Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/11/2024, 22:23

General

  • Target

    file.exe

  • Size

    2.0MB

  • MD5

    a48cf87c8f6511be994f5aa11385f188

  • SHA1

    d901949d4d93d392a8f09b9c2ea0763dd9c1b27d

  • SHA256

    86d56848a2231f9b3fb85a93318867ea31c0f1a58e6a8dd92115fa18b3deb663

  • SHA512

    2a33f72c575697a4e3c4cad6863e6eb1a12bb5f5c3802c2872d71c5c75cf39fa546d4665917f38de30dd25fb985fc92e492407435476c73349e0f379cb10317c

  • SSDEEP

    49152:oamwHAnAKgA+uOht7q6Eyx4TdDd0D0xzwxylMZXceIHUVeybql:oanxfnt7xid50uSLZMeIHUVeQq

Malware Config

Extracted

Family

stealc

Botnet

tale

C2

http://185.215.113.206

Attributes
  • url_path

    /6c4adf523b719729.php

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://founpiuer.store/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 14 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Identifies Wine through registry keys 2 TTPs 9 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 4 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 11 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2884
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
      2⤵
      • Uses browser remote debugging
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4732
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9096fcc40,0x7ff9096fcc4c,0x7ff9096fcc58
        3⤵
          PID:2080
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1840,i,1942436472367574608,15094622238438845737,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1836 /prefetch:2
          3⤵
            PID:3500
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2184,i,1942436472367574608,15094622238438845737,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2232 /prefetch:3
            3⤵
              PID:2068
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2272,i,1942436472367574608,15094622238438845737,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2312 /prefetch:8
              3⤵
                PID:2944
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3188,i,1942436472367574608,15094622238438845737,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3200 /prefetch:1
                3⤵
                • Uses browser remote debugging
                PID:1628
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3220,i,1942436472367574608,15094622238438845737,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3244 /prefetch:1
                3⤵
                • Uses browser remote debugging
                PID:4144
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4540,i,1942436472367574608,15094622238438845737,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4548 /prefetch:1
                3⤵
                • Uses browser remote debugging
                PID:3532
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4688,i,1942436472367574608,15094622238438845737,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3184 /prefetch:8
                3⤵
                  PID:4952
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4800,i,1942436472367574608,15094622238438845737,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4680 /prefetch:8
                  3⤵
                    PID:1900
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4808,i,1942436472367574608,15094622238438845737,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4200 /prefetch:8
                    3⤵
                      PID:3748
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4872,i,1942436472367574608,15094622238438845737,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4848 /prefetch:8
                      3⤵
                        PID:4612
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4752,i,1942436472367574608,15094622238438845737,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5012 /prefetch:8
                        3⤵
                          PID:4896
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5128,i,1942436472367574608,15094622238438845737,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5140 /prefetch:8
                          3⤵
                            PID:5048
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4852,i,1942436472367574608,15094622238438845737,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4804 /prefetch:8
                            3⤵
                              PID:3716
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4780,i,1942436472367574608,15094622238438845737,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4844 /prefetch:8
                              3⤵
                                PID:3972
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4684,i,1942436472367574608,15094622238438845737,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4988 /prefetch:2
                                3⤵
                                • Uses browser remote debugging
                                PID:5400
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
                              2⤵
                              • Uses browser remote debugging
                              • Enumerates system info in registry
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                              • Suspicious use of FindShellTrayWindow
                              PID:6088
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff909b846f8,0x7ff909b84708,0x7ff909b84718
                                3⤵
                                • Checks processor information in registry
                                • Enumerates system info in registry
                                • Suspicious behavior: EnumeratesProcesses
                                PID:6104
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,18178809430361975708,14972066387228687782,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
                                3⤵
                                  PID:344
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,18178809430361975708,14972066387228687782,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
                                  3⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4628
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,18178809430361975708,14972066387228687782,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
                                  3⤵
                                    PID:1176
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2112,18178809430361975708,14972066387228687782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
                                    3⤵
                                    • Uses browser remote debugging
                                    PID:2584
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2112,18178809430361975708,14972066387228687782,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
                                    3⤵
                                    • Uses browser remote debugging
                                    PID:1172
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2112,18178809430361975708,14972066387228687782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
                                    3⤵
                                    • Uses browser remote debugging
                                    PID:5376
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2112,18178809430361975708,14972066387228687782,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
                                    3⤵
                                    • Uses browser remote debugging
                                    PID:5384
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,18178809430361975708,14972066387228687782,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
                                    3⤵
                                      PID:5496
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,18178809430361975708,14972066387228687782,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
                                      3⤵
                                        PID:5860
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,18178809430361975708,14972066387228687782,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2808 /prefetch:2
                                        3⤵
                                          PID:2640
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,18178809430361975708,14972066387228687782,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2800 /prefetch:2
                                          3⤵
                                            PID:1544
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\DocumentsHJDGCGDBGC.exe"
                                          2⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:5792
                                          • C:\Users\Admin\DocumentsHJDGCGDBGC.exe
                                            "C:\Users\Admin\DocumentsHJDGCGDBGC.exe"
                                            3⤵
                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                            • Checks BIOS information in registry
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Identifies Wine through registry keys
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            • Drops file in Windows directory
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:6060
                                            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                              "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
                                              4⤵
                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                              • Checks BIOS information in registry
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Identifies Wine through registry keys
                                              • Adds Run key to start application
                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:5144
                                              • C:\Users\Admin\AppData\Local\Temp\1004149001\freecam.exe
                                                "C:\Users\Admin\AppData\Local\Temp\1004149001\freecam.exe"
                                                5⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                PID:2460
                                              • C:\Users\Admin\AppData\Local\Temp\1004211001\Set-up.exe
                                                "C:\Users\Admin\AppData\Local\Temp\1004211001\Set-up.exe"
                                                5⤵
                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                • Checks BIOS information in registry
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Identifies Wine through registry keys
                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                • System Location Discovery: System Language Discovery
                                                • Checks processor information in registry
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:1872
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
                                                  6⤵
                                                  • Uses browser remote debugging
                                                  • Enumerates system info in registry
                                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of FindShellTrayWindow
                                                  PID:5612
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff909e1cc40,0x7ff909e1cc4c,0x7ff909e1cc58
                                                    7⤵
                                                      PID:5232
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2040,i,10361216199565744833,915406768388094117,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2036 /prefetch:2
                                                      7⤵
                                                        PID:5760
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1948,i,10361216199565744833,915406768388094117,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2064 /prefetch:3
                                                        7⤵
                                                          PID:6052
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2276,i,10361216199565744833,915406768388094117,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2288 /prefetch:8
                                                          7⤵
                                                            PID:5852
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3220,i,10361216199565744833,915406768388094117,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3240 /prefetch:1
                                                            7⤵
                                                            • Uses browser remote debugging
                                                            PID:548
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3260,i,10361216199565744833,915406768388094117,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3504 /prefetch:1
                                                            7⤵
                                                            • Uses browser remote debugging
                                                            PID:5020
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4356,i,10361216199565744833,915406768388094117,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3784 /prefetch:1
                                                            7⤵
                                                            • Uses browser remote debugging
                                                            PID:1720
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4384,i,10361216199565744833,915406768388094117,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4712 /prefetch:8
                                                            7⤵
                                                              PID:1164
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4556,i,10361216199565744833,915406768388094117,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4848 /prefetch:8
                                                              7⤵
                                                                PID:2072
                                                            • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\service123.exe"
                                                              6⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Location Discovery: System Language Discovery
                                                              PID:6036
                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                              "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
                                                              6⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:5984
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 1844
                                                              6⤵
                                                              • Program crash
                                                              PID:32
                                                          • C:\Users\Admin\AppData\Local\Temp\1004220001\2512a3d459.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\1004220001\2512a3d459.exe"
                                                            5⤵
                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                            • Checks BIOS information in registry
                                                            • Executes dropped EXE
                                                            • Identifies Wine through registry keys
                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                            • System Location Discovery: System Language Discovery
                                                            PID:6100
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 6100 -s 1500
                                                              6⤵
                                                              • Program crash
                                                              PID:3424
                                                          • C:\Users\Admin\AppData\Local\Temp\1004221001\55ec3c26f1.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\1004221001\55ec3c26f1.exe"
                                                            5⤵
                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                            • Checks BIOS information in registry
                                                            • Executes dropped EXE
                                                            • Identifies Wine through registry keys
                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                            • System Location Discovery: System Language Discovery
                                                            PID:2356
                                                          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
                                                            5⤵
                                                              PID:5788
                                                            • C:\Users\Admin\AppData\Local\Temp\1004223001\a9af00f992.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\1004223001\a9af00f992.exe"
                                                              5⤵
                                                              • Modifies Windows Defender Real-time Protection settings
                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                              • Checks BIOS information in registry
                                                              • Executes dropped EXE
                                                              • Identifies Wine through registry keys
                                                              • Windows security modification
                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:208
                                                    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                      1⤵
                                                        PID:3132
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                        1⤵
                                                          PID:2700
                                                        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                          C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                          1⤵
                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                          • Checks BIOS information in registry
                                                          • Executes dropped EXE
                                                          • Identifies Wine through registry keys
                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:4608
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6100 -ip 6100
                                                          1⤵
                                                            PID:3232
                                                          • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                            "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                            1⤵
                                                              PID:6140
                                                            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                              C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                              1⤵
                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                              • Checks BIOS information in registry
                                                              • Executes dropped EXE
                                                              • Identifies Wine through registry keys
                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                              PID:4136
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1872 -ip 1872
                                                              1⤵
                                                                PID:5964

                                                              Network

                                                              MITRE ATT&CK Enterprise v15

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              • C:\ProgramData\chrome.dll

                                                                Filesize

                                                                676KB

                                                                MD5

                                                                eda18948a989176f4eebb175ce806255

                                                                SHA1

                                                                ff22a3d5f5fb705137f233c36622c79eab995897

                                                                SHA256

                                                                81a4f37c5495800b7cc46aea6535d9180dadb5c151db6f1fd1968d1cd8c1eeb4

                                                                SHA512

                                                                160ed9990c37a4753fc0f5111c94414568654afbedc05308308197df2a99594f2d5d8fe511fd2279543a869ed20248e603d88a0b9b8fb119e8e6131b0c52ff85

                                                              • C:\ProgramData\mozglue.dll

                                                                Filesize

                                                                593KB

                                                                MD5

                                                                c8fd9be83bc728cc04beffafc2907fe9

                                                                SHA1

                                                                95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                SHA256

                                                                ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                SHA512

                                                                fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                              • C:\ProgramData\nss3.dll

                                                                Filesize

                                                                2.0MB

                                                                MD5

                                                                1cc453cdf74f31e4d913ff9c10acdde2

                                                                SHA1

                                                                6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                                SHA256

                                                                ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                                SHA512

                                                                dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

                                                                Filesize

                                                                40B

                                                                MD5

                                                                53f896e6ec3a1c85c0d9124da3b7380e

                                                                SHA1

                                                                f4b222bb0b3fda0f2ab34768d1d086bc6533575e

                                                                SHA256

                                                                17445b99fe65252ca0a67cde3f5d2b1feb0224d39f52d1641ae0bb8dd0282453

                                                                SHA512

                                                                512cd2d07e1e7ebe78ddf8f5c5a682a30a0a9a1f55099a466ddd54c351295a92f4ac4946ebf4218d6353a3148ac38a2dbc07c9f96e12042868acce13c9edb1c3

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                                                Filesize

                                                                649B

                                                                MD5

                                                                dd2d421072f3efebc22d4a2fa2796dc4

                                                                SHA1

                                                                6b323ce8a32e1139f8e4e12268f10fd4cfaae648

                                                                SHA256

                                                                64ebbf546cdfce6575156fcdffb5b41c708ef838b8fa276407eebc2f2d760420

                                                                SHA512

                                                                d314b3f68b6dfbaed68a1702d20179361589541ce7822bb87abb7c7471c891581e9150696caabe50e5a15f436dca323ee36a2950350d426f37ce724d9c5bd229

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0

                                                                Filesize

                                                                44KB

                                                                MD5

                                                                ac7483416d0900dc985325f31e28e74b

                                                                SHA1

                                                                6af02b8c4cbecdcf9e5d9870a7db06a622a4c556

                                                                SHA256

                                                                d4c6e7a137245cbda1f962337df0a3fab44a47845fbd0cbe6641a1f41851ea17

                                                                SHA512

                                                                5a4e7a805a24e452c69d091f26d899723d34adca5f7a53d240f90a9470f5203554b0e7ed4c8dc4bd84435b87654d7745b19be1555645ae2228bc1d3bf1f50d47

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1

                                                                Filesize

                                                                264KB

                                                                MD5

                                                                7005f565cd63f648c95515e1c9740552

                                                                SHA1

                                                                e0f7de67ae78afdd660911d474291036bcaca68c

                                                                SHA256

                                                                5dfa9379fe8a6477c096fe453c7015df5998c064bf65ea10127270b3e635c2f0

                                                                SHA512

                                                                a4f62306787d7c6f6d625bce4f4ac89ed56d3a9bd935ebcc43ca5d7df4a69d0042270b6a81fd932cc26a0cb80d9ab06f9ddacaa37749c26e4083597515015ba6

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2

                                                                Filesize

                                                                1.0MB

                                                                MD5

                                                                cf217d712c4bf0982f5b4cbae6ddde5a

                                                                SHA1

                                                                ea362dc171ac45038fb7771d2182c72d368d93fb

                                                                SHA256

                                                                47bae565499a3df35910a66663b3a138ccf93dd55a23f65def59614c3e425467

                                                                SHA512

                                                                961f9a710a18919decae3530b1b53b0ca7816712cb9ad4277b00ef49de0066d49003a2696754519fbd577f82f7b05d1c0859e8a5215793c909a9abac4b362442

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3

                                                                Filesize

                                                                4.0MB

                                                                MD5

                                                                78220ced851ab80d37e7451341d4c59f

                                                                SHA1

                                                                ec1a52430f837acbd9c94946c70252e2a020bbab

                                                                SHA256

                                                                56c81c2a08f5573f218900d68e236bf6b978dbbe066efc4b376ffb912b11f3cd

                                                                SHA512

                                                                7e26fb6f689be820b3cc8ae32bf3b3792c071adfe866d71fce72ec9aeb9d40722b2c30de315db8f53111f4de7f5a18e7f0e5052d9ccb7618644f33d34e9c76aa

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

                                                                Filesize

                                                                36KB

                                                                MD5

                                                                024496c4bfe0902ae7b8d28a16044698

                                                                SHA1

                                                                ded38321656880a1a81b2eda34a46853852bed91

                                                                SHA256

                                                                3ccc9c0f639e153fb73a0a72d99ee82c2545ef0ab5314ec6307beaf804984c00

                                                                SHA512

                                                                17108827c6a74946e05988554d7438bfa87a2db7055cc670e12e5210549a5de0cfc578e519ce1e1b79500dcfe7406be11ad02b970a3fdb42c9b9b8c67a982c9a

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

                                                                Filesize

                                                                62KB

                                                                MD5

                                                                e5fc91cbce096df1d36191f9eedd3c64

                                                                SHA1

                                                                1a8076bf524b6d2b8a44c18fa8afb199a60dc1c9

                                                                SHA256

                                                                0e111dba5797ec182bf4af537a2c928ebd3957b99ed291610fbf322d6c2c9e19

                                                                SHA512

                                                                c9b064fbcb2df48dcf5bfa4387c164acb2bae075af013e6c39166dddc7e91ce993caaa0fdfac3ba1c3a12ca6c21577d99776fb1445f3009c7359b926a173f668

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

                                                                Filesize

                                                                38KB

                                                                MD5

                                                                d4586933fabd5754ef925c6e940472f4

                                                                SHA1

                                                                a77f36a596ef86e1ad10444b2679e1531995b553

                                                                SHA256

                                                                6e1c3edffec71a01e11e30aa359952213ac2f297c5014f36027f308a18df75d2

                                                                SHA512

                                                                6ce33a8da7730035fb6b67ed59f32029c3a94b0a5d7dc5aa58c9583820bb01ef59dd55c1c142f392e02da86c8699b2294aff2d7c0e4c3a59fce5f792c749c5ce

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\_locales\en_CA\messages.json

                                                                Filesize

                                                                851B

                                                                MD5

                                                                07ffbe5f24ca348723ff8c6c488abfb8

                                                                SHA1

                                                                6dc2851e39b2ee38f88cf5c35a90171dbea5b690

                                                                SHA256

                                                                6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

                                                                SHA512

                                                                7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\dasherSettingSchema.json

                                                                Filesize

                                                                854B

                                                                MD5

                                                                4ec1df2da46182103d2ffc3b92d20ca5

                                                                SHA1

                                                                fb9d1ba3710cf31a87165317c6edc110e98994ce

                                                                SHA256

                                                                6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

                                                                SHA512

                                                                939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0

                                                                Filesize

                                                                44KB

                                                                MD5

                                                                39969060315412afe1aded177fdb9454

                                                                SHA1

                                                                ce47936bca6af3817b7b5df5f1cb0e0434379cab

                                                                SHA256

                                                                462ee1ddcdc20249bb4b5437d7d7281e46ab1ca44d63ec30b47497be2a3845ce

                                                                SHA512

                                                                bf9f4764aea2f7f1b3e8d0b564b5728f139dbe27c8e25d92db0572ee71730051b11cfc7e809c9db1839b4ddb8b67ee4aa1865fabef3c4ce438dfd76ca74b999f

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG

                                                                Filesize

                                                                332B

                                                                MD5

                                                                abf9579132f4f799901350393bda8778

                                                                SHA1

                                                                50fbff0f1d16776ed37152451abdb0cc1d75b0fc

                                                                SHA256

                                                                2f7e325debb29e65a85031056d5a507d465c313007a28027013beecd244a84f7

                                                                SHA512

                                                                f2eab148f10f99f3522b88ea3e3414b562d1d649abfcba6310191a1c53dd7d67df64d6f6b0b939d56631241603a4ae9ee5445a449652c1f39b20e1537172e8cf

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                                Filesize

                                                                2B

                                                                MD5

                                                                d751713988987e9331980363e24189ce

                                                                SHA1

                                                                97d170e1550eee4afc0af065b78cda302a97674c

                                                                SHA256

                                                                4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                SHA512

                                                                b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log

                                                                Filesize

                                                                3KB

                                                                MD5

                                                                95a51fbd24fb9dcbc9a3a98419716d03

                                                                SHA1

                                                                0c6ee4e29ca0ef477bc21c94e7b54e7f43f6d381

                                                                SHA256

                                                                bb9159c947490ec0341f372ba25ed6cb03ad26d1496868626d70eedfb6e33f8c

                                                                SHA512

                                                                690390c5b6a44ea2744ca351caa06913aec1f9686733ae7002e4ffcec822e2bf410097f298d293996da7da28121842df444d9cde5ab6e85c5fc622bd34217839

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG

                                                                Filesize

                                                                333B

                                                                MD5

                                                                26bb11617e03ddf3a8cf322a42ca60df

                                                                SHA1

                                                                64ba7e7ade32b95334214f81e2c86df42cb0fa85

                                                                SHA256

                                                                c77c813307d0ceba9ec53db82400a0840dfd88bbc511b87640f69d8595c568d3

                                                                SHA512

                                                                e4aa9f8189c2c4d890af1f325decbd2f2159f3b6070048d63a0c570c68c76822778023681b07e2dcf69e17646cfecf33853e113edcdcde625e6e9f51a5d91b5e

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG

                                                                Filesize

                                                                345B

                                                                MD5

                                                                d2ac0e486f45250d02a3ac6deb4ad569

                                                                SHA1

                                                                cb40d56678448a9d389dcfacf946baf8d2d7ea74

                                                                SHA256

                                                                5db280113112c07135bb840902f75e54d20fa4da411ebbab688a7819c2a5dfb1

                                                                SHA512

                                                                29bcad61c08412f690289cece61a127dfef2814b8d548fd5b2d9e579fb9762353fadbf2333d5a85e4e037281f5be34302728e236b2c54e62a500304daf7d4d2e

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG

                                                                Filesize

                                                                321B

                                                                MD5

                                                                d1d8d5fdf10de6584120ee3a0d3d4240

                                                                SHA1

                                                                ca1928593da0f2de80d99d837e0c065f714b153c

                                                                SHA256

                                                                a3fbc9712fba15aacd295c474afd855ba428df23f1ca7ee33848ca2163c108db

                                                                SHA512

                                                                09a0fee5c85a8b4087170ddde245c9a6bc5cdb3dbe88a8fce95e6bf90f88c0818537e0dec6bd8c2d94d8cc344c5d863760cae637acf7db9fcd443185e4aecb68

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

                                                                Filesize

                                                                14B

                                                                MD5

                                                                ef48733031b712ca7027624fff3ab208

                                                                SHA1

                                                                da4f3812e6afc4b90d2185f4709dfbb6b47714fa

                                                                SHA256

                                                                c9ce8dbbe51a4131073db3d6ceef1e11eaca6308ad88a86125f221102d2cee99

                                                                SHA512

                                                                ce3a5a429e3796977a8019f47806b8c0671b597ead642fcbfbe3144e2b8112d35a9f2250896b7f215d237d0d19c5966caf3fe674165a6d50e14cb2b88c892029

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

                                                                Filesize

                                                                86B

                                                                MD5

                                                                f732dbed9289177d15e236d0f8f2ddd3

                                                                SHA1

                                                                53f822af51b014bc3d4b575865d9c3ef0e4debde

                                                                SHA256

                                                                2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93

                                                                SHA512

                                                                b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

                                                                Filesize

                                                                418B

                                                                MD5

                                                                defdb4e00fcdcd75fa2ac3893d89de85

                                                                SHA1

                                                                270b9228e593da574c2c08827c71d01bfbe700c8

                                                                SHA256

                                                                ba637c067897015616102f20fc2d93c90494662507fa8416a9d86a55e5892ad9

                                                                SHA512

                                                                a7199980104d2ea31d504577110eae419226660698fa4229388c6bd54d4e6c1dd5710406c8f7e7cb62d091bc0b3ba6ce417fd88df8ab2681fa876487fb5adc27

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\1245782b-2c3d-40d6-a44e-68487fdf5548.dmp

                                                                Filesize

                                                                838KB

                                                                MD5

                                                                5756ac9645210633a9778a50cff77267

                                                                SHA1

                                                                ee37f0abb2c5b5afa76ff2c87b09c3a97dade08a

                                                                SHA256

                                                                081c4bd10f1157c8f8f7a157769344babee209ae28440c7e278b153d91e35ec0

                                                                SHA512

                                                                6e7a00d61bc2fae86c84a70b9b41a8b2628e4a2b944f127799f14bee653eac91f875581b4bab698b277ca654af142b1b17c6d8ebaa80801e636c3063f68201e8

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\6901ef5c-665c-4685-bdd6-1994c0040ee9.dmp

                                                                Filesize

                                                                826KB

                                                                MD5

                                                                eba5049f39c61ef101ebf11502dcec50

                                                                SHA1

                                                                c361ba80f1b8a8fb862842735a5793055025660e

                                                                SHA256

                                                                a301304d404cdb77842472b87fdb5b0945f9e4240fd9e34464b3391a15da6f93

                                                                SHA512

                                                                9378b06b673315c18f32ad5da91f01eca0273941d5572324f40731d336cc17a76d3e9c40ffb08a1dd2b7958c1664f582a4194ea7f6cf77d71102fe8105f31fb6

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\69e694a5-8dc3-497f-b8d5-b5fc17573ef3.dmp

                                                                Filesize

                                                                826KB

                                                                MD5

                                                                0920a37d85c87d9a1824122fc80933cf

                                                                SHA1

                                                                5c83ab51b76412ab2eed3d03dc52dc3677a5d2ea

                                                                SHA256

                                                                4c51b47ae0b5dc5dca9d862d8483db2f179832ea7cbd44d9e49d2adc0915af49

                                                                SHA512

                                                                9bf9db48718516182171c94221415684adf6d7fa3ac90263bfc1d32c9314a2e30eb1bd9f275d939c4386f275fa6eb6eeed48174ba7f53ef8f92d635c8f64cf87

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\89ab0bdf-331a-4886-85b0-79778de36caf.dmp

                                                                Filesize

                                                                826KB

                                                                MD5

                                                                b540b59b22515c1372fdc2c37643c511

                                                                SHA1

                                                                87d2250009e5bd3caa3c3a85ce6b89990415c069

                                                                SHA256

                                                                6ddc7fde92958409cc9a38eb117f42b6e70ddc39ce0dcbc9342417893a5ff9b3

                                                                SHA512

                                                                54fb4711f856692bb995539e3daa9a8b387b6ae678ce4deba64c9f99c8660375db458ae1c119e14caaec36e3944173f2b7bc983b40d1945b13522a5a9047b10e

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                Filesize

                                                                152B

                                                                MD5

                                                                61cef8e38cd95bf003f5fdd1dc37dae1

                                                                SHA1

                                                                11f2f79ecb349344c143eea9a0fed41891a3467f

                                                                SHA256

                                                                ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

                                                                SHA512

                                                                6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                Filesize

                                                                152B

                                                                MD5

                                                                0a9dc42e4013fc47438e96d24beb8eff

                                                                SHA1

                                                                806ab26d7eae031a58484188a7eb1adab06457fc

                                                                SHA256

                                                                58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

                                                                SHA512

                                                                868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                Filesize

                                                                152B

                                                                MD5

                                                                377c9a96f70aff8c07694dccfaf1e8ee

                                                                SHA1

                                                                75809d47fb3e2514118d90ba06cd0cf6860f2dc2

                                                                SHA256

                                                                da0e229745c495905a6defd36bb040cee527ffa02bbd9f2518977e4faf1cff78

                                                                SHA512

                                                                7f02e47f7e89be89a41f7443cf08d7e9baf595a55f573774c9cb422e4f8745abd7d2162440ae0877d20e08e81eae9a1330843a6195557bb595fd0c545b3a0b73

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                Filesize

                                                                152B

                                                                MD5

                                                                e9e1a6e6c43b40463d839d060cb26165

                                                                SHA1

                                                                f7335cdc6497d1d69dbfd1b4304b7d5eaf943732

                                                                SHA256

                                                                4cdbadec68af993e16ef294b838e0b4dc7db147efd2c279aeb465c245977a059

                                                                SHA512

                                                                b4b94b2537337c03ec01643954452f39bf25d326ce8cad83874d3543f0412b81bf5f336b0f102a0028951c756a9ae58cddef74fe85f313f9336e3b8004322f9b

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                Filesize

                                                                5KB

                                                                MD5

                                                                67671446939d0d5cab1318207dee8d97

                                                                SHA1

                                                                d581c0932d76016ea13dc4e8f54a1dbf56c05240

                                                                SHA256

                                                                565f96f49264617a9110b038b9a5e8c9780c72ef63c13c7e60e140b7ddb07879

                                                                SHA512

                                                                1f531228955e0c240776a286b561616ad5880790d13fdc3cb375fa88c07f1c4995bcc5240f106ebff79442464111bc4789e0cbdbb74ac5217fff0a6b17d02606

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e8dc4d7f-eaae-4314-8be2-e2eed869808f.tmp

                                                                Filesize

                                                                1B

                                                                MD5

                                                                5058f1af8388633f609cadb75a75dc9d

                                                                SHA1

                                                                3a52ce780950d4d969792a2559cd519d7ee8c727

                                                                SHA256

                                                                cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                                                SHA512

                                                                0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

                                                                Filesize

                                                                264KB

                                                                MD5

                                                                f50f89a0a91564d0b8a211f8921aa7de

                                                                SHA1

                                                                112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                                SHA256

                                                                b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                                SHA512

                                                                bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                              • C:\Users\Admin\AppData\Local\Temp\1004149001\freecam.exe

                                                                Filesize

                                                                12.9MB

                                                                MD5

                                                                704d12a2e64a9b3ebe375594a11f3ee6

                                                                SHA1

                                                                e6e45cd1926de46bfa0832de19ddeb29c8c0f629

                                                                SHA256

                                                                b5975c9eb7e34161ae63eab8518b130d4fdcc1526ca512d2e5452c6d701fe912

                                                                SHA512

                                                                b72689628014a48976672427d0470d8e024dac4d3b266bc9398a8dadd72f1b4d4dc1a4429847a45956ae604cf072cf5419cf3036a4e6d5373517db38a9d3ffb4

                                                              • C:\Users\Admin\AppData\Local\Temp\1004211001\Set-up.exe

                                                                Filesize

                                                                4.2MB

                                                                MD5

                                                                e61852d0a596d91897c3e731f18b4ae7

                                                                SHA1

                                                                fa10a42495e023ae6cbd464842352cccf0d0ee28

                                                                SHA256

                                                                16606d62af0e28e4c9359802f1e9f329eae01edee0b31b8b84b0fbc51818a129

                                                                SHA512

                                                                c47dc92cd52c0efec3c993812965ad74a710ce8600f069d6d7d18c04e777682a2c77881a61443f9f4c425c79627ab6d06db0461f0622d1f0c6414eca2215a310

                                                              • C:\Users\Admin\AppData\Local\Temp\1004220001\2512a3d459.exe

                                                                Filesize

                                                                3.1MB

                                                                MD5

                                                                16175965c1a26f713050155f2691c9fa

                                                                SHA1

                                                                b56d08b38b9e10b6678073f4d1625a899f437dde

                                                                SHA256

                                                                0e12694790980fed561f7da0baaadcffb6502e69008c57302e2a2d06b9824aee

                                                                SHA512

                                                                c98e8acaba2fd34b3d0c33b5fbbc68e6d7bd560f6e1dadb7633fcc2ab5ca8bfc59e651b6fb3fedd3153157280b5ce8468a92d743becdbd50c3faceed87fa7ffa

                                                              • C:\Users\Admin\AppData\Local\Temp\1004221001\55ec3c26f1.exe

                                                                Filesize

                                                                2.0MB

                                                                MD5

                                                                a48cf87c8f6511be994f5aa11385f188

                                                                SHA1

                                                                d901949d4d93d392a8f09b9c2ea0763dd9c1b27d

                                                                SHA256

                                                                86d56848a2231f9b3fb85a93318867ea31c0f1a58e6a8dd92115fa18b3deb663

                                                                SHA512

                                                                2a33f72c575697a4e3c4cad6863e6eb1a12bb5f5c3802c2872d71c5c75cf39fa546d4665917f38de30dd25fb985fc92e492407435476c73349e0f379cb10317c

                                                              • C:\Users\Admin\AppData\Local\Temp\1004223001\a9af00f992.exe

                                                                Filesize

                                                                2.7MB

                                                                MD5

                                                                b8d3c6ffd7a9069a0ef5c3c8ae8f4b3d

                                                                SHA1

                                                                3892df5651b3e8b4ef4ed3b5ab54b02af896ed0e

                                                                SHA256

                                                                9918ac2c0708da89e015d5e0b15654c3e9dd1e03a21bca31644e54f988aa9055

                                                                SHA512

                                                                e6cba030ac86c3f35c5a9933ea79b9690b860e9d6810edb9eaa957c1a92e1eaef82fe729a64c47c33b6593d077cfcb006a90abe81c6eaebb58f20d591bc496df

                                                              • C:\Users\Admin\AppData\Local\Temp\scoped_dir4732_258725511\CRX_INSTALL\_locales\en_CA\messages.json

                                                                Filesize

                                                                711B

                                                                MD5

                                                                558659936250e03cc14b60ebf648aa09

                                                                SHA1

                                                                32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

                                                                SHA256

                                                                2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

                                                                SHA512

                                                                1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

                                                              • C:\Users\Admin\AppData\Local\Temp\scoped_dir4732_258725511\bceff44f-9db4-40ef-a185-3435d8739b99.tmp

                                                                Filesize

                                                                132KB

                                                                MD5

                                                                da75bb05d10acc967eecaac040d3d733

                                                                SHA1

                                                                95c08e067df713af8992db113f7e9aec84f17181

                                                                SHA256

                                                                33ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2

                                                                SHA512

                                                                56533de53872f023809a20d1ea8532cdc2260d40b05c5a7012c8e61576ff092f006a197f759c92c6b8c429eeec4bb542073b491ddcfd5b22cd4ecbe1a8a7c6ef

                                                              • C:\Users\Admin\DocumentsHJDGCGDBGC.exe

                                                                Filesize

                                                                3.0MB

                                                                MD5

                                                                2e17ab7346c3eb1753d6a230e67c9fee

                                                                SHA1

                                                                39e2f727cfd81587d25bde0f9bf86b9b727d9c2e

                                                                SHA256

                                                                a4df99e125f4f3edca8d1657bddf19a6b6e582f93bfc112468bcf282c735d309

                                                                SHA512

                                                                c61ffb8942477ca722451488686481aaa884a8c1cddc11c248f7f4c16fd39ad029f92c97dd7271ce951c31deff7acd7a937fb6a6a71d031a5bf494dca96baf54

                                                              • memory/208-817-0x0000000000D90000-0x0000000001048000-memory.dmp

                                                                Filesize

                                                                2.7MB

                                                              • memory/208-813-0x0000000000D90000-0x0000000001048000-memory.dmp

                                                                Filesize

                                                                2.7MB

                                                              • memory/208-820-0x0000000000D90000-0x0000000001048000-memory.dmp

                                                                Filesize

                                                                2.7MB

                                                              • memory/208-812-0x0000000000D90000-0x0000000001048000-memory.dmp

                                                                Filesize

                                                                2.7MB

                                                              • memory/208-810-0x0000000000D90000-0x0000000001048000-memory.dmp

                                                                Filesize

                                                                2.7MB

                                                              • memory/1872-822-0x0000000000A40000-0x000000000162C000-memory.dmp

                                                                Filesize

                                                                11.9MB

                                                              • memory/1872-823-0x0000000069CC0000-0x000000006A71B000-memory.dmp

                                                                Filesize

                                                                10.4MB

                                                              • memory/1872-785-0x0000000000A40000-0x000000000162C000-memory.dmp

                                                                Filesize

                                                                11.9MB

                                                              • memory/1872-910-0x0000000000A40000-0x000000000162C000-memory.dmp

                                                                Filesize

                                                                11.9MB

                                                              • memory/1872-792-0x0000000000A40000-0x000000000162C000-memory.dmp

                                                                Filesize

                                                                11.9MB

                                                              • memory/1872-902-0x0000000000A40000-0x000000000162C000-memory.dmp

                                                                Filesize

                                                                11.9MB

                                                              • memory/1872-896-0x0000000000A40000-0x000000000162C000-memory.dmp

                                                                Filesize

                                                                11.9MB

                                                              • memory/1872-752-0x0000000000A40000-0x000000000162C000-memory.dmp

                                                                Filesize

                                                                11.9MB

                                                              • memory/1872-833-0x0000000000A40000-0x000000000162C000-memory.dmp

                                                                Filesize

                                                                11.9MB

                                                              • memory/1872-815-0x0000000000A40000-0x000000000162C000-memory.dmp

                                                                Filesize

                                                                11.9MB

                                                              • memory/2356-790-0x0000000000510000-0x0000000000C25000-memory.dmp

                                                                Filesize

                                                                7.1MB

                                                              • memory/2356-786-0x0000000000510000-0x0000000000C25000-memory.dmp

                                                                Filesize

                                                                7.1MB

                                                              • memory/2884-1-0x0000000077074000-0x0000000077076000-memory.dmp

                                                                Filesize

                                                                8KB

                                                              • memory/2884-448-0x0000000000F80000-0x0000000001695000-memory.dmp

                                                                Filesize

                                                                7.1MB

                                                              • memory/2884-60-0x0000000000F80000-0x0000000001695000-memory.dmp

                                                                Filesize

                                                                7.1MB

                                                              • memory/2884-602-0x0000000000F80000-0x0000000001695000-memory.dmp

                                                                Filesize

                                                                7.1MB

                                                              • memory/2884-694-0x0000000000F80000-0x0000000001695000-memory.dmp

                                                                Filesize

                                                                7.1MB

                                                              • memory/2884-26-0x0000000000F80000-0x0000000001695000-memory.dmp

                                                                Filesize

                                                                7.1MB

                                                              • memory/2884-2-0x0000000000F81000-0x0000000000FE9000-memory.dmp

                                                                Filesize

                                                                416KB

                                                              • memory/2884-3-0x0000000000F80000-0x0000000001695000-memory.dmp

                                                                Filesize

                                                                7.1MB

                                                              • memory/2884-0-0x0000000000F80000-0x0000000001695000-memory.dmp

                                                                Filesize

                                                                7.1MB

                                                              • memory/2884-698-0x0000000000F80000-0x0000000001695000-memory.dmp

                                                                Filesize

                                                                7.1MB

                                                              • memory/2884-4-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                Filesize

                                                                972KB

                                                              • memory/2884-457-0x0000000000F80000-0x0000000001695000-memory.dmp

                                                                Filesize

                                                                7.1MB

                                                              • memory/2884-455-0x0000000000F80000-0x0000000001695000-memory.dmp

                                                                Filesize

                                                                7.1MB

                                                              • memory/4136-897-0x00000000009A0000-0x0000000000CAA000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/4136-899-0x00000000009A0000-0x0000000000CAA000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/4608-733-0x00000000009A0000-0x0000000000CAA000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/4608-735-0x00000000009A0000-0x0000000000CAA000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/5144-712-0x00000000009A0000-0x0000000000CAA000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/5144-821-0x00000000009A0000-0x0000000000CAA000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/5144-917-0x00000000009A0000-0x0000000000CAA000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/5144-713-0x00000000009A0000-0x0000000000CAA000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/5144-814-0x00000000009A0000-0x0000000000CAA000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/5144-736-0x00000000009A0000-0x0000000000CAA000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/5144-895-0x00000000009A0000-0x0000000000CAA000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/5144-914-0x00000000009A0000-0x0000000000CAA000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/5144-832-0x00000000009A0000-0x0000000000CAA000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/5144-911-0x00000000009A0000-0x0000000000CAA000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/5144-901-0x00000000009A0000-0x0000000000CAA000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/5144-777-0x00000000009A0000-0x0000000000CAA000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/6036-913-0x0000000073250000-0x0000000073384000-memory.dmp

                                                                Filesize

                                                                1.2MB

                                                              • memory/6036-912-0x0000000000980000-0x0000000000992000-memory.dmp

                                                                Filesize

                                                                72KB

                                                              • memory/6060-696-0x00000000005A0000-0x00000000008AA000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/6060-711-0x00000000005A0000-0x00000000008AA000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/6100-788-0x0000000000200000-0x0000000000514000-memory.dmp

                                                                Filesize

                                                                3.1MB

                                                              • memory/6100-767-0x0000000000200000-0x0000000000514000-memory.dmp

                                                                Filesize

                                                                3.1MB