Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/11/2024, 23:55

General

  • Target

    file.exe

  • Size

    3.1MB

  • MD5

    df3fc9d0e3234bec4a4a21004056d0e3

  • SHA1

    3a689c14f50b7569fd3452e640c53cd9b7c173b2

  • SHA256

    72e18d1f94925f558f47baf67848e00775a07622df025ebce3c1264296d6d44e

  • SHA512

    4190a7991d8f1ac68eb19ccd53ecbb0fe39fcb9b0c590aebecf5fc8c879b47bef639cf7882d9a120209bc60ef649c77a36289a84a3830b03243dc722670b9121

  • SSDEEP

    49152:Nx4TiaIdRZA4sxc8K3ZVrTy996ouxTYZNJfYd2ysTv2:N+OPrm4sxnK3ZVrTyPICTJfYd2f2

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

tale

C2

http://185.215.113.206

Attributes
  • url_path

    /6c4adf523b719729.php

Extracted

Family

lumma

C2

https://founpiuer.store/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 14 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Identifies Wine through registry keys 2 TTPs 9 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 5 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 11 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4776
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4000
      • C:\Users\Admin\AppData\Local\Temp\1004149001\freecam.exe
        "C:\Users\Admin\AppData\Local\Temp\1004149001\freecam.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1056
      • C:\Users\Admin\AppData\Local\Temp\1004211001\Set-up.exe
        "C:\Users\Admin\AppData\Local\Temp\1004211001\Set-up.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:2672
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
          4⤵
          • Uses browser remote debugging
          • Enumerates system info in registry
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:5392
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc8b16cc40,0x7ffc8b16cc4c,0x7ffc8b16cc58
            5⤵
              PID:4720
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1908,i,1544571212510050772,12993821658156410300,262144 --variations-seed-version=20241105-050129.381000 --mojo-platform-channel-handle=1912 /prefetch:2
              5⤵
                PID:4860
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2136,i,1544571212510050772,12993821658156410300,262144 --variations-seed-version=20241105-050129.381000 --mojo-platform-channel-handle=2168 /prefetch:3
                5⤵
                  PID:2524
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2232,i,1544571212510050772,12993821658156410300,262144 --variations-seed-version=20241105-050129.381000 --mojo-platform-channel-handle=2452 /prefetch:8
                  5⤵
                    PID:6044
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3192,i,1544571212510050772,12993821658156410300,262144 --variations-seed-version=20241105-050129.381000 --mojo-platform-channel-handle=3200 /prefetch:1
                    5⤵
                    • Uses browser remote debugging
                    PID:5088
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3224,i,1544571212510050772,12993821658156410300,262144 --variations-seed-version=20241105-050129.381000 --mojo-platform-channel-handle=3248 /prefetch:1
                    5⤵
                    • Uses browser remote debugging
                    PID:4780
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4420,i,1544571212510050772,12993821658156410300,262144 --variations-seed-version=20241105-050129.381000 --mojo-platform-channel-handle=4484 /prefetch:1
                    5⤵
                    • Uses browser remote debugging
                    PID:5880
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4016,i,1544571212510050772,12993821658156410300,262144 --variations-seed-version=20241105-050129.381000 --mojo-platform-channel-handle=4000 /prefetch:8
                    5⤵
                      PID:5816
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3872,i,1544571212510050772,12993821658156410300,262144 --variations-seed-version=20241105-050129.381000 --mojo-platform-channel-handle=4672 /prefetch:8
                      5⤵
                        PID:5912
                    • C:\Users\Admin\AppData\Local\Temp\service123.exe
                      "C:\Users\Admin\AppData\Local\Temp\service123.exe"
                      4⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      PID:428
                    • C:\Windows\SysWOW64\schtasks.exe
                      "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
                      4⤵
                      • System Location Discovery: System Language Discovery
                      • Scheduled Task/Job: Scheduled Task
                      PID:2180
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 1848
                      4⤵
                      • Program crash
                      PID:4296
                  • C:\Users\Admin\AppData\Local\Temp\1004232001\2ce0b91576.exe
                    "C:\Users\Admin\AppData\Local\Temp\1004232001\2ce0b91576.exe"
                    3⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3584
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 3584 -s 1476
                      4⤵
                      • Program crash
                      PID:916
                  • C:\Users\Admin\AppData\Local\Temp\1004233001\c80d83d60b.exe
                    "C:\Users\Admin\AppData\Local\Temp\1004233001\c80d83d60b.exe"
                    3⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Loads dropped DLL
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    • Checks processor information in registry
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:4352
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
                      4⤵
                      • Uses browser remote debugging
                      • Enumerates system info in registry
                      • Modifies data under HKEY_USERS
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:2476
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc7ab5cc40,0x7ffc7ab5cc4c,0x7ffc7ab5cc58
                        5⤵
                          PID:3372
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1956,i,15503118537873097668,7302636630950906584,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1944 /prefetch:2
                          5⤵
                            PID:4184
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2156,i,15503118537873097668,7302636630950906584,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2204 /prefetch:3
                            5⤵
                              PID:1812
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2272,i,15503118537873097668,7302636630950906584,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2504 /prefetch:8
                              5⤵
                                PID:4120
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3176,i,15503118537873097668,7302636630950906584,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3184 /prefetch:1
                                5⤵
                                • Uses browser remote debugging
                                PID:1816
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3192,i,15503118537873097668,7302636630950906584,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3244 /prefetch:1
                                5⤵
                                • Uses browser remote debugging
                                PID:4348
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4512,i,15503118537873097668,7302636630950906584,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4552 /prefetch:1
                                5⤵
                                • Uses browser remote debugging
                                PID:4320
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4368,i,15503118537873097668,7302636630950906584,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4284 /prefetch:8
                                5⤵
                                  PID:1708
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4776,i,15503118537873097668,7302636630950906584,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3836 /prefetch:8
                                  5⤵
                                    PID:3084
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3836,i,15503118537873097668,7302636630950906584,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4256 /prefetch:8
                                    5⤵
                                      PID:5600
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4972,i,15503118537873097668,7302636630950906584,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4980 /prefetch:8
                                      5⤵
                                        PID:5696
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4256,i,15503118537873097668,7302636630950906584,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4548 /prefetch:8
                                        5⤵
                                          PID:5812
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4264,i,15503118537873097668,7302636630950906584,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4500 /prefetch:8
                                          5⤵
                                            PID:5860
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5252,i,15503118537873097668,7302636630950906584,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5264 /prefetch:8
                                            5⤵
                                              PID:5896
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5244,i,15503118537873097668,7302636630950906584,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5128 /prefetch:8
                                              5⤵
                                                PID:5128
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5364,i,15503118537873097668,7302636630950906584,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5340 /prefetch:2
                                                5⤵
                                                • Uses browser remote debugging
                                                PID:5152
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
                                              4⤵
                                              • Uses browser remote debugging
                                              • Enumerates system info in registry
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                              • Suspicious use of FindShellTrayWindow
                                              PID:6132
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc8b1746f8,0x7ffc8b174708,0x7ffc8b174718
                                                5⤵
                                                • Checks processor information in registry
                                                • Enumerates system info in registry
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:6136
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,6321986008874407,5314149601123815616,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
                                                5⤵
                                                  PID:6016
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,6321986008874407,5314149601123815616,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:3
                                                  5⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4124
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,6321986008874407,5314149601123815616,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
                                                  5⤵
                                                    PID:5976
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2016,6321986008874407,5314149601123815616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
                                                    5⤵
                                                    • Uses browser remote debugging
                                                    PID:5936
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2016,6321986008874407,5314149601123815616,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
                                                    5⤵
                                                    • Uses browser remote debugging
                                                    PID:5868
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2016,6321986008874407,5314149601123815616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
                                                    5⤵
                                                    • Uses browser remote debugging
                                                    PID:2660
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2016,6321986008874407,5314149601123815616,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1
                                                    5⤵
                                                    • Uses browser remote debugging
                                                    PID:6052
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,6321986008874407,5314149601123815616,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
                                                    5⤵
                                                      PID:3236
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,6321986008874407,5314149601123815616,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:2
                                                      5⤵
                                                        PID:5580
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,6321986008874407,5314149601123815616,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2896 /prefetch:2
                                                        5⤵
                                                          PID:5176
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,6321986008874407,5314149601123815616,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2336 /prefetch:2
                                                          5⤵
                                                            PID:2752
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,6321986008874407,5314149601123815616,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3848 /prefetch:2
                                                            5⤵
                                                              PID:5520
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\DocumentsAKJDGIEHCA.exe"
                                                            4⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:5160
                                                            • C:\Users\Admin\DocumentsAKJDGIEHCA.exe
                                                              "C:\Users\Admin\DocumentsAKJDGIEHCA.exe"
                                                              5⤵
                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                              • Checks BIOS information in registry
                                                              • Executes dropped EXE
                                                              • Identifies Wine through registry keys
                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                              • System Location Discovery: System Language Discovery
                                                              PID:4184
                                                        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
                                                          3⤵
                                                            PID:1500
                                                          • C:\Users\Admin\AppData\Local\Temp\1004235001\8ceeaf4dbf.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\1004235001\8ceeaf4dbf.exe"
                                                            3⤵
                                                            • Modifies Windows Defender Real-time Protection settings
                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                            • Checks BIOS information in registry
                                                            • Executes dropped EXE
                                                            • Identifies Wine through registry keys
                                                            • Windows security modification
                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:5428
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3584 -ip 3584
                                                        1⤵
                                                          PID:4192
                                                        • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                          "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                          1⤵
                                                            PID:2608
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                            1⤵
                                                              PID:5592
                                                            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                              C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                              1⤵
                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                              • Checks BIOS information in registry
                                                              • Executes dropped EXE
                                                              • Identifies Wine through registry keys
                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:2472
                                                            • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                              "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                              1⤵
                                                                PID:5844
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2672 -ip 2672
                                                                1⤵
                                                                  PID:2140
                                                                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                  1⤵
                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                  • Checks BIOS information in registry
                                                                  • Executes dropped EXE
                                                                  • Identifies Wine through registry keys
                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                  PID:5312
                                                                • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\/service123.exe
                                                                  1⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  PID:4376

                                                                Network

                                                                MITRE ATT&CK Enterprise v15

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                • C:\ProgramData\chrome.dll

                                                                  Filesize

                                                                  676KB

                                                                  MD5

                                                                  eda18948a989176f4eebb175ce806255

                                                                  SHA1

                                                                  ff22a3d5f5fb705137f233c36622c79eab995897

                                                                  SHA256

                                                                  81a4f37c5495800b7cc46aea6535d9180dadb5c151db6f1fd1968d1cd8c1eeb4

                                                                  SHA512

                                                                  160ed9990c37a4753fc0f5111c94414568654afbedc05308308197df2a99594f2d5d8fe511fd2279543a869ed20248e603d88a0b9b8fb119e8e6131b0c52ff85

                                                                • C:\ProgramData\mozglue.dll

                                                                  Filesize

                                                                  593KB

                                                                  MD5

                                                                  c8fd9be83bc728cc04beffafc2907fe9

                                                                  SHA1

                                                                  95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                  SHA256

                                                                  ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                  SHA512

                                                                  fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                • C:\ProgramData\nss3.dll

                                                                  Filesize

                                                                  2.0MB

                                                                  MD5

                                                                  1cc453cdf74f31e4d913ff9c10acdde2

                                                                  SHA1

                                                                  6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                                  SHA256

                                                                  ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                                  SHA512

                                                                  dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

                                                                  Filesize

                                                                  40B

                                                                  MD5

                                                                  9e930267525529064c3cccf82f7f630d

                                                                  SHA1

                                                                  9cdf349a8e5e2759aeeb73063a414730c40a5341

                                                                  SHA256

                                                                  1cf7df0f74ee0baaaaa32e44c197edec1ae04c2191e86bf52373f2a5a559f1ac

                                                                  SHA512

                                                                  dbc7db60f6d140f08058ba07249cc1d55127896b14663f6a4593f88829867063952d1f0e0dd47533e7e8532aa45e3acc90c117b8dd9497e11212ac1daa703055

                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                                                  Filesize

                                                                  649B

                                                                  MD5

                                                                  67ec7c7e249e4a5f35eeca998bf685c9

                                                                  SHA1

                                                                  8831409660ec4a619ba7d998d8611c3680d9eccb

                                                                  SHA256

                                                                  6a96e8a663166dfae03605f2cbbdd5eeb93026d40ffa8f2b5533ac3f793fb9fb

                                                                  SHA512

                                                                  283fdea1c7edbce667db373de2c5edb82ca7c06bddb7be65d9543a4ee4627cf0037b304138443307e6ac17bf4c752a58d80f2600167d05e6c1fc1e2fb842a9a2

                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0

                                                                  Filesize

                                                                  44KB

                                                                  MD5

                                                                  9624a3456b604e7950bf4ed68c0e8081

                                                                  SHA1

                                                                  4e029bd1acf861592f7e35097aef24a9ba99fd8f

                                                                  SHA256

                                                                  ee82bafe6cfd6c9749ef0c76ac1410ff71498798a6045dc0cdacca10896c765a

                                                                  SHA512

                                                                  acf7d4fdc997d7c9c2fead51437f5c325386a9953a9fb745dd82afcbde08c2e2bda190b34821e9ba2c395e29143e0d455b0b894f87b66014802b44da2a6c510f

                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1

                                                                  Filesize

                                                                  264KB

                                                                  MD5

                                                                  3a0ea8d5c7a7f21c3db83164de70f444

                                                                  SHA1

                                                                  90a82adeb5e144ae83a9cd377907b11f357cee9d

                                                                  SHA256

                                                                  87440cbb22d6b463b34b89da80efb9a97f52724da114c592942af073d3c62451

                                                                  SHA512

                                                                  bd80e4781700846764d3b1b33564d768ed145d2caf00a037bb44dcf73df92e1194765b535bc356d342bfef624ed4b197a94df7df4c6a003b816768ae9b30b3e3

                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2

                                                                  Filesize

                                                                  1.0MB

                                                                  MD5

                                                                  cf217d712c4bf0982f5b4cbae6ddde5a

                                                                  SHA1

                                                                  ea362dc171ac45038fb7771d2182c72d368d93fb

                                                                  SHA256

                                                                  47bae565499a3df35910a66663b3a138ccf93dd55a23f65def59614c3e425467

                                                                  SHA512

                                                                  961f9a710a18919decae3530b1b53b0ca7816712cb9ad4277b00ef49de0066d49003a2696754519fbd577f82f7b05d1c0859e8a5215793c909a9abac4b362442

                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3

                                                                  Filesize

                                                                  4.0MB

                                                                  MD5

                                                                  2b679d135b902981ef00536c2e73206a

                                                                  SHA1

                                                                  63af33d62f236bacf1cb3b98d539bd55a0d2fdeb

                                                                  SHA256

                                                                  74cb24bf7696f9734e3287c027c47019abb88885c48e41ff3d33b8154faa8158

                                                                  SHA512

                                                                  ec7eda9eeeffbfeee29e4060f2cbd1c7c4018951d3544a7aad0fb8fe79c4bec6096642a3a41ee27969a8b9179868898541ff0d18cdaabb82cd01ce98b58dcda9

                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

                                                                  Filesize

                                                                  36KB

                                                                  MD5

                                                                  7dbaa57c49c6e47ba107c0695d56ee3e

                                                                  SHA1

                                                                  90d39465a39a3a1541955e33ae82f8198f55035a

                                                                  SHA256

                                                                  0dead0d639a7821e703605afc4be1adde5dedd05d41593bfc9edd0ea6928cfb3

                                                                  SHA512

                                                                  d6a9c3f6d3ff60ebb9d31950a1f560ed1651025eff2cfbf18d25015db7e39a04da469fc43cf57db020135d9a57bec6e54c1bd77fb80b7a85e08f6eb3e016c40d

                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

                                                                  Filesize

                                                                  62KB

                                                                  MD5

                                                                  e5fc91cbce096df1d36191f9eedd3c64

                                                                  SHA1

                                                                  1a8076bf524b6d2b8a44c18fa8afb199a60dc1c9

                                                                  SHA256

                                                                  0e111dba5797ec182bf4af537a2c928ebd3957b99ed291610fbf322d6c2c9e19

                                                                  SHA512

                                                                  c9b064fbcb2df48dcf5bfa4387c164acb2bae075af013e6c39166dddc7e91ce993caaa0fdfac3ba1c3a12ca6c21577d99776fb1445f3009c7359b926a173f668

                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

                                                                  Filesize

                                                                  38KB

                                                                  MD5

                                                                  d4586933fabd5754ef925c6e940472f4

                                                                  SHA1

                                                                  a77f36a596ef86e1ad10444b2679e1531995b553

                                                                  SHA256

                                                                  6e1c3edffec71a01e11e30aa359952213ac2f297c5014f36027f308a18df75d2

                                                                  SHA512

                                                                  6ce33a8da7730035fb6b67ed59f32029c3a94b0a5d7dc5aa58c9583820bb01ef59dd55c1c142f392e02da86c8699b2294aff2d7c0e4c3a59fce5f792c749c5ce

                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\_locales\en_CA\messages.json

                                                                  Filesize

                                                                  851B

                                                                  MD5

                                                                  07ffbe5f24ca348723ff8c6c488abfb8

                                                                  SHA1

                                                                  6dc2851e39b2ee38f88cf5c35a90171dbea5b690

                                                                  SHA256

                                                                  6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

                                                                  SHA512

                                                                  7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\dasherSettingSchema.json

                                                                  Filesize

                                                                  854B

                                                                  MD5

                                                                  4ec1df2da46182103d2ffc3b92d20ca5

                                                                  SHA1

                                                                  fb9d1ba3710cf31a87165317c6edc110e98994ce

                                                                  SHA256

                                                                  6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

                                                                  SHA512

                                                                  939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                                  Filesize

                                                                  2B

                                                                  MD5

                                                                  d751713988987e9331980363e24189ce

                                                                  SHA1

                                                                  97d170e1550eee4afc0af065b78cda302a97674c

                                                                  SHA256

                                                                  4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                  SHA512

                                                                  b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                  Filesize

                                                                  9KB

                                                                  MD5

                                                                  e8eab40f3ad92dc9b7b56fd16cf90d13

                                                                  SHA1

                                                                  50607fce2e86b4428c57b2e06a8313697df4618c

                                                                  SHA256

                                                                  3da75a31965ec2b26afafa787d26e5f7fc03d2909724ef091d3e584842a6f99c

                                                                  SHA512

                                                                  bc14398216cb4d1518f914b8bafe231248e3e89e03f323a66e986ba2023f079e330e8137ac8b0b3ab2364625cd732e34b6de942041d19894723ea26d063ab501

                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log

                                                                  Filesize

                                                                  3KB

                                                                  MD5

                                                                  f2e2b727a93ee36217d67fe76a23935e

                                                                  SHA1

                                                                  7c6c723d92526c448ccf3afb2ef2b9285ae892cc

                                                                  SHA256

                                                                  c56306f6b99e1ab966cbaf43be7394d35dee02e5dc14e87cb9abb482a794827d

                                                                  SHA512

                                                                  663a9658b6fc5d81dd1cd5d77327999c1326c12967a3fc54a4e4cb9a115e88844169fafc67e87b9fe4cb139467f4e9f69aa1c33818461ef6c8c5d26daad26272

                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG

                                                                  Filesize

                                                                  333B

                                                                  MD5

                                                                  4b73030f13c352d5a0a9d61124a6ac82

                                                                  SHA1

                                                                  47c56a92a651d29bd476976aff81c55a27652eb3

                                                                  SHA256

                                                                  b87df4e4fd1c83275488dd9f89741371686437b7a4d001217bd88283fb7e45b4

                                                                  SHA512

                                                                  217586b9aa9a8cfff91cc8169c76be96f8fb82e9f728f7249846c30bb881584f8da916d4fa06212dafb291d9f5516248f1a5a9cb1b6c66fdf3a026ba1141141d

                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG

                                                                  Filesize

                                                                  321B

                                                                  MD5

                                                                  252a9fa1cba8fab6827a78665f76e12e

                                                                  SHA1

                                                                  f976f3e7661167357bc825590edba6e08581879d

                                                                  SHA256

                                                                  27d6ba5c5a576ac6c7aea481d52b45bed3c90afe833037794cb768c8c2b74886

                                                                  SHA512

                                                                  a77bcd00a0dc4feb6e612b33bb41f9f79172a9401daa9b095cb8fc20e5df5779e7cf9a609be75e0a5985bef69bd738e4402e249598b37396bf756fe4f29944df

                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

                                                                  Filesize

                                                                  14B

                                                                  MD5

                                                                  ef48733031b712ca7027624fff3ab208

                                                                  SHA1

                                                                  da4f3812e6afc4b90d2185f4709dfbb6b47714fa

                                                                  SHA256

                                                                  c9ce8dbbe51a4131073db3d6ceef1e11eaca6308ad88a86125f221102d2cee99

                                                                  SHA512

                                                                  ce3a5a429e3796977a8019f47806b8c0671b597ead642fcbfbe3144e2b8112d35a9f2250896b7f215d237d0d19c5966caf3fe674165a6d50e14cb2b88c892029

                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                  Filesize

                                                                  230KB

                                                                  MD5

                                                                  21d44a6c8072395696f08be6cc97d084

                                                                  SHA1

                                                                  7ce0d05eb4381eacfe347c98a70068e39f7c7369

                                                                  SHA256

                                                                  6e5c78f3f3d725432ed8bb3ba8883272fc43e4b46cd774bea05a6e8abd4badf1

                                                                  SHA512

                                                                  030207fc2bdaf16ccd06efcdf8a5516f36b1913bea22748409b037b6d73589be326807d37aec60d08586c380adc04cef774817e614aac77cd02520c9d8a70673

                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

                                                                  Filesize

                                                                  86B

                                                                  MD5

                                                                  f732dbed9289177d15e236d0f8f2ddd3

                                                                  SHA1

                                                                  53f822af51b014bc3d4b575865d9c3ef0e4debde

                                                                  SHA256

                                                                  2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93

                                                                  SHA512

                                                                  b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

                                                                  Filesize

                                                                  150B

                                                                  MD5

                                                                  1b3b2286963df4455e7f5dcc6a5c55af

                                                                  SHA1

                                                                  fd567cc314754a3d4784c639d8f097a468e397c7

                                                                  SHA256

                                                                  8b67e5a617cb2087f39837eb2a6ae3844db1522fd59506a8087ec223330b780d

                                                                  SHA512

                                                                  1c4d05401fae45e561624f790310be7c9fadc623bf542522b3f59d08999aff924ca6f5d9e131d9c6920467a4021f709d93ed977a20c7cf2015d07836a3b1d5a8

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

                                                                  Filesize

                                                                  284B

                                                                  MD5

                                                                  75c455785f649245f602e57f0e6caa38

                                                                  SHA1

                                                                  525b7f2e60b7f7b89a86b0e3c7192fba891a1336

                                                                  SHA256

                                                                  b91531d4de676d732f121350df14fa8e9ccd2dc22f47b677f4f9b6a9c0f0b0c5

                                                                  SHA512

                                                                  9095ccbb7034e5e35d3b17616c9fb618a1b72440f59d334c7855a0056ea1eb451ff4bc26931622bd2c836fd7fc7a05d68063085b87c77d9c5c4b1daf15061b4e

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\2a44255c-90ed-4064-8e79-e06a20eaab96.dmp

                                                                  Filesize

                                                                  838KB

                                                                  MD5

                                                                  33c5fd233647bf2784aabfec37c39ca5

                                                                  SHA1

                                                                  9488d7596b6f9ba7ed906e2d32cef11b028e0ee6

                                                                  SHA256

                                                                  5af6605ea93d5545ea856fce918e453f9969a5a4c288b34b83d72e754ca09abf

                                                                  SHA512

                                                                  58a100c2062c9b6fa8db1752b02734859a1e8bb01bd64336eaf4819d3d4a5301be56f51249c19250d907f8f0449a930ab364de0f23d8c70d07f6ef9f1d493201

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\594abbe2-0d96-416b-9c83-2352bacb0359.dmp

                                                                  Filesize

                                                                  830KB

                                                                  MD5

                                                                  8d9801f7db84f75afe69220fb15e645d

                                                                  SHA1

                                                                  4fc048a15f3eee7f5b641cf152192e06e86d2d1f

                                                                  SHA256

                                                                  806f81e34cb478243ac0c16feeb8afbfb89f9a590c438bff273bfae31922ac5f

                                                                  SHA512

                                                                  57db26e4e456bdd52e1c5bfc118907bd5cb624910c1a2f700f47ea42d6aba70cc2fb1fae202a5b8246281871ee5bbe23dfa463c8622b2a15cbc03493771d33d5

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\7543df3a-3c8a-49df-8042-a1c9374c19d4.dmp

                                                                  Filesize

                                                                  838KB

                                                                  MD5

                                                                  14dcab42cd76a43a08aa38e75b13277b

                                                                  SHA1

                                                                  a1bcbd764be4921757d7d33fefe6e51d698f5d74

                                                                  SHA256

                                                                  29a9ae3c3406fc1b61b4f160195253f7173a2c33badba14148b0d0663e126d0b

                                                                  SHA512

                                                                  940e3897eca55ba65d634de26e032010527039f1b86cc0ef5d24fc446b63129e1de55be71cb26d57b18194d146de8676ed5fe1ea24065a21e4e236830812a829

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\c9896ce9-7ce8-4a3d-9ee3-aa50b7260c92.dmp

                                                                  Filesize

                                                                  834KB

                                                                  MD5

                                                                  e8e660a74091daabf52bf2e7ba4d9132

                                                                  SHA1

                                                                  20da9207f623c89c3c4499e2ef4a605bae6876e8

                                                                  SHA256

                                                                  f3e899ef53090f1ba2914486bb7d5382c485b377b11a65ecab1789bcaabf2fcb

                                                                  SHA512

                                                                  fc0ed29d03bc400293695bf3447288056ed395c8db5121cb44ce009899315d41c69a1e4bfc017377295c82cf2e679ac1212a58840d7243f40b3331c2f21f36d3

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\cc59e169-69b2-4349-8fc5-1c2f2d5911fb.dmp

                                                                  Filesize

                                                                  830KB

                                                                  MD5

                                                                  89ae39564574c41c261412634565be77

                                                                  SHA1

                                                                  3675b13905602f56d63ec39d40fdb0596d426642

                                                                  SHA256

                                                                  2098c6b7f270838340d237edb300b7005f07d4086bdc9cf7674a340e46a865b8

                                                                  SHA512

                                                                  66c90cbe5f11706456ddea4b2fb588e653c85cb3bf78fd8e535007aab8334787f791e63646cf69751f9d6615ed165b903f6020004a4c824d57fafb2deec75c7c

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                  Filesize

                                                                  152B

                                                                  MD5

                                                                  d22073dea53e79d9b824f27ac5e9813e

                                                                  SHA1

                                                                  6d8a7281241248431a1571e6ddc55798b01fa961

                                                                  SHA256

                                                                  86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

                                                                  SHA512

                                                                  97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                  Filesize

                                                                  152B

                                                                  MD5

                                                                  bffcefacce25cd03f3d5c9446ddb903d

                                                                  SHA1

                                                                  8923f84aa86db316d2f5c122fe3874bbe26f3bab

                                                                  SHA256

                                                                  23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

                                                                  SHA512

                                                                  761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                  Filesize

                                                                  152B

                                                                  MD5

                                                                  4f6d9a114adbd4c56008b3f8f9c243d6

                                                                  SHA1

                                                                  cbb675780aba0bba1e0ed1bbca88ea4d7126a458

                                                                  SHA256

                                                                  e2fe59ba849bfb4f4ad3fe7cdba1c3c4847a40df20a66c2c1fdf1cd1513ec2d1

                                                                  SHA512

                                                                  4a0a0950cf5cafec50651dbf098dfb44131d7b3a66a0c8eeb8b99a7f26ea1b3d3db99a5d4e76fc4bd0cbff6f07d4697cc1e9bec04aeceb042db3a34035cf3d92

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                  Filesize

                                                                  152B

                                                                  MD5

                                                                  6b8bd827a04c5b1e092877e633cb3d61

                                                                  SHA1

                                                                  d139610bbe7d06ad736bf9359ec0cec36c91d7c9

                                                                  SHA256

                                                                  2456c702f4d424eebb268d1a98c593f66523693465ca3a30383ebadf31ad5d20

                                                                  SHA512

                                                                  900c6e04bc8c5e41302931ecc21d04ee470caa09d2c9b37686c1059879051fd4068fccab54df9b65a92ae161968bfbb2623cd018b0f323a5ec46abe7b18a607f

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                  Filesize

                                                                  5KB

                                                                  MD5

                                                                  240b135c38de8d550e67f904e7b82eb9

                                                                  SHA1

                                                                  b8c9d51f1f76bda52d5cd7af68ba50cf1a89d75a

                                                                  SHA256

                                                                  3fe2f96a6fac714af5cd1b6fbf540a3c197c8fba9457b61adf8e2aa603591c11

                                                                  SHA512

                                                                  5911b487c9e61232cc817fb4ed7d7a1587e0e3e483091f41480c7c0aaacf851ad3585b338ad49aea158f7204d0f336692768ac1d1c70e58787367157788f7b9e

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f8282da6-5e13-4952-b25d-4b4b19e6e9fe.tmp

                                                                  Filesize

                                                                  1B

                                                                  MD5

                                                                  5058f1af8388633f609cadb75a75dc9d

                                                                  SHA1

                                                                  3a52ce780950d4d969792a2559cd519d7ee8c727

                                                                  SHA256

                                                                  cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                                                  SHA512

                                                                  0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

                                                                  Filesize

                                                                  264KB

                                                                  MD5

                                                                  f50f89a0a91564d0b8a211f8921aa7de

                                                                  SHA1

                                                                  112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                                  SHA256

                                                                  b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                                  SHA512

                                                                  bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                                • C:\Users\Admin\AppData\Local\Temp\1004149001\freecam.exe

                                                                  Filesize

                                                                  12.9MB

                                                                  MD5

                                                                  704d12a2e64a9b3ebe375594a11f3ee6

                                                                  SHA1

                                                                  e6e45cd1926de46bfa0832de19ddeb29c8c0f629

                                                                  SHA256

                                                                  b5975c9eb7e34161ae63eab8518b130d4fdcc1526ca512d2e5452c6d701fe912

                                                                  SHA512

                                                                  b72689628014a48976672427d0470d8e024dac4d3b266bc9398a8dadd72f1b4d4dc1a4429847a45956ae604cf072cf5419cf3036a4e6d5373517db38a9d3ffb4

                                                                • C:\Users\Admin\AppData\Local\Temp\1004211001\Set-up.exe

                                                                  Filesize

                                                                  4.2MB

                                                                  MD5

                                                                  e61852d0a596d91897c3e731f18b4ae7

                                                                  SHA1

                                                                  fa10a42495e023ae6cbd464842352cccf0d0ee28

                                                                  SHA256

                                                                  16606d62af0e28e4c9359802f1e9f329eae01edee0b31b8b84b0fbc51818a129

                                                                  SHA512

                                                                  c47dc92cd52c0efec3c993812965ad74a710ce8600f069d6d7d18c04e777682a2c77881a61443f9f4c425c79627ab6d06db0461f0622d1f0c6414eca2215a310

                                                                • C:\Users\Admin\AppData\Local\Temp\1004232001\2ce0b91576.exe

                                                                  Filesize

                                                                  3.0MB

                                                                  MD5

                                                                  4ac1e252c1765c62a40fa7b7be66983b

                                                                  SHA1

                                                                  a5e1fd72c8dbe6a1e05f64093aaa1bd7d3639c95

                                                                  SHA256

                                                                  516da3eed4c8dafd588727f02920aca4b47f2318e378a7f0130a419e9f74b6b3

                                                                  SHA512

                                                                  cd3639602a573678fbc9757336c6ebcf903c180312fa19b1ad3f4e76a5d90eb9fffc6902699620d479094f920dbe637f6d4ef8fddf653952910093fc2d7b3a36

                                                                • C:\Users\Admin\AppData\Local\Temp\1004233001\c80d83d60b.exe

                                                                  Filesize

                                                                  2.0MB

                                                                  MD5

                                                                  528a74ec51b95f19a5d1b00df07bc6cc

                                                                  SHA1

                                                                  a4f8523d03455ddea5acaacbc509338038600081

                                                                  SHA256

                                                                  84d88a7533316a280ea2a732b8949bc70a5a30875fbeb524e4eed526db83b97d

                                                                  SHA512

                                                                  8c990976aade9a4f80d55a3923f5b6b4cd331a8ab570c9f8666823599af42317841587db7799f72d59e0aee1b38fb0cd6571d0d54aa021cb1e06d5bfcf7c497f

                                                                • C:\Users\Admin\AppData\Local\Temp\1004235001\8ceeaf4dbf.exe

                                                                  Filesize

                                                                  2.6MB

                                                                  MD5

                                                                  ae6af6ca15feec9a0d65f7ea6369adee

                                                                  SHA1

                                                                  f3102944f0dfce4dbebdc17a2a8abeb2990299c6

                                                                  SHA256

                                                                  7d2da9cbbba1df44a3744d1c939c312b1a3be5032e7ee9c23a70ce6df0590d33

                                                                  SHA512

                                                                  edd392c5dd211fd227005e822c809e95a0dfc59cf3a5a9bd115a106873c80b340af776b1b4ba6001b66abd497537d87ba13a42b232962f2ce5a626a24d261d6e

                                                                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

                                                                  Filesize

                                                                  3.1MB

                                                                  MD5

                                                                  df3fc9d0e3234bec4a4a21004056d0e3

                                                                  SHA1

                                                                  3a689c14f50b7569fd3452e640c53cd9b7c173b2

                                                                  SHA256

                                                                  72e18d1f94925f558f47baf67848e00775a07622df025ebce3c1264296d6d44e

                                                                  SHA512

                                                                  4190a7991d8f1ac68eb19ccd53ecbb0fe39fcb9b0c590aebecf5fc8c879b47bef639cf7882d9a120209bc60ef649c77a36289a84a3830b03243dc722670b9121

                                                                • C:\Users\Admin\AppData\Local\Temp\scoped_dir2476_64315830\57188a7c-1ba3-4d5c-8374-27733cf03910.tmp

                                                                  Filesize

                                                                  132KB

                                                                  MD5

                                                                  da75bb05d10acc967eecaac040d3d733

                                                                  SHA1

                                                                  95c08e067df713af8992db113f7e9aec84f17181

                                                                  SHA256

                                                                  33ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2

                                                                  SHA512

                                                                  56533de53872f023809a20d1ea8532cdc2260d40b05c5a7012c8e61576ff092f006a197f759c92c6b8c429eeec4bb542073b491ddcfd5b22cd4ecbe1a8a7c6ef

                                                                • C:\Users\Admin\AppData\Local\Temp\scoped_dir2476_64315830\CRX_INSTALL\_locales\en_CA\messages.json

                                                                  Filesize

                                                                  711B

                                                                  MD5

                                                                  558659936250e03cc14b60ebf648aa09

                                                                  SHA1

                                                                  32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

                                                                  SHA256

                                                                  2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

                                                                  SHA512

                                                                  1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

                                                                • memory/428-969-0x00000000006D0000-0x00000000006E2000-memory.dmp

                                                                  Filesize

                                                                  72KB

                                                                • memory/428-970-0x0000000073500000-0x0000000073634000-memory.dmp

                                                                  Filesize

                                                                  1.2MB

                                                                • memory/2472-656-0x0000000000D00000-0x0000000001025000-memory.dmp

                                                                  Filesize

                                                                  3.1MB

                                                                • memory/2472-694-0x0000000000D00000-0x0000000001025000-memory.dmp

                                                                  Filesize

                                                                  3.1MB

                                                                • memory/2672-62-0x0000000000D20000-0x000000000190C000-memory.dmp

                                                                  Filesize

                                                                  11.9MB

                                                                • memory/2672-897-0x0000000000D20000-0x000000000190C000-memory.dmp

                                                                  Filesize

                                                                  11.9MB

                                                                • memory/2672-957-0x0000000000D20000-0x000000000190C000-memory.dmp

                                                                  Filesize

                                                                  11.9MB

                                                                • memory/2672-88-0x0000000000D20000-0x000000000190C000-memory.dmp

                                                                  Filesize

                                                                  11.9MB

                                                                • memory/2672-882-0x0000000000D20000-0x000000000190C000-memory.dmp

                                                                  Filesize

                                                                  11.9MB

                                                                • memory/2672-967-0x0000000000D20000-0x000000000190C000-memory.dmp

                                                                  Filesize

                                                                  11.9MB

                                                                • memory/2672-623-0x0000000000D20000-0x000000000190C000-memory.dmp

                                                                  Filesize

                                                                  11.9MB

                                                                • memory/2672-887-0x0000000069CC0000-0x000000006A71B000-memory.dmp

                                                                  Filesize

                                                                  10.4MB

                                                                • memory/2672-97-0x0000000000D20000-0x000000000190C000-memory.dmp

                                                                  Filesize

                                                                  11.9MB

                                                                • memory/2672-960-0x0000000000D20000-0x000000000190C000-memory.dmp

                                                                  Filesize

                                                                  11.9MB

                                                                • memory/2672-565-0x0000000000D20000-0x000000000190C000-memory.dmp

                                                                  Filesize

                                                                  11.9MB

                                                                • memory/3584-99-0x0000000000DA0000-0x00000000010A9000-memory.dmp

                                                                  Filesize

                                                                  3.0MB

                                                                • memory/3584-78-0x0000000000DA0000-0x00000000010A9000-memory.dmp

                                                                  Filesize

                                                                  3.0MB

                                                                • memory/4000-19-0x0000000000D00000-0x0000000001025000-memory.dmp

                                                                  Filesize

                                                                  3.1MB

                                                                • memory/4000-971-0x0000000000D00000-0x0000000001025000-memory.dmp

                                                                  Filesize

                                                                  3.1MB

                                                                • memory/4000-984-0x0000000000D00000-0x0000000001025000-memory.dmp

                                                                  Filesize

                                                                  3.1MB

                                                                • memory/4000-956-0x0000000000D00000-0x0000000001025000-memory.dmp

                                                                  Filesize

                                                                  3.1MB

                                                                • memory/4000-959-0x0000000000D00000-0x0000000001025000-memory.dmp

                                                                  Filesize

                                                                  3.1MB

                                                                • memory/4000-558-0x0000000000D00000-0x0000000001025000-memory.dmp

                                                                  Filesize

                                                                  3.1MB

                                                                • memory/4000-981-0x0000000000D00000-0x0000000001025000-memory.dmp

                                                                  Filesize

                                                                  3.1MB

                                                                • memory/4000-978-0x0000000000D00000-0x0000000001025000-memory.dmp

                                                                  Filesize

                                                                  3.1MB

                                                                • memory/4000-968-0x0000000000D00000-0x0000000001025000-memory.dmp

                                                                  Filesize

                                                                  3.1MB

                                                                • memory/4000-874-0x0000000000D00000-0x0000000001025000-memory.dmp

                                                                  Filesize

                                                                  3.1MB

                                                                • memory/4000-21-0x0000000000D00000-0x0000000001025000-memory.dmp

                                                                  Filesize

                                                                  3.1MB

                                                                • memory/4000-20-0x0000000000D01000-0x0000000000D69000-memory.dmp

                                                                  Filesize

                                                                  416KB

                                                                • memory/4000-22-0x0000000000D00000-0x0000000001025000-memory.dmp

                                                                  Filesize

                                                                  3.1MB

                                                                • memory/4000-23-0x0000000000D00000-0x0000000001025000-memory.dmp

                                                                  Filesize

                                                                  3.1MB

                                                                • memory/4000-24-0x0000000000D00000-0x0000000001025000-memory.dmp

                                                                  Filesize

                                                                  3.1MB

                                                                • memory/4000-25-0x0000000000D00000-0x0000000001025000-memory.dmp

                                                                  Filesize

                                                                  3.1MB

                                                                • memory/4000-896-0x0000000000D00000-0x0000000001025000-memory.dmp

                                                                  Filesize

                                                                  3.1MB

                                                                • memory/4000-26-0x0000000000D01000-0x0000000000D69000-memory.dmp

                                                                  Filesize

                                                                  416KB

                                                                • memory/4000-79-0x0000000000D00000-0x0000000001025000-memory.dmp

                                                                  Filesize

                                                                  3.1MB

                                                                • memory/4000-621-0x0000000000D00000-0x0000000001025000-memory.dmp

                                                                  Filesize

                                                                  3.1MB

                                                                • memory/4000-46-0x0000000000D00000-0x0000000001025000-memory.dmp

                                                                  Filesize

                                                                  3.1MB

                                                                • memory/4000-27-0x0000000000D00000-0x0000000001025000-memory.dmp

                                                                  Filesize

                                                                  3.1MB

                                                                • memory/4184-886-0x00000000007A0000-0x0000000000AC5000-memory.dmp

                                                                  Filesize

                                                                  3.1MB

                                                                • memory/4184-883-0x00000000007A0000-0x0000000000AC5000-memory.dmp

                                                                  Filesize

                                                                  3.1MB

                                                                • memory/4352-624-0x0000000000EE0000-0x0000000001609000-memory.dmp

                                                                  Filesize

                                                                  7.2MB

                                                                • memory/4352-96-0x0000000000EE0000-0x0000000001609000-memory.dmp

                                                                  Filesize

                                                                  7.2MB

                                                                • memory/4352-884-0x0000000000EE0000-0x0000000001609000-memory.dmp

                                                                  Filesize

                                                                  7.2MB

                                                                • memory/4352-101-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                  Filesize

                                                                  972KB

                                                                • memory/4352-878-0x0000000000EE0000-0x0000000001609000-memory.dmp

                                                                  Filesize

                                                                  7.2MB

                                                                • memory/4352-559-0x0000000000EE0000-0x0000000001609000-memory.dmp

                                                                  Filesize

                                                                  7.2MB

                                                                • memory/4352-566-0x0000000000EE0000-0x0000000001609000-memory.dmp

                                                                  Filesize

                                                                  7.2MB

                                                                • memory/4376-975-0x00000000006D0000-0x00000000006E2000-memory.dmp

                                                                  Filesize

                                                                  72KB

                                                                • memory/4776-0-0x0000000000620000-0x0000000000945000-memory.dmp

                                                                  Filesize

                                                                  3.1MB

                                                                • memory/4776-4-0x0000000000620000-0x0000000000945000-memory.dmp

                                                                  Filesize

                                                                  3.1MB

                                                                • memory/4776-3-0x0000000000620000-0x0000000000945000-memory.dmp

                                                                  Filesize

                                                                  3.1MB

                                                                • memory/4776-17-0x0000000000620000-0x0000000000945000-memory.dmp

                                                                  Filesize

                                                                  3.1MB

                                                                • memory/4776-2-0x0000000000621000-0x0000000000689000-memory.dmp

                                                                  Filesize

                                                                  416KB

                                                                • memory/4776-1-0x0000000077324000-0x0000000077326000-memory.dmp

                                                                  Filesize

                                                                  8KB

                                                                • memory/4776-18-0x0000000000621000-0x0000000000689000-memory.dmp

                                                                  Filesize

                                                                  416KB

                                                                • memory/5312-974-0x0000000000D00000-0x0000000001025000-memory.dmp

                                                                  Filesize

                                                                  3.1MB

                                                                • memory/5312-972-0x0000000000D00000-0x0000000001025000-memory.dmp

                                                                  Filesize

                                                                  3.1MB

                                                                • memory/5428-615-0x0000000000870000-0x0000000000B14000-memory.dmp

                                                                  Filesize

                                                                  2.6MB

                                                                • memory/5428-167-0x0000000000870000-0x0000000000B14000-memory.dmp

                                                                  Filesize

                                                                  2.6MB

                                                                • memory/5428-168-0x0000000000870000-0x0000000000B14000-memory.dmp

                                                                  Filesize

                                                                  2.6MB

                                                                • memory/5428-169-0x0000000000870000-0x0000000000B14000-memory.dmp

                                                                  Filesize

                                                                  2.6MB

                                                                • memory/5428-612-0x0000000000870000-0x0000000000B14000-memory.dmp

                                                                  Filesize

                                                                  2.6MB