278a4e8de474428bb27f

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                        Filesize

                                                        8KB

                                                        MD5

                                                        d5791887a4e24953c808c20104703569

                                                        SHA1

                                                        171cb020c0831e402d25b63d8793c8f7b9a0e035

                                                        SHA256

                                                        7852bd85ee0a7dc275cd1e8dbb454a6a9d41bbe0d7d47dc27d6f487a1f0f7342

                                                        SHA512

                                                        2413ee5abfc831ffac3de9c3c1307880392a2b2dc9a57e53ee53de23d048191b0db600719aba11961109194eb5bf2178be45a5ca69b170f395bd5a8ccd0601f1

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                        Filesize

                                                        5KB

                                                        MD5

                                                        336a87f386d26fab2378d6f9e66bc338

                                                        SHA1

                                                        9ea1b42ee9bff0fce953d162cfe4a04208ed1edf

                                                        SHA256

                                                        89a4b8685d96dc4ea4f8eb8f803ac84bf1ed154b4b409db3f4ecb3be7d3deffb

                                                        SHA512

                                                        06025652919efd9af1430c404c569e2b1f43cec0b81c7b4c0224e77050c69a797a28de16281f230170a90fd4b8b4f9d8721ce44a86a9415fa787658a4e1e8a0c

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                        Filesize

                                                        12KB

                                                        MD5

                                                        34b90c66ae04e1b77d2c5923f78eda27

                                                        SHA1

                                                        08edd7d943ce1a3732e3008c33a885b740ae94ec

                                                        SHA256

                                                        72b7b41e24ddb732c83971cbc09f675a17f92985713b4ba7cd5170a6f1e1a89c

                                                        SHA512

                                                        d366ce858a6a9537c5f8c98423db125a9533691bdf8e65b36d6aedfa8863455d8b2cb327f7a02e66c175cd28ef5edb5845789106851f40d72a4b6a55f79b3106

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                        Filesize

                                                        14KB

                                                        MD5

                                                        e8962d28e577fc975ba2b7b9a2483d8c

                                                        SHA1

                                                        b222cf0d3641754040f504784d8e38f1086a725c

                                                        SHA256

                                                        a3ecc2f3a9fe3060794fd8a6e6c0dc61f5bd566c5f3b15737fb63a81eb4fed30

                                                        SHA512

                                                        cea97ed37a559573acd1e7745d6405eaf441a4f3c0e0500ec51fa689fff09c305d624a3e2b7f61be69c7eb8ce93843477b65572793a0c156c3c724e848da9905

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                        Filesize

                                                        14KB

                                                        MD5

                                                        c19f7f9559dfd73bc377b11f38419be0

                                                        SHA1

                                                        1ecab2830cc0ea28f7244a9c9fdae015ffa6568c

                                                        SHA256

                                                        2c3193198f3d70d93f21150bb98315d33cb43f49bce6d448035fe101a823f3f6

                                                        SHA512

                                                        1b8709c19aaa3fd3fad12a2d080395c6f990d411a44358e2ddaa73f382e073426e803183b67e4f20ccb8bb605cc558407d1396decdbf9a7c15a112367a0b425f

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                        Filesize

                                                        6KB

                                                        MD5

                                                        383ee851b4af062b4e6c61b91038a0ce

                                                        SHA1

                                                        1a8c850a5af6ac657b1b4735b04f2a17b09775df

                                                        SHA256

                                                        04e649c7f2d9485b955ce265b29c42b790e5f0132856280cac5758e56ea969e5

                                                        SHA512

                                                        96ccc04491f77f0ed900feefcccdbd2ee3905dd1a089ae509e12488e087a65311a10b905e1fbbc223b8d8a7e285cb246dbdf33f2750ca8e0b55c796a066dea59

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                        Filesize

                                                        7KB

                                                        MD5

                                                        c750856677c0a739828a96905eb57fee

                                                        SHA1

                                                        ab418256e2ce76c60653ada11de666434ea11b3c

                                                        SHA256

                                                        305bbaf82ff8afdd2e4a27fe31a96c796ff85f319db8fa9a265e707dd5bc231b

                                                        SHA512

                                                        dd2cbe2a50e41d6c02e4aab0dd2fc992598020e03fd13b403390505057800758803b97254d41b2317d0dbf7c1200fed87ce65e7dff4ba208d23d24ca7c079d2b

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                        Filesize

                                                        4KB

                                                        MD5

                                                        a57fe570e59029fef252673938d00082

                                                        SHA1

                                                        15167b4e8361e2f0ef98e200863a8dd7c518c0b8

                                                        SHA256

                                                        b3eedbffbb75afd9de42e2a7d9c78efed28eff2c46b2eb14778982bed420c4c6

                                                        SHA512

                                                        026fa7d85c2981dc7dd0e701e28ead41496eb548dc464ea82f33ba84d5fda8cd5fa1610dcbfcf7e9fc0f1369aec086f0b0b952fd123c68a290e3bd8da4c91345

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                        Filesize

                                                        3KB

                                                        MD5

                                                        1b2578cd883b85259101c5ede1ea45a4

                                                        SHA1

                                                        57dcd153379972db8dfad86d1ca53e3c2c8af4e6

                                                        SHA256

                                                        c7a35e9df6ee4d8e359753c656658f4d96cb6994670d5a2781cfcf935afb5dca

                                                        SHA512

                                                        04551f3fa5b8ee2d52b4fcc42d31be14e80b145e0d9a0e7499cebc4db1152f6c849057bf0db3a49407906cef33b629942e94726d300a8fbc134f48c5d836d9f3

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                        Filesize

                                                        4KB

                                                        MD5

                                                        48736c16be8dad28f4f6d27b72be9e33

                                                        SHA1

                                                        8e87bbcbadb649d37964d46fa0b583cd806ff36e

                                                        SHA256

                                                        462cd83736b50393fd46480c1ee2d7a9b4049a523d36c8e71011cefd8dff4fd0

                                                        SHA512

                                                        29037313f51cc9558f2c859fb14061c3a495f830cd686c2cbf9f113651a6e7b5ac4caea2af29f1878a9c4b0debd38549ff6f44fa7c1c4aef551e5f8642081de0

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                        Filesize

                                                        1KB

                                                        MD5

                                                        e29d49b77f714ad8c9d0a1ccf412eb4a

                                                        SHA1

                                                        fb8504c4dc6747d0bac8df079f24d107c91cedb6

                                                        SHA256

                                                        f6e6e03431cf0aca20e591d86d31c29bfd813e9db2aa8b638167615bb59ef271

                                                        SHA512

                                                        b373510cbee6021f1a7e2d8a2b18ee6929039f036ae99bb09373b38e1ee356288cd8690720c771264ac8e03bac18c779fa1e091f334baafc544b6cbe20d1747a

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5810a5.TMP

                                                        Filesize

                                                        204B

                                                        MD5

                                                        11dbd0a772c0f5e23253f0a49af4b0a8

                                                        SHA1

                                                        39f3cb3a2608b3a632a8cfe7a967a0b22d9a4250

                                                        SHA256

                                                        a6ab844bf4fb09fd7ff94a4ed84c9136787f4c7ba4c96e8cb8b5775a7266ce8f

                                                        SHA512

                                                        3b2f17f1269d10e9941c635024df0d8803abbea6b0571de121cd86261b9c204afe7efd2d0634fa1b076f7f589f1c34a0a37f3e1e6e5880bf3144fcc2e840685d

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                        Filesize

                                                        16B

                                                        MD5

                                                        6752a1d65b201c13b62ea44016eb221f

                                                        SHA1

                                                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                        SHA256

                                                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                        SHA512

                                                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                        Filesize

                                                        11KB

                                                        MD5

                                                        ae50d735f2858a55915a4fe8a107846f

                                                        SHA1

                                                        5d86b753fcddcfbfd1abb8dd1a51c35193933872

                                                        SHA256

                                                        1be47cc759e860a105ab5940887b1fa5636531b5696dc563a4ce881a2c951f23

                                                        SHA512

                                                        274189557f127176408f3c59c4ef4944d308fc7b1f94eee3a5eb07945b8eccdc6775eba64cc81bba0b0418db75240405cc0ed58a142f67d274a921ff6f01d157

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                        Filesize

                                                        10KB

                                                        MD5

                                                        8ddb595001379efca6bd7fde5b42e737

                                                        SHA1

                                                        ac4680b96a516ca35e451149b115de60b7757e1d

                                                        SHA256

                                                        1c495856c73ede2d9e40910c6db83f3610c0235c3cd4e845ae3ffaf9740ab6ed

                                                        SHA512

                                                        a73c4f2ad27cda39bad8197c59dc987450906ce4b2d1adfc1538cca2966f49525bab0a4bc65d4bf056b6224eef37691da66a70b5dd5418dddf8555af6d4adb2e

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                        Filesize

                                                        11KB

                                                        MD5

                                                        8c8200f8f770b50685602e8e7896a718

                                                        SHA1

                                                        4cd7414c17182801ffdd18b325c71628bd47786d

                                                        SHA256

                                                        f4480b75890ce64e6c46fed3ec219cc0004362453e6e64304861ffc256f64dde

                                                        SHA512

                                                        18b7714928f18113602d264c79b32ec53bac008bdca13c8d93ddbbf5ece09537ee879c742f5794d5941691ef8d611e50064a4a8fe88442e7f48024455e211b8b

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                        Filesize

                                                        11KB

                                                        MD5

                                                        d523433d8ea382054b472638f904a5f6

                                                        SHA1

                                                        1a15af339ed976b1da3b6ac35dc364929d12ebc6

                                                        SHA256

                                                        57e4cdf2a6f3b5af952d4649383200aeda897d57d3fee79975905d72308b872a

                                                        SHA512

                                                        ec26aa855d18c3de858a17a05a5ec3e309201a53c8d9a8ff418244c6e974cc1df13cd916938a1cb41d175fde2cd011b851e55e03a5f0b3764fc8135fee301da9

                                                      • C:\Users\Admin\Downloads\S0FTWARE.rar

                                                        Filesize

                                                        22.8MB

                                                        MD5

                                                        ff409ca8f2d9702c936f0de34fa3f268

                                                        SHA1

                                                        4ed58cba9dbf2ebaa1da6b05ee5c9ccaef0a99d5

                                                        SHA256

                                                        fa30a9b5deb2206471e38412e68d76dc2a4e9efc895ca02c816ad7bd3cf94903

                                                        SHA512

                                                        8feb49abd04821e5bba6c45b6afcadd8c43e3b6b84de1ac60d0453b09fde9d702e692be95998347402319d6ad2eddc508b95352f8120329c5a7ba2677a81966b

                                                      • C:\Users\Admin\Downloads\S0FTWARE\S0FTWARE.exe

                                                        Filesize

                                                        21.1MB

                                                        MD5

                                                        cfe61c91004402eb43efa2cceb6fd2a0

                                                        SHA1

                                                        ab7fbc240d4fe28e895adbe166df108268dac58a

                                                        SHA256

                                                        a490fe9a531f182f99e5de208cdbf9a1e53556b7c3883f18be5e1f7ed3629b6b

                                                        SHA512

                                                        d32467ff81d84cae2d386d42d8b4a7dc556c50998523bdc153fb003fc1a526e78f49156cb5191bb9216026fea67b3a4043a149de74612564e9c35210f95dd91b

                                                      • memory/5864-932-0x0000000000400000-0x0000000000657000-memory.dmp

                                                        Filesize

                                                        2.3MB

                                                      • memory/5864-933-0x0000000000400000-0x0000000000657000-memory.dmp

                                                        Filesize

                                                        2.3MB

                                                      • memory/5864-950-0x0000000000400000-0x0000000000657000-memory.dmp

                                                        Filesize

                                                        2.3MB

                                                      • memory/5864-951-0x0000000000400000-0x0000000000657000-memory.dmp

                                                        Filesize

                                                        2.3MB

                                                      • memory/5864-953-0x0000000000400000-0x0000000000657000-memory.dmp

                                                        Filesize

                                                        2.3MB

                                                      • memory/5864-954-0x0000000000400000-0x0000000000657000-memory.dmp

                                                        Filesize

                                                        2.3MB

                                                      • memory/5864-958-0x0000000000400000-0x0000000000657000-memory.dmp

                                                        Filesize

                                                        2.3MB

                                                      • memory/5864-959-0x0000000000400000-0x0000000000657000-memory.dmp

                                                        Filesize

                                                        2.3MB

                                                      • memory/5864-944-0x0000000000400000-0x0000000000657000-memory.dmp

                                                        Filesize

                                                        2.3MB

                                                      • memory/5864-945-0x0000000000400000-0x0000000000657000-memory.dmp

                                                        Filesize

                                                        2.3MB

                                                      • memory/5864-983-0x0000000000400000-0x0000000000657000-memory.dmp

                                                        Filesize

                                                        2.3MB

                                                      • memory/5864-984-0x0000000000400000-0x0000000000657000-memory.dmp

                                                        Filesize

                                                        2.3MB

                                                      • memory/5864-883-0x0000000000400000-0x0000000000657000-memory.dmp

                                                        Filesize

                                                        2.3MB

                                                      • memory/5864-1000-0x0000000000400000-0x0000000000657000-memory.dmp

                                                        Filesize

                                                        2.3MB

                                                      • memory/5864-1001-0x0000000000400000-0x0000000000657000-memory.dmp

                                                        Filesize

                                                        2.3MB

                                                      • memory/5864-919-0x0000000024590000-0x00000000247EF000-memory.dmp

                                                        Filesize

                                                        2.4MB

                                                      • memory/5864-917-0x0000000000400000-0x0000000000657000-memory.dmp

                                                        Filesize

                                                        2.3MB

                                                      • memory/5864-916-0x0000000000400000-0x0000000000657000-memory.dmp

                                                        Filesize

                                                        2.3MB

                                                      • memory/5864-902-0x0000000000400000-0x0000000000657000-memory.dmp

                                                        Filesize

                                                        2.3MB