Analysis

  • max time kernel
    144s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-11-2024 16:49

General

  • Target

    c20ec8351da86707453bb3db6412d84f89ecc59008a9437b831a4ed6e78a15c2.exe

  • Size

    3.1MB

  • MD5

    9c45fce44a67d603745df0cecd5d3068

  • SHA1

    fc048570fbc9025258426c62abc50024ad254332

  • SHA256

    c20ec8351da86707453bb3db6412d84f89ecc59008a9437b831a4ed6e78a15c2

  • SHA512

    51d9cb3b1d6b916680e03047da369c867b936a47e06dfb925923950630f249f4a0d229d084116a7a645c8be1921696cad0e17719165c1f3f8016c3810284c974

  • SSDEEP

    98304:dxXkmmTg9/pwXqTJCfKAjnUsd3dXBfRY5Py2G:3L2jnVtJR0y2

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 10 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Identifies Wine through registry keys 2 TTPs 9 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 11 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 57 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c20ec8351da86707453bb3db6412d84f89ecc59008a9437b831a4ed6e78a15c2.exe
    "C:\Users\Admin\AppData\Local\Temp\c20ec8351da86707453bb3db6412d84f89ecc59008a9437b831a4ed6e78a15c2.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4444
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4580
      • C:\Users\Admin\AppData\Local\Temp\1006010001\2cfa22db1f.exe
        "C:\Users\Admin\AppData\Local\Temp\1006010001\2cfa22db1f.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3228
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2cfa22db1f.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
          4⤵
            PID:5788
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe9b046f8,0x7ffbe9b04708,0x7ffbe9b04718
              5⤵
                PID:5804
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,1306554135702292221,9916106995899980945,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
                5⤵
                  PID:6488
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,1306554135702292221,9916106995899980945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1816 /prefetch:3
                  5⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:6504
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2cfa22db1f.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
                4⤵
                • Enumerates system info in registry
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:516
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe9b046f8,0x7ffbe9b04708,0x7ffbe9b04718
                  5⤵
                    PID:7032
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,4772954215662250528,11123268695890135,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
                    5⤵
                      PID:3140
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,4772954215662250528,11123268695890135,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 /prefetch:3
                      5⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4008
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,4772954215662250528,11123268695890135,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
                      5⤵
                        PID:4904
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4772954215662250528,11123268695890135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
                        5⤵
                          PID:216
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4772954215662250528,11123268695890135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
                          5⤵
                            PID:5092
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4772954215662250528,11123268695890135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
                            5⤵
                              PID:5224
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,4772954215662250528,11123268695890135,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
                              5⤵
                                PID:5796
                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,4772954215662250528,11123268695890135,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
                                5⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4596
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4772954215662250528,11123268695890135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
                                5⤵
                                  PID:5512
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4772954215662250528,11123268695890135,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
                                  5⤵
                                    PID:5432
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4772954215662250528,11123268695890135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
                                    5⤵
                                      PID:5172
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4772954215662250528,11123268695890135,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
                                      5⤵
                                        PID:5420
                                  • C:\Users\Admin\AppData\Local\Temp\1006011001\0e1a1bbce9.exe
                                    "C:\Users\Admin\AppData\Local\Temp\1006011001\0e1a1bbce9.exe"
                                    3⤵
                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                    • Checks BIOS information in registry
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Identifies Wine through registry keys
                                    • Loads dropped DLL
                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                    • System Location Discovery: System Language Discovery
                                    • Checks processor information in registry
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:4492
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
                                      4⤵
                                      • Uses browser remote debugging
                                      • Enumerates system info in registry
                                      • Modifies data under HKEY_USERS
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of WriteProcessMemory
                                      PID:668
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbe8a7cc40,0x7ffbe8a7cc4c,0x7ffbe8a7cc58
                                        5⤵
                                          PID:2840
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1916,i,185149953544435997,11035821114580780244,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1912 /prefetch:2
                                          5⤵
                                            PID:4868
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2060,i,185149953544435997,11035821114580780244,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2108 /prefetch:3
                                            5⤵
                                              PID:3404
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2264,i,185149953544435997,11035821114580780244,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2488 /prefetch:8
                                              5⤵
                                                PID:3164
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3188,i,185149953544435997,11035821114580780244,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3208 /prefetch:1
                                                5⤵
                                                • Uses browser remote debugging
                                                PID:2868
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3204,i,185149953544435997,11035821114580780244,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3332 /prefetch:1
                                                5⤵
                                                • Uses browser remote debugging
                                                PID:1776
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4424,i,185149953544435997,11035821114580780244,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4512 /prefetch:1
                                                5⤵
                                                • Uses browser remote debugging
                                                PID:4076
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4608,i,185149953544435997,11035821114580780244,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4616 /prefetch:8
                                                5⤵
                                                  PID:4828
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4888,i,185149953544435997,11035821114580780244,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4900 /prefetch:8
                                                  5⤵
                                                    PID:2028
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5168,i,185149953544435997,11035821114580780244,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4920 /prefetch:8
                                                    5⤵
                                                      PID:5340
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4896,i,185149953544435997,11035821114580780244,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4904 /prefetch:8
                                                      5⤵
                                                        PID:5408
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5288,i,185149953544435997,11035821114580780244,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4816 /prefetch:8
                                                        5⤵
                                                          PID:5444
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5344,i,185149953544435997,11035821114580780244,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5352 /prefetch:8
                                                          5⤵
                                                            PID:5812
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4200,i,185149953544435997,11035821114580780244,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4728 /prefetch:2
                                                            5⤵
                                                            • Uses browser remote debugging
                                                            PID:5564
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
                                                          4⤵
                                                          • Uses browser remote debugging
                                                          • Enumerates system info in registry
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                          • Suspicious use of FindShellTrayWindow
                                                          PID:5960
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe9b046f8,0x7ffbe9b04708,0x7ffbe9b04718
                                                            5⤵
                                                            • Checks processor information in registry
                                                            • Enumerates system info in registry
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:5976
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,114166917306186821,12249755852657628652,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:2
                                                            5⤵
                                                              PID:988
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,114166917306186821,12249755852657628652,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 /prefetch:3
                                                              5⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:2028
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,114166917306186821,12249755852657628652,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
                                                              5⤵
                                                                PID:5168
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2040,114166917306186821,12249755852657628652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
                                                                5⤵
                                                                • Uses browser remote debugging
                                                                PID:5824
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2040,114166917306186821,12249755852657628652,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
                                                                5⤵
                                                                • Uses browser remote debugging
                                                                PID:5844
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2040,114166917306186821,12249755852657628652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
                                                                5⤵
                                                                • Uses browser remote debugging
                                                                PID:6308
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2040,114166917306186821,12249755852657628652,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
                                                                5⤵
                                                                • Uses browser remote debugging
                                                                PID:6320
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\DocumentsHCGCBFHCFC.exe"
                                                              4⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:6520
                                                              • C:\Users\Admin\DocumentsHCGCBFHCFC.exe
                                                                "C:\Users\Admin\DocumentsHCGCBFHCFC.exe"
                                                                5⤵
                                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                • Checks BIOS information in registry
                                                                • Executes dropped EXE
                                                                • Identifies Wine through registry keys
                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:6584
                                                          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
                                                            3⤵
                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                            • Checks BIOS information in registry
                                                            • Executes dropped EXE
                                                            • Identifies Wine through registry keys
                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:3620
                                                          • C:\Users\Admin\AppData\Local\Temp\1006013001\fb8b3fc71d.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\1006013001\fb8b3fc71d.exe"
                                                            3⤵
                                                            • Modifies Windows Defender Real-time Protection settings
                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                            • Checks BIOS information in registry
                                                            • Executes dropped EXE
                                                            • Identifies Wine through registry keys
                                                            • Windows security modification
                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:6632
                                                      • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                        1⤵
                                                          PID:4272
                                                        • C:\Windows\system32\svchost.exe
                                                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                          1⤵
                                                            PID:1428
                                                          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                            C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                            1⤵
                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                            • Checks BIOS information in registry
                                                            • Executes dropped EXE
                                                            • Identifies Wine through registry keys
                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:7036
                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                            1⤵
                                                              PID:844
                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                              1⤵
                                                                PID:1632
                                                              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                1⤵
                                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                • Checks BIOS information in registry
                                                                • Executes dropped EXE
                                                                • Identifies Wine through registry keys
                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:836

                                                              Network

                                                              MITRE ATT&CK Enterprise v15

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              • C:\ProgramData\mozglue.dll

                                                                Filesize

                                                                593KB

                                                                MD5

                                                                c8fd9be83bc728cc04beffafc2907fe9

                                                                SHA1

                                                                95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                SHA256

                                                                ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                SHA512

                                                                fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                              • C:\ProgramData\nss3.dll

                                                                Filesize

                                                                2.0MB

                                                                MD5

                                                                1cc453cdf74f31e4d913ff9c10acdde2

                                                                SHA1

                                                                6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                                SHA256

                                                                ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                                SHA512

                                                                dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                                                Filesize

                                                                649B

                                                                MD5

                                                                cc4e183350abbce9a7a2964ba3f5cdbf

                                                                SHA1

                                                                133be22c08e274688a8da79a4133c4fb34b9914f

                                                                SHA256

                                                                785abbbdab082978fc5c7176166d968b5c3097a0961f79d682cd28d7f3fb1c67

                                                                SHA512

                                                                d16caf439367e506343aa37f30e2acbf2f34a156f1aa48414b6b8e1ce9f3c286c33ebef6b7045074a5389e8a25ed1fef240af23785d4ea89085e586522fc51e5

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\_locales\en_CA\messages.json

                                                                Filesize

                                                                851B

                                                                MD5

                                                                07ffbe5f24ca348723ff8c6c488abfb8

                                                                SHA1

                                                                6dc2851e39b2ee38f88cf5c35a90171dbea5b690

                                                                SHA256

                                                                6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

                                                                SHA512

                                                                7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\dasherSettingSchema.json

                                                                Filesize

                                                                854B

                                                                MD5

                                                                4ec1df2da46182103d2ffc3b92d20ca5

                                                                SHA1

                                                                fb9d1ba3710cf31a87165317c6edc110e98994ce

                                                                SHA256

                                                                6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

                                                                SHA512

                                                                939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                                Filesize

                                                                2B

                                                                MD5

                                                                d751713988987e9331980363e24189ce

                                                                SHA1

                                                                97d170e1550eee4afc0af065b78cda302a97674c

                                                                SHA256

                                                                4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                SHA512

                                                                b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                Filesize

                                                                356B

                                                                MD5

                                                                bdecb549854caa624fa5a7b5264b4b13

                                                                SHA1

                                                                d1b7689b1bdf105fe81598ccea9cf1dc92e40e11

                                                                SHA256

                                                                f7cac0b80c2b65a829ac042420eec93442a854ec2dbc87a3b27d8733f0ff2eda

                                                                SHA512

                                                                443532f6ce71f749112b5f97608c3a22e8ce70966bf1f9ef3e566fbb50c9e2dce14f111533b3c9659893e9f036abad1b1c0124c616426a9ba3253b886f613613

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                Filesize

                                                                9KB

                                                                MD5

                                                                dc4889f592ba3eb520554b815b9cb4f1

                                                                SHA1

                                                                367bf2dfafed180cbe26d61a5cab2e16eb11cafd

                                                                SHA256

                                                                b06ecc00ee03ffd862806973947fb4893117a4868071fc2c557e20f7bfee1c8e

                                                                SHA512

                                                                5719baae0020ede35955a6f8e94c5d9b1fad540b91c5dc2fd0d76333b6a4bdffca8725743a1ff0a84c053c8a498312dbdcdec7fe7948c48d7523a0ceced668e9

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                Filesize

                                                                15KB

                                                                MD5

                                                                82b2ece978c52cff6ea2ae0edae3df1e

                                                                SHA1

                                                                eb75706b86bbe84c15aefac7301913045c8ce50e

                                                                SHA256

                                                                18a66879a13f4ecef4f656b0e74384184219a9f959ec9559bb02d8fcf9fdc2d7

                                                                SHA512

                                                                644b53615068042047df0715ca2bd618adddc323bae27715e42681c0e0ce4f63e3b7ddcacadacacddd25cda055aa631e8fdf5ce770ed6a94d8067f4afc0e6636

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                Filesize

                                                                231KB

                                                                MD5

                                                                c4c06f59b88a3d9247bb132a834e4277

                                                                SHA1

                                                                7ae7ffe9c2dd470743697c550cce5f33a48c8279

                                                                SHA256

                                                                e4931986f8af1cf23ddea585c64920c08896b9dcecd5f16807cddad5c1ccdb89

                                                                SHA512

                                                                5169234f4a8331e01539feec7ebb62be119c8aac3a70762af515b603459472c1b6fa699e81693200c00497eb08c98f1b16f84a1db07e04dfc068925537b7429c

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                Filesize

                                                                152B

                                                                MD5

                                                                443a627d539ca4eab732bad0cbe7332b

                                                                SHA1

                                                                86b18b906a1acd2a22f4b2c78ac3564c394a9569

                                                                SHA256

                                                                1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

                                                                SHA512

                                                                923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                Filesize

                                                                152B

                                                                MD5

                                                                99afa4934d1e3c56bbce114b356e8a99

                                                                SHA1

                                                                3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

                                                                SHA256

                                                                08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

                                                                SHA512

                                                                76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                Filesize

                                                                152B

                                                                MD5

                                                                a37da350dddf3fb4450b9a4372478df3

                                                                SHA1

                                                                538ae3ff940b52ee4aa6eee84bb53215655b3e94

                                                                SHA256

                                                                05afd62e44653b83ac58c2fc041b10ef0ef5fadc5341e301cfc675334da199a0

                                                                SHA512

                                                                bde4bf98f9cb7e40e3320408b51932ded8a620b415197efbf7d072adee1d4de67caa5f405be2dbc1e9dbebb9c063ced3e58d0ea778a70b47b7dbbddb2791b862

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\64f5aeb0-6b68-40f2-9072-a7890530df55.tmp

                                                                Filesize

                                                                1B

                                                                MD5

                                                                5058f1af8388633f609cadb75a75dc9d

                                                                SHA1

                                                                3a52ce780950d4d969792a2559cd519d7ee8c727

                                                                SHA256

                                                                cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                                                SHA512

                                                                0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

                                                                Filesize

                                                                44KB

                                                                MD5

                                                                1d13cc599d000096e1a7c9c68e47dd6c

                                                                SHA1

                                                                11a2e6c9875556be68a91af289f5f026b2c5b946

                                                                SHA256

                                                                6a4827d6489f2cad9a21388d08e107530875fc3d5107885b1538c3120231b3cb

                                                                SHA512

                                                                ecad0980a240693eb55002fd250dfe5f3779ebca5f3d3ed7002938fd8eb26e5fb0ede5c23e3b872934e9d11ef81ab4e33fcd0ae8ecb99383449acd7bf18340ed

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

                                                                Filesize

                                                                264KB

                                                                MD5

                                                                53bb899bbecc8e65c9c75c59848f71d8

                                                                SHA1

                                                                56cfa2b1902892f63cf91bf27a8525ed4d1c2723

                                                                SHA256

                                                                fc4ac37d52e56a09d55b0bf201566a53a6ff67b1f2585a46bae83f27f89b95bb

                                                                SHA512

                                                                36b2679e483c8fee6e204e4c63608c4d3e91fa69f76ba6ac8578b7565459505aaec02451ce22b8b5c644e98028b2dd5ff4a2c8dafbf1f19b87aab8ada6bce43a

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                Filesize

                                                                168B

                                                                MD5

                                                                10885a46782b9d0b8b236c572a11758b

                                                                SHA1

                                                                5fef9de83f4a1e137961f6f1cd583ec22b6b019e

                                                                SHA256

                                                                3d7b4f6de24dc532ada82d5fb986c3cc3f8d5ba95cea456f14d9b8582325c3c2

                                                                SHA512

                                                                8e8b9b3cf54c8194e52c46de91b26c4c80615022acb4e39ce99466820b47ec8f637cf0cd03478deee0775b9755a83fa93b561d93f2d2787d91047edac8b65a42

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

                                                                Filesize

                                                                322B

                                                                MD5

                                                                f6bc485ce7ba3c513e2791609e22c1e0

                                                                SHA1

                                                                9269cd2414cecbf80e056c5ca23fb53badb147ec

                                                                SHA256

                                                                a17ef61e33e44e2d841f21167e2d3c3713cb921ca7537b7dafbc081b99793977

                                                                SHA512

                                                                8e901b938474b2ee19be2061305b472d27e4db3c6fb295552a26bd4e19e01b3711bf1a5cf3c3d93407d37fdd177072f546403202f9be8d821ca01b3cfc2696af

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

                                                                Filesize

                                                                334B

                                                                MD5

                                                                1159d296f17da6d6c1f64ded0e4eae63

                                                                SHA1

                                                                e5dd3c06fc490fa9242fc6a4929d0bd740fbb6ae

                                                                SHA256

                                                                02dcae9502127d5f68c20622b4e8bdd5bdfaf6f3685b6b4a0f392f6aae50b660

                                                                SHA512

                                                                373cb8cd72781a165df6eb1a443b22a598443427f8d2831daab41cf4f944bf9efa066d7ca1c3523981f87670d5309e70ed61026cadd9380072bed8584cc08d60

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                Filesize

                                                                437B

                                                                MD5

                                                                05592d6b429a6209d372dba7629ce97c

                                                                SHA1

                                                                b4d45e956e3ec9651d4e1e045b887c7ccbdde326

                                                                SHA256

                                                                3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

                                                                SHA512

                                                                caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                Filesize

                                                                5KB

                                                                MD5

                                                                bf5e4f85c70f0eea7a29a2fd24e533a4

                                                                SHA1

                                                                6d559bd0da506e84a51089130f75214e3ef57748

                                                                SHA256

                                                                c8c92d65fb3cf43e38d3ce3c9095ee1c7f368ab85f733c170c6162212a31779b

                                                                SHA512

                                                                fdef296bfe1cfea2b7084261ab011f0fd0b963786483044d4c45d12393808f8f6293396d2b09d4045093aa64387fe715e128c5b1c214176456ee8449e522b5c3

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                Filesize

                                                                5KB

                                                                MD5

                                                                11cc0a44856a0f1dd6c8fb6a2292be1f

                                                                SHA1

                                                                e7bb4bf6db4f9a9e327bd0054044ad157052d453

                                                                SHA256

                                                                edf7b8366e22a27af8ff52c78251e33f07f176715538f0429426f887635467fa

                                                                SHA512

                                                                f634ce2cd7cb47d097cffb8cea599b54be75ba7219d7340dacb91684edd3d3c3745fb3df3c9a2e2ddc2327f71ccc4a7987cd0db970d5dfde541491df16c86a9f

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                Filesize

                                                                6KB

                                                                MD5

                                                                d334a16135d6a4f3224d278d7a1a7e17

                                                                SHA1

                                                                053d63dcc2eceab910608dae518837a5869df84f

                                                                SHA256

                                                                497576e699085162e7d3764d9a05fccfcf73d9d657f09d2813f1a104e2d08230

                                                                SHA512

                                                                7aca2b3210390a91049d0814b9ba29402717523297da2b0ba6fbd4759007269ec2ca91776cd795dc17f429db1beacbf397c965d46ae2a151ef88ef4ade0f9763

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

                                                                Filesize

                                                                99B

                                                                MD5

                                                                ba92e5bbca79ea378c3376187ae43eae

                                                                SHA1

                                                                f0947098577f6d0fe07422acbe3d71510289e2fc

                                                                SHA256

                                                                ccf4c13cd2433fe8a7add616c7d8e6b384cf441e4d948de5c6fc73e9315c619f

                                                                SHA512

                                                                aa1d8b7eb9add6c5ed5635295f501f950914affc3fa9aa1ee58167ed110f99a1760b05e4efb779df8e432eab1b2a0fc9cf9d67a05b2d5432ff8f82c620a38a62

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

                                                                Filesize

                                                                322B

                                                                MD5

                                                                5526d4c88e45bd8bf2852d1b37496174

                                                                SHA1

                                                                64dad5d86f96896fac4317e75a85b230c6322c4f

                                                                SHA256

                                                                b0584ea19857a4e0fc8e4b9b70432c70ae5cbbdab7d0a007da36cde1a0b6b2e9

                                                                SHA512

                                                                7cfad35d7cd580a9973d5740122009de6683bc37e64045d526e982bab40b3c3b8dff7793fd90f6f74c012fabf09c56c6f6a3cd4fa04845cbd34844f4ec10999a

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13375990205132462

                                                                Filesize

                                                                307B

                                                                MD5

                                                                73e588e7473e86e4f63f1dcd8a90d8fa

                                                                SHA1

                                                                7786ef8b0d571ba01396b8495a479dfa79a337e4

                                                                SHA256

                                                                c3477e8f169c549923e0d7a96a42222ef33eb0985460242d8e0b5cbc38713fd8

                                                                SHA512

                                                                323da06c3a610a032982aae36a26566bf8a6709fe88df8b0ca380be24131447ff7f475e83116a185b240fd5cf09c9d40723c60047862dfa964b882b6b43dc65b

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13375990205273462

                                                                Filesize

                                                                933B

                                                                MD5

                                                                4d6e0ed22ce95f48c1a419e6cf5d2cd7

                                                                SHA1

                                                                256c666ce9862bba81d0549d82800f977e213e24

                                                                SHA256

                                                                c0bd205712ce6aeef29903c29c61704eaefbef06dda1abde3e82f3391d4ff792

                                                                SHA512

                                                                b5aca5710be6a6d8561cccc4cd32db54486fb658cf3e69775252f4f47eb7d597555b2fb545e5929fd3f40aca3d62ea53ca4e934443bf957ce1a1cb7342bd6b8b

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

                                                                Filesize

                                                                350B

                                                                MD5

                                                                49b53d276952a86dbe9645850ddb631f

                                                                SHA1

                                                                d1ca5f9bc18212333bb6f583225684c1bf93bebf

                                                                SHA256

                                                                6ea3fed9544af9a9e5d8a4b33b87251b1331534a394546bc4411ac282f3cc545

                                                                SHA512

                                                                e74f39b7329380e7d2a1e0511f64d5957f920b108d06632910e61a330fa102b55ac9d22a4d4847e04aeb0d2cb718a5a9a0ed38db9bcffcfc4eeb37f976b152c7

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

                                                                Filesize

                                                                326B

                                                                MD5

                                                                311c95ea8cb2bc6fe7a64c2b9609a8a3

                                                                SHA1

                                                                bb41cd4eac228ffaf22c24177e10456b4eae85e8

                                                                SHA256

                                                                eff674995e35af5ffbe984d088cb6f08f6ddbca8265ceb1813e2cc17222edf8e

                                                                SHA512

                                                                92d48f0588e5bcc67e613b574687eb32f0367a1288cbc7095ebbf4fd338842d7f9715c55627820480f512c207af69d03f7c735f1428c9b031515a0b38c8db70e

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                Filesize

                                                                16B

                                                                MD5

                                                                206702161f94c5cd39fadd03f4014d98

                                                                SHA1

                                                                bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                SHA256

                                                                1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                SHA512

                                                                0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                Filesize

                                                                16B

                                                                MD5

                                                                46295cac801e5d4857d09837238a6394

                                                                SHA1

                                                                44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                SHA256

                                                                0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                SHA512

                                                                8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

                                                                Filesize

                                                                16KB

                                                                MD5

                                                                3fb6d3a5d772283e6f6d6229bdb45764

                                                                SHA1

                                                                994f825031f96c39323b1f64ff3a96728cd8b7da

                                                                SHA256

                                                                dfbdf92b2b602b67621814bb610497e5eff646e4dc4285ce687575c22ff680ab

                                                                SHA512

                                                                13980fd98b8ae0951012f1c91a783a44cc22d41bdff678c47e86b8b1e73e374e96341154f7fe5f81d8a73b505f63813c5dc0329699a7359318e62dea64dc3776

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

                                                                Filesize

                                                                319B

                                                                MD5

                                                                19dc4655c7280a30f20fc146be1aa1f9

                                                                SHA1

                                                                6d0a73c001b82c033fa537999132cbfc496cc0da

                                                                SHA256

                                                                0c9ad4dd9f6368b253bdc51135174848cd9f603342c7fd10db392bfc5c2b6118

                                                                SHA512

                                                                4d2f0d1fcdd63b3a3555f4dbcdb944d71aebe1bf138bb052261f1913cc1e54a37c3cc50f6131d4a5495b896ac09fbeafcf3a2cc944220def24d0e3974e336751

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

                                                                Filesize

                                                                194B

                                                                MD5

                                                                a48763b50473dbd0a0922258703d673e

                                                                SHA1

                                                                5a3572629bcdf5586d79823b6ddbf3d9736aa251

                                                                SHA256

                                                                9bb14ea03c24f4c3543b22a8b4e9d306b926d4950cfcc410808ecac2407409fd

                                                                SHA512

                                                                536406435e35f8204ce6d3b64850ffb656813aacbc5172af895c16c4f183005d69999c4f48f948875d9837890f290b51a7358ff974fb1efc6ba3d1592426cca1

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

                                                                Filesize

                                                                337B

                                                                MD5

                                                                126a538144015ad4607bca366deaed6a

                                                                SHA1

                                                                384e4309de6734ce8150907b6e13104d252c6bbf

                                                                SHA256

                                                                3758e476a78799b24ba65cc26b8d055242401ba979178d553800e55a079ae700

                                                                SHA512

                                                                3b8a4079109073a5439b600fbcf1e796450e68dcd895ff479ee2b4d62c4fdfe4595d3ca71227a883256a2ac6ce1147311311ba733fae66a4e2714c78b98320b2

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

                                                                Filesize

                                                                11B

                                                                MD5

                                                                838a7b32aefb618130392bc7d006aa2e

                                                                SHA1

                                                                5159e0f18c9e68f0e75e2239875aa994847b8290

                                                                SHA256

                                                                ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

                                                                SHA512

                                                                9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                Filesize

                                                                8KB

                                                                MD5

                                                                05d0c122a1450305696294239bbd30f0

                                                                SHA1

                                                                39755e42c56e0af85a2bd3bf0d0ae2fde3bbb7ac

                                                                SHA256

                                                                0a1563d9879e647db3f20b3f5900d61de0bc3f7f6f4c7466c153c9908e9bd182

                                                                SHA512

                                                                32dea421902c9b6930aab217a95e2a67f1aec413f4e455017be6944583adce638fea04e59e56a7745c2959677306c98f2ebce1dc52eae5f45a40f687e34587d3

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                Filesize

                                                                10KB

                                                                MD5

                                                                e1a76083e7208bbdbd92b9e3739fc04f

                                                                SHA1

                                                                043f88fc7da6a5ea7f0d24aec864362f9f14e314

                                                                SHA256

                                                                a1e08e137e2ac6b69db4a6f5889e1a45801e709a1805086c2c1cfc3319f42d72

                                                                SHA512

                                                                5af373cde016a6a08948bc49add3277a74a6fad47c4dedc3d1242b70f9574b32297587a07e12a538c651d8003c699d19ed2c8a031e2351a53fe2f1cc17961a38

                                                              • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

                                                                Filesize

                                                                4KB

                                                                MD5

                                                                277deeb104e006da6339a8fd2ac05516

                                                                SHA1

                                                                2e30de993d55d94b0ff2297b6bbfe5a96ad91335

                                                                SHA256

                                                                d4e6859664385906f3aeb42047d2151db8c61a8b96d56251fdaa4e835c60040e

                                                                SHA512

                                                                424000bd0074e4a90017804040991889191db424a90c22279bea30fa051519f139090f93d8f72bdb6507ca67bfb4f0cf9ecc7178324ced94cee109e79b9ca5a9

                                                              • C:\Users\Admin\AppData\Local\Temp\1006010001\2cfa22db1f.exe

                                                                Filesize

                                                                3.0MB

                                                                MD5

                                                                0e06eb8231e8c91e9a5b7395c663325b

                                                                SHA1

                                                                322f48093bbb80f6cd67253212906253353d08df

                                                                SHA256

                                                                ccebdba05513a1f46c224b9bf729546c069c9f45026f24d9ee52f9b0a90ebd44

                                                                SHA512

                                                                cf2de3982e628dd41b181a42c8da0ab1a87e6b114da38fee015ff65b21e7468079b734516927577b79ec9c5ff548f24ed17c9de38c2c1ed360b061ad8e7033e1

                                                              • C:\Users\Admin\AppData\Local\Temp\1006011001\0e1a1bbce9.exe

                                                                Filesize

                                                                1.7MB

                                                                MD5

                                                                cd8c45afbd6413151275eb2bc29abdcb

                                                                SHA1

                                                                c6c1598bd0f73ee52bbd2b638b52bf89e546958f

                                                                SHA256

                                                                929a7ad95ec5deeba0bd1397e047e4423a109effda994becd7a2409395de66de

                                                                SHA512

                                                                7e5b6d6b5dd1c0ec35855aa652f58d71e27876bbcac10d805acdba29648ba4e5ce461e9f687b9ddb2bdd2d5d84f93903e097550b4b8d117675b726bd1d371dbb

                                                              • C:\Users\Admin\AppData\Local\Temp\1006013001\fb8b3fc71d.exe

                                                                Filesize

                                                                2.7MB

                                                                MD5

                                                                b4df9c6034911a3be46aea16a079bfae

                                                                SHA1

                                                                149e265c4e8a5810f2d1378032e8f3c23c6807aa

                                                                SHA256

                                                                010a8105de13d202b1da2e38718d06d8f74cb74663631e098fd6195b8004395a

                                                                SHA512

                                                                b147ef9fdfca76e838edc341b329a35fe0d1f18d6186e62a20ea749874d7dd551b2ac971a5de295ebf5c415df3dac25a42c83644eae64bfb702609bfa2b59413

                                                              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

                                                                Filesize

                                                                3.1MB

                                                                MD5

                                                                9c45fce44a67d603745df0cecd5d3068

                                                                SHA1

                                                                fc048570fbc9025258426c62abc50024ad254332

                                                                SHA256

                                                                c20ec8351da86707453bb3db6412d84f89ecc59008a9437b831a4ed6e78a15c2

                                                                SHA512

                                                                51d9cb3b1d6b916680e03047da369c867b936a47e06dfb925923950630f249f4a0d229d084116a7a645c8be1921696cad0e17719165c1f3f8016c3810284c974

                                                              • C:\Users\Admin\AppData\Local\Temp\scoped_dir668_562047886\80362fbe-9cf1-4e50-bb9e-d4d3c440f8aa.tmp

                                                                Filesize

                                                                132KB

                                                                MD5

                                                                da75bb05d10acc967eecaac040d3d733

                                                                SHA1

                                                                95c08e067df713af8992db113f7e9aec84f17181

                                                                SHA256

                                                                33ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2

                                                                SHA512

                                                                56533de53872f023809a20d1ea8532cdc2260d40b05c5a7012c8e61576ff092f006a197f759c92c6b8c429eeec4bb542073b491ddcfd5b22cd4ecbe1a8a7c6ef

                                                              • C:\Users\Admin\AppData\Local\Temp\scoped_dir668_562047886\CRX_INSTALL\_locales\en_CA\messages.json

                                                                Filesize

                                                                711B

                                                                MD5

                                                                558659936250e03cc14b60ebf648aa09

                                                                SHA1

                                                                32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

                                                                SHA256

                                                                2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

                                                                SHA512

                                                                1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

                                                              • memory/836-929-0x0000000000F90000-0x00000000012BA000-memory.dmp

                                                                Filesize

                                                                3.2MB

                                                              • memory/3228-745-0x0000000000371000-0x00000000003C3000-memory.dmp

                                                                Filesize

                                                                328KB

                                                              • memory/3228-172-0x0000000005B50000-0x0000000005E12000-memory.dmp

                                                                Filesize

                                                                2.8MB

                                                              • memory/3228-44-0x0000000000370000-0x0000000000676000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/3228-45-0x0000000000371000-0x00000000003C3000-memory.dmp

                                                                Filesize

                                                                328KB

                                                              • memory/3228-46-0x0000000000370000-0x0000000000676000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/3228-47-0x0000000000370000-0x0000000000676000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/3228-48-0x0000000000370000-0x0000000000676000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/3228-66-0x0000000000371000-0x00000000003C3000-memory.dmp

                                                                Filesize

                                                                328KB

                                                              • memory/3228-67-0x0000000000370000-0x0000000000676000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/3228-68-0x0000000000370000-0x0000000000676000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/3228-91-0x0000000000370000-0x0000000000676000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/3228-744-0x0000000000370000-0x0000000000676000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/3228-585-0x0000000005B50000-0x0000000005E12000-memory.dmp

                                                                Filesize

                                                                2.8MB

                                                              • memory/3228-586-0x0000000005B50000-0x0000000005E12000-memory.dmp

                                                                Filesize

                                                                2.8MB

                                                              • memory/3228-587-0x0000000005B50000-0x0000000005E12000-memory.dmp

                                                                Filesize

                                                                2.8MB

                                                              • memory/3228-588-0x0000000005B50000-0x0000000005E12000-memory.dmp

                                                                Filesize

                                                                2.8MB

                                                              • memory/3228-171-0x0000000005B50000-0x0000000005E12000-memory.dmp

                                                                Filesize

                                                                2.8MB

                                                              • memory/3228-178-0x0000000000370000-0x0000000000676000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/3620-123-0x0000000000400000-0x0000000000AA3000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/3620-137-0x0000000000400000-0x0000000000AA3000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/3620-129-0x0000000000400000-0x0000000000AA3000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/3620-133-0x0000000000400000-0x0000000000AA3000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/3620-119-0x0000000000400000-0x0000000000AA3000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/3620-121-0x0000000000400000-0x0000000000AA3000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/3620-127-0x0000000000400000-0x0000000000AA3000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/3620-128-0x0000000000400000-0x0000000000AA3000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/3620-122-0x0000000000400000-0x0000000000AA3000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/3620-144-0x0000000000400000-0x0000000000AA3000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/3620-120-0x0000000000400000-0x0000000000AA3000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/3620-117-0x0000000000400000-0x0000000000AA3000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/3620-116-0x0000000000400000-0x0000000000AA3000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/3620-141-0x0000000000400000-0x0000000000AA3000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/3620-114-0x0000000000400000-0x0000000000AA3000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/3620-112-0x0000000000400000-0x0000000000AA3000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/3620-115-0x0000000000400000-0x0000000000AA3000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/3620-118-0x0000000000400000-0x0000000000AA3000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/3620-142-0x0000000000400000-0x0000000000AA3000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/3620-131-0x0000000000400000-0x0000000000AA3000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/3620-132-0x0000000000400000-0x0000000000AA3000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/3620-134-0x0000000000400000-0x0000000000AA3000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/3620-135-0x0000000000400000-0x0000000000AA3000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/3620-140-0x0000000000400000-0x0000000000AA3000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/3620-139-0x0000000000400000-0x0000000000AA3000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/3620-143-0x0000000000400000-0x0000000000AA3000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/3620-113-0x0000000000400000-0x0000000000AA3000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/3620-110-0x0000000000400000-0x0000000000AA3000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/3620-111-0x0000000000400000-0x0000000000AA3000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/3620-109-0x0000000000400000-0x0000000000AA3000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/3620-107-0x0000000000400000-0x0000000000AA3000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/3620-136-0x0000000000400000-0x0000000000AA3000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/4444-2-0x0000000000B31000-0x0000000000B99000-memory.dmp

                                                                Filesize

                                                                416KB

                                                              • memory/4444-19-0x0000000000B31000-0x0000000000B99000-memory.dmp

                                                                Filesize

                                                                416KB

                                                              • memory/4444-4-0x0000000000B30000-0x0000000000E5A000-memory.dmp

                                                                Filesize

                                                                3.2MB

                                                              • memory/4444-3-0x0000000000B30000-0x0000000000E5A000-memory.dmp

                                                                Filesize

                                                                3.2MB

                                                              • memory/4444-18-0x0000000000B30000-0x0000000000E5A000-memory.dmp

                                                                Filesize

                                                                3.2MB

                                                              • memory/4444-0-0x0000000000B30000-0x0000000000E5A000-memory.dmp

                                                                Filesize

                                                                3.2MB

                                                              • memory/4444-1-0x0000000076FC4000-0x0000000076FC6000-memory.dmp

                                                                Filesize

                                                                8KB

                                                              • memory/4492-859-0x0000000000070000-0x0000000000713000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/4492-71-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                Filesize

                                                                972KB

                                                              • memory/4492-138-0x0000000000070000-0x0000000000713000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/4492-63-0x0000000000070000-0x0000000000713000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/4492-568-0x0000000000070000-0x0000000000713000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/4492-130-0x0000000000070000-0x0000000000713000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                              • memory/4580-567-0x0000000000F90000-0x00000000012BA000-memory.dmp

                                                                Filesize

                                                                3.2MB

                                                              • memory/4580-20-0x0000000000F91000-0x0000000000FF9000-memory.dmp

                                                                Filesize

                                                                416KB

                                                              • memory/4580-28-0x0000000000F90000-0x00000000012BA000-memory.dmp

                                                                Filesize

                                                                3.2MB

                                                              • memory/4580-26-0x0000000000F90000-0x00000000012BA000-memory.dmp

                                                                Filesize

                                                                3.2MB

                                                              • memory/4580-25-0x0000000000F91000-0x0000000000FF9000-memory.dmp

                                                                Filesize

                                                                416KB

                                                              • memory/4580-24-0x0000000000F90000-0x00000000012BA000-memory.dmp

                                                                Filesize

                                                                3.2MB

                                                              • memory/4580-23-0x0000000000F90000-0x00000000012BA000-memory.dmp

                                                                Filesize

                                                                3.2MB

                                                              • memory/4580-22-0x0000000000F90000-0x00000000012BA000-memory.dmp

                                                                Filesize

                                                                3.2MB

                                                              • memory/4580-21-0x0000000000F90000-0x00000000012BA000-memory.dmp

                                                                Filesize

                                                                3.2MB

                                                              • memory/4580-126-0x0000000000F90000-0x00000000012BA000-memory.dmp

                                                                Filesize

                                                                3.2MB

                                                              • memory/4580-17-0x0000000000F90000-0x00000000012BA000-memory.dmp

                                                                Filesize

                                                                3.2MB

                                                              • memory/4580-65-0x0000000000F90000-0x00000000012BA000-memory.dmp

                                                                Filesize

                                                                3.2MB

                                                              • memory/6584-855-0x0000000000770000-0x0000000000A9A000-memory.dmp

                                                                Filesize

                                                                3.2MB

                                                              • memory/6584-863-0x0000000000770000-0x0000000000A9A000-memory.dmp

                                                                Filesize

                                                                3.2MB

                                                              • memory/6632-699-0x0000000000BD0000-0x0000000000E92000-memory.dmp

                                                                Filesize

                                                                2.8MB

                                                              • memory/6632-616-0x0000000000BD0000-0x0000000000E92000-memory.dmp

                                                                Filesize

                                                                2.8MB

                                                              • memory/6632-615-0x0000000000BD0000-0x0000000000E92000-memory.dmp

                                                                Filesize

                                                                2.8MB

                                                              • memory/6632-584-0x0000000000BD0000-0x0000000000E92000-memory.dmp

                                                                Filesize

                                                                2.8MB

                                                              • memory/6632-767-0x0000000000BD0000-0x0000000000E92000-memory.dmp

                                                                Filesize

                                                                2.8MB

                                                              • memory/7036-618-0x0000000000F90000-0x00000000012BA000-memory.dmp

                                                                Filesize

                                                                3.2MB