Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19-11-2024 17:24

General

  • Target

    9fdac22c258cb6e7426e553df54bf2f7b6269dce5b10e539a746aee4671e6196.exe

  • Size

    1.8MB

  • MD5

    77b74d811a921f3feafe6143482a93fb

  • SHA1

    2302257c7693519586bcb783b3d958ed48001e3a

  • SHA256

    9fdac22c258cb6e7426e553df54bf2f7b6269dce5b10e539a746aee4671e6196

  • SHA512

    7fda02922af9b056d278950085ff64ef90ae66492265f22b609fd338cf2991459cf43db6913a33437f335957863e3e54145b995f0c3a69a745ecf58a21e5e082

  • SSDEEP

    49152:B4PvBEvRUvALTgcmmwXtgvm7JeDRFIpt+raq:B4REvOALTPMXtBV4R2p/

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

mars

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

lumma

C2

https://processhol.sbs/api

https://p10tgrace.sbs/api

https://peepburry828.sbs/api

https://3xp3cts1aim.sbs/api

https://p3ar11fter.sbs/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

  • Cryptbot family
  • Detects CryptBot payload 1 IoCs

    CryptBot is a C++ stealer distributed widely in bundle with other software.

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 4 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 8 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 16 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 5 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 49 IoCs
  • Suspicious use of SendNotifyMessage 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\9fdac22c258cb6e7426e553df54bf2f7b6269dce5b10e539a746aee4671e6196.exe
    "C:\Users\Admin\AppData\Local\Temp\9fdac22c258cb6e7426e553df54bf2f7b6269dce5b10e539a746aee4671e6196.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2644
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3036
      • C:\Users\Admin\AppData\Local\Temp\1007459001\2703f76103.exe
        "C:\Users\Admin\AppData\Local\Temp\1007459001\2703f76103.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:1764
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
          4⤵
          • Uses browser remote debugging
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:3888
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef71e9758,0x7fef71e9768,0x7fef71e9778
            5⤵
              PID:3900
            • C:\Windows\system32\ctfmon.exe
              ctfmon.exe
              5⤵
                PID:4016
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1080 --field-trial-handle=1124,i,8475804071236695499,991061344305681655,131072 /prefetch:2
                5⤵
                  PID:4076
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1488 --field-trial-handle=1124,i,8475804071236695499,991061344305681655,131072 /prefetch:8
                  5⤵
                    PID:4092
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1572 --field-trial-handle=1124,i,8475804071236695499,991061344305681655,131072 /prefetch:8
                    5⤵
                      PID:3248
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1908 --field-trial-handle=1124,i,8475804071236695499,991061344305681655,131072 /prefetch:1
                      5⤵
                      • Uses browser remote debugging
                      PID:2988
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=1888 --field-trial-handle=1124,i,8475804071236695499,991061344305681655,131072 /prefetch:1
                      5⤵
                      • Uses browser remote debugging
                      PID:3284
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1444 --field-trial-handle=1124,i,8475804071236695499,991061344305681655,131072 /prefetch:2
                      5⤵
                        PID:3628
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1084 --field-trial-handle=1124,i,8475804071236695499,991061344305681655,131072 /prefetch:1
                        5⤵
                        • Uses browser remote debugging
                        PID:3688
                    • C:\Users\Admin\AppData\Local\Temp\service123.exe
                      "C:\Users\Admin\AppData\Local\Temp\service123.exe"
                      4⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:3264
                    • C:\Windows\SysWOW64\schtasks.exe
                      "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
                      4⤵
                      • System Location Discovery: System Language Discovery
                      • Scheduled Task/Job: Scheduled Task
                      PID:3092
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 960
                      4⤵
                      • Loads dropped DLL
                      • Program crash
                      PID:3288
                  • C:\Users\Admin\AppData\Local\Temp\1007460001\5704e7f58f.exe
                    "C:\Users\Admin\AppData\Local\Temp\1007460001\5704e7f58f.exe"
                    3⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    • Modifies system certificate store
                    • Suspicious behavior: EnumeratesProcesses
                    PID:588
                  • C:\Users\Admin\AppData\Local\Temp\1007461001\345db4bba0.exe
                    "C:\Users\Admin\AppData\Local\Temp\1007461001\345db4bba0.exe"
                    3⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1968
                  • C:\Users\Admin\AppData\Local\Temp\1007462001\7a2e7eb1d7.exe
                    "C:\Users\Admin\AppData\Local\Temp\1007462001\7a2e7eb1d7.exe"
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of WriteProcessMemory
                    PID:1940
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /F /IM firefox.exe /T
                      4⤵
                      • System Location Discovery: System Language Discovery
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1320
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /F /IM chrome.exe /T
                      4⤵
                      • System Location Discovery: System Language Discovery
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2576
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /F /IM msedge.exe /T
                      4⤵
                      • System Location Discovery: System Language Discovery
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2784
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /F /IM opera.exe /T
                      4⤵
                      • System Location Discovery: System Language Discovery
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2788
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /F /IM brave.exe /T
                      4⤵
                      • System Location Discovery: System Language Discovery
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2384
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2688
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                        5⤵
                        • Checks processor information in registry
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of WriteProcessMemory
                        PID:1312
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1312.0.657567861\624540368" -parentBuildID 20221007134813 -prefsHandle 1216 -prefMapHandle 1208 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {08bcd047-8b14-42ef-a4d5-ebb1b2bae03c} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" 1308 ec08e58 gpu
                          6⤵
                            PID:2088
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1312.1.1623187224\768830831" -parentBuildID 20221007134813 -prefsHandle 1488 -prefMapHandle 1484 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {327e9e1c-ec9a-4edb-bcf1-8bb0917823b7} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" 1500 e71b58 socket
                            6⤵
                              PID:536
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1312.2.948871162\433636358" -childID 1 -isForBrowser -prefsHandle 2096 -prefMapHandle 2012 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ee5cc36-8f60-448f-96c0-bece6423db58} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" 2068 1a5fc358 tab
                              6⤵
                                PID:2960
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1312.3.1122757786\1872054226" -childID 2 -isForBrowser -prefsHandle 2800 -prefMapHandle 2796 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f48fdf12-163e-474a-a14a-7b29b3fb2ee9} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" 2812 e5f658 tab
                                6⤵
                                  PID:2188
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1312.4.770162651\372773659" -childID 3 -isForBrowser -prefsHandle 3740 -prefMapHandle 3868 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ab9ad37a-8075-4d99-8f8b-16384fce03dd} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" 3756 2148ea58 tab
                                  6⤵
                                    PID:2780
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1312.5.2120464900\643665935" -childID 4 -isForBrowser -prefsHandle 3996 -prefMapHandle 4000 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {478ac395-e396-4fae-850c-2821244c9934} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" 3984 22613558 tab
                                    6⤵
                                      PID:2540
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1312.6.1429846027\151782989" -childID 5 -isForBrowser -prefsHandle 4180 -prefMapHandle 4184 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1086875-9edc-46e7-8f67-32f113ef09e1} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" 4172 22615358 tab
                                      6⤵
                                        PID:1864
                                • C:\Users\Admin\AppData\Local\Temp\1007463001\5e079548ea.exe
                                  "C:\Users\Admin\AppData\Local\Temp\1007463001\5e079548ea.exe"
                                  3⤵
                                  • Modifies Windows Defender Real-time Protection settings
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Windows security modification
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:568
                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                              1⤵
                                PID:1756
                              • C:\Windows\system32\taskeng.exe
                                taskeng.exe {CBE82166-D27C-496C-AA12-4A513F11AC9A} S-1-5-21-2872745919-2748461613-2989606286-1000:CCJBVTGQ\Admin:Interactive:[1]
                                1⤵
                                  PID:4056
                                  • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                    C:\Users\Admin\AppData\Local\Temp\/service123.exe
                                    2⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    PID:3964

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                  Filesize

                                  264KB

                                  MD5

                                  f50f89a0a91564d0b8a211f8921aa7de

                                  SHA1

                                  112403a17dd69d5b9018b8cede023cb3b54eab7d

                                  SHA256

                                  b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                  SHA512

                                  bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

                                  Filesize

                                  16B

                                  MD5

                                  18e723571b00fb1694a3bad6c78e4054

                                  SHA1

                                  afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                  SHA256

                                  8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                  SHA512

                                  43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\activity-stream.discovery_stream.json.tmp

                                  Filesize

                                  22KB

                                  MD5

                                  712bfeb994c38f31f980eda2660da355

                                  SHA1

                                  701a0f1e6e56979ed3f1e043e5e1e9662cd44f2f

                                  SHA256

                                  9106adc4c38308627f9594fffda52a2b6ba3224b1c3f5e8f66ccdbad8d065f38

                                  SHA512

                                  5c66131cc4671044401e0895e3920c6de541f37383cbd76038988556548ad985812f5926ef014cbbd10c271c7016f62de8ca75c22d7bf79687050f03f62a94e8

                                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

                                  Filesize

                                  13KB

                                  MD5

                                  f99b4984bd93547ff4ab09d35b9ed6d5

                                  SHA1

                                  73bf4d313cb094bb6ead04460da9547106794007

                                  SHA256

                                  402571262fd1f6dca336f822ceb0ec2a368a25dfe2f4bfa13b45c983e88b6069

                                  SHA512

                                  cd0ed84a24d3faae94290aca1b5ef65eef4cfba8a983da9f88ee3268fc611484a72bd44ca0947c0ca8de174619debae4604e15e4b2c364e636424ba1d37e1759

                                • C:\Users\Admin\AppData\Local\Temp\1007459001\2703f76103.exe

                                  Filesize

                                  4.1MB

                                  MD5

                                  ca00d6c5903f68cf43e74774d7b08a52

                                  SHA1

                                  65e2318a24492c149eb66865f5f3bd4ee09e88bb

                                  SHA256

                                  de16ea07d8934b7746f20ee895293e48e49a7264a589518f04a4c8b8e2bafe8e

                                  SHA512

                                  0ce810baa5f5284c030cb38c9f3057cb5a5973e38ab677177b9f5cde452a6f894bcf42ef16229c497d2fd2f720872803fb121f2ee4264123aa2fe087a9295c8b

                                • C:\Users\Admin\AppData\Local\Temp\1007460001\5704e7f58f.exe

                                  Filesize

                                  1.8MB

                                  MD5

                                  f6df237f8dc7d584d8836042966a0943

                                  SHA1

                                  8749f7bd027e624de82cfff581962b2eeb6a7dfb

                                  SHA256

                                  e0ba78bf9b945f75349fd5a76290b9b8ff746abd24f15896a277676261499f55

                                  SHA512

                                  a01d4fe202be936549f6a1d465234164a0e315c4725efa85569ce957782ccc904e833db3b2015b173288bfa353b155d649dcff1f2e371e8d010fc197d138f629

                                • C:\Users\Admin\AppData\Local\Temp\1007461001\345db4bba0.exe

                                  Filesize

                                  1.7MB

                                  MD5

                                  8427e384ea4951ee4a5f0b425fa5ad02

                                  SHA1

                                  08f6dd97b593d0bc86339e1a1b7dd405f7798d4e

                                  SHA256

                                  1498a63ecb4dab164c1b8287ea274408379e317874d7d05f41bc6209060326ba

                                  SHA512

                                  b62cea071d32ce26c8542fd718ccba61995a7807d73281c7ec066858052d3f7d3539baabafa5e2b0df42c1976f61fece4a7259c92282a3494f7a406c727eaf52

                                • C:\Users\Admin\AppData\Local\Temp\1007462001\7a2e7eb1d7.exe

                                  Filesize

                                  901KB

                                  MD5

                                  ced448790328e3105c0cfc739ce1c049

                                  SHA1

                                  4e5d7352b4272867394b9a2c8878c108d833662d

                                  SHA256

                                  b5aa55ab7b1267b5e806ab6a306816d8198655a7dd68c2af43e11d06e695fb62

                                  SHA512

                                  74a181ce8cdef058a0637231822446ce0c7261f7bc9f0a52db90c357ba9d0046676308370501b925d4a039b0ab7540b21c6b08e963de80f1ec2494add6deee4e

                                • C:\Users\Admin\AppData\Local\Temp\1007463001\5e079548ea.exe

                                  Filesize

                                  2.6MB

                                  MD5

                                  233f648404abf3a913b830957f8bd1d5

                                  SHA1

                                  7dd39c8b950694bb87303aae1fc9e778b525a7e4

                                  SHA256

                                  e6524526950e9fca8f5a7d001a678ca62cca94ff03491e8d45d58df263d6381a

                                  SHA512

                                  dc9170603b2f4190496883ec7769c5dc6f1520ebe7be6b2f9b790047a6c92589a71d914887e7f2101807ab7ed1d3fb021ffe339f0e6ec38542df88c22d25b7b5

                                • C:\Users\Admin\AppData\Local\Temp\Cab3A64.tmp

                                  Filesize

                                  70KB

                                  MD5

                                  49aebf8cbd62d92ac215b2923fb1b9f5

                                  SHA1

                                  1723be06719828dda65ad804298d0431f6aff976

                                  SHA256

                                  b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                  SHA512

                                  bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                • C:\Users\Admin\AppData\Local\Temp\Tar3A95.tmp

                                  Filesize

                                  181KB

                                  MD5

                                  4ea6026cf93ec6338144661bf1202cd1

                                  SHA1

                                  a1dec9044f750ad887935a01430bf49322fbdcb7

                                  SHA256

                                  8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                  SHA512

                                  6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

                                  Filesize

                                  1.8MB

                                  MD5

                                  77b74d811a921f3feafe6143482a93fb

                                  SHA1

                                  2302257c7693519586bcb783b3d958ed48001e3a

                                  SHA256

                                  9fdac22c258cb6e7426e553df54bf2f7b6269dce5b10e539a746aee4671e6196

                                  SHA512

                                  7fda02922af9b056d278950085ff64ef90ae66492265f22b609fd338cf2991459cf43db6913a33437f335957863e3e54145b995f0c3a69a745ecf58a21e5e082

                                • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                  Filesize

                                  442KB

                                  MD5

                                  85430baed3398695717b0263807cf97c

                                  SHA1

                                  fffbee923cea216f50fce5d54219a188a5100f41

                                  SHA256

                                  a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                                  SHA512

                                  06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                                • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                  Filesize

                                  8.0MB

                                  MD5

                                  a01c5ecd6108350ae23d2cddf0e77c17

                                  SHA1

                                  c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                                  SHA256

                                  345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                                  SHA512

                                  b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\datareporting\glean\db\data.safe.bin

                                  Filesize

                                  2KB

                                  MD5

                                  4f6c475d14c714ba40717ec59570a28a

                                  SHA1

                                  cbb47bcd4a72fafcc1f0b69f270aa6905a7ac576

                                  SHA256

                                  0f89d5434aeb53837de779077bf19ce5e01bee2305caa14e1a3927936df35e20

                                  SHA512

                                  2954c31bdc2b0ecb706eaee4297c54ab7bc49adb8e3bd73ec0428d60f30ca2a12d9b8a77cec03768d799e9057cf3676aaf72d0998d128f19603db2b5dee4a0fe

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\datareporting\glean\pending_pings\22a7fdd5-e418-4252-843a-a8c711cc1ff3

                                  Filesize

                                  745B

                                  MD5

                                  9fd7ee8a12b3b9c9aa4662a363011c8d

                                  SHA1

                                  4d772b3d57c8f5b624b2b079f2c7e9e9f8dacb0e

                                  SHA256

                                  bd9eb4aabafa32cb26a3237e1403347006f3dea50ce70d0fcf284b4f1e01e9c0

                                  SHA512

                                  8486809671d873d94d64c2e67258f296b9c51a37804bf70f49cb74e82129dfa9798d1ffb95d735ce88690ecac7afd58bb311d8c0261465a78f754f88cbeadddc

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\datareporting\glean\pending_pings\ed02de1a-e8a0-4496-9744-4af25aed2174

                                  Filesize

                                  12KB

                                  MD5

                                  32a605869de344ebd2356b4de5b6bae4

                                  SHA1

                                  c772c76bb7f73cf3be87c2caa5ed0422c396d062

                                  SHA256

                                  bba35a6f2f642ceb759400c138dcea3ca034a4fe91a96634cd340afc52af9eeb

                                  SHA512

                                  88e7d13eebf09aaf879e55a00d7072012682ff7d9a1cea50a149d97a1f9c7c82a1a9f489fd364cc664a163af34344c4e7c448a6a1366e10bcbb966219b1a64aa

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                                  Filesize

                                  997KB

                                  MD5

                                  fe3355639648c417e8307c6d051e3e37

                                  SHA1

                                  f54602d4b4778da21bc97c7238fc66aa68c8ee34

                                  SHA256

                                  1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                                  SHA512

                                  8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                                  Filesize

                                  116B

                                  MD5

                                  3d33cdc0b3d281e67dd52e14435dd04f

                                  SHA1

                                  4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                                  SHA256

                                  f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                                  SHA512

                                  a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                                  Filesize

                                  479B

                                  MD5

                                  49ddb419d96dceb9069018535fb2e2fc

                                  SHA1

                                  62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                                  SHA256

                                  2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                                  SHA512

                                  48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                                  Filesize

                                  372B

                                  MD5

                                  8be33af717bb1b67fbd61c3f4b807e9e

                                  SHA1

                                  7cf17656d174d951957ff36810e874a134dd49e0

                                  SHA256

                                  e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                                  SHA512

                                  6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                                  Filesize

                                  11.8MB

                                  MD5

                                  33bf7b0439480effb9fb212efce87b13

                                  SHA1

                                  cee50f2745edc6dc291887b6075ca64d716f495a

                                  SHA256

                                  8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                                  SHA512

                                  d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                                  Filesize

                                  1KB

                                  MD5

                                  688bed3676d2104e7f17ae1cd2c59404

                                  SHA1

                                  952b2cdf783ac72fcb98338723e9afd38d47ad8e

                                  SHA256

                                  33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                                  SHA512

                                  7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                                  Filesize

                                  1KB

                                  MD5

                                  937326fead5fd401f6cca9118bd9ade9

                                  SHA1

                                  4526a57d4ae14ed29b37632c72aef3c408189d91

                                  SHA256

                                  68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                                  SHA512

                                  b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\prefs-1.js

                                  Filesize

                                  6KB

                                  MD5

                                  dde19069b1f7e8ea3f0d30fc35eaa1b2

                                  SHA1

                                  79f8469106f77071ccd6af9b0823b108d0e00473

                                  SHA256

                                  b1ce2ee0222c56baa16a075dafdf3246209cba1768429535330a2969229008c6

                                  SHA512

                                  9c16601300298047eda153a3851cc503ec79160df897412a925949df95c2a7acf5d821dc8ecae7bd30b069bdb8c82af57afc33cffcad29caa831781084729209

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\prefs-1.js

                                  Filesize

                                  7KB

                                  MD5

                                  9219651d25e8af193c7e83c1262b9e8c

                                  SHA1

                                  a42cc01ecce59d549ff2c37488fc8236d75e6cee

                                  SHA256

                                  c9a9b236b4cffcd8851a178f0b49f13c2d7ab4d74a28f42cb06d75078bc2ee89

                                  SHA512

                                  39023fb2cd21175604741b230b50fdc6425c845eee78c5c9b474712601526b362063460c206c4c1139e1a783c991c26a6d36e2fff8a7d20573b0c8144dbe63ce

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\prefs-1.js

                                  Filesize

                                  7KB

                                  MD5

                                  482570d4933d57adc3cb16ff9f60bca7

                                  SHA1

                                  e792639a57e1586571477b77e49a63df6b131047

                                  SHA256

                                  f3fe64325fc99a57aeba77786ff83b02be409e8f31515cdd50304cd8f29da465

                                  SHA512

                                  f311135ee6816cf64a95a54672cbe36eb990d4705cdb87c8ba2c0922196d2cfd8ff7349e9499d6f9735d9ea11cbbc8ad46482957c9ea70eb8ec72a5e2ac9b4c7

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\sessionstore-backups\recovery.jsonlz4

                                  Filesize

                                  4KB

                                  MD5

                                  fc8ead6049eb374ddafe5b4af14a8186

                                  SHA1

                                  dcc1a165351e4398b55eaf2b4364f61e7cc50880

                                  SHA256

                                  2ec60860533072b92871da620c15e4f32ffecbd0637156805e4e28a6f7b9d0d9

                                  SHA512

                                  cac3016841112f4531aa0ab5893d3b21ae4b67154aca6ae4946d74e27f9e3202cb32cd352da63896b6127a8a89e93284bebe418df873eca966bafd767e218e1e

                                • memory/568-329-0x00000000011E0000-0x000000000148A000-memory.dmp

                                  Filesize

                                  2.7MB

                                • memory/568-306-0x00000000011E0000-0x000000000148A000-memory.dmp

                                  Filesize

                                  2.7MB

                                • memory/568-307-0x00000000011E0000-0x000000000148A000-memory.dmp

                                  Filesize

                                  2.7MB

                                • memory/568-327-0x00000000011E0000-0x000000000148A000-memory.dmp

                                  Filesize

                                  2.7MB

                                • memory/568-305-0x00000000011E0000-0x000000000148A000-memory.dmp

                                  Filesize

                                  2.7MB

                                • memory/588-124-0x0000000000BB0000-0x0000000001058000-memory.dmp

                                  Filesize

                                  4.7MB

                                • memory/588-65-0x0000000000BB0000-0x0000000001058000-memory.dmp

                                  Filesize

                                  4.7MB

                                • memory/1764-484-0x0000000001340000-0x0000000001EAE000-memory.dmp

                                  Filesize

                                  11.4MB

                                • memory/1764-417-0x0000000001340000-0x0000000001EAE000-memory.dmp

                                  Filesize

                                  11.4MB

                                • memory/1764-408-0x0000000069CC0000-0x000000006A71B000-memory.dmp

                                  Filesize

                                  10.4MB

                                • memory/1764-133-0x0000000001340000-0x0000000001EAE000-memory.dmp

                                  Filesize

                                  11.4MB

                                • memory/1764-87-0x0000000001340000-0x0000000001EAE000-memory.dmp

                                  Filesize

                                  11.4MB

                                • memory/1764-45-0x0000000001340000-0x0000000001EAE000-memory.dmp

                                  Filesize

                                  11.4MB

                                • memory/1764-470-0x0000000001340000-0x0000000001EAE000-memory.dmp

                                  Filesize

                                  11.4MB

                                • memory/1764-330-0x0000000001340000-0x0000000001EAE000-memory.dmp

                                  Filesize

                                  11.4MB

                                • memory/1764-487-0x0000000001340000-0x0000000001EAE000-memory.dmp

                                  Filesize

                                  11.4MB

                                • memory/1764-312-0x0000000001340000-0x0000000001EAE000-memory.dmp

                                  Filesize

                                  11.4MB

                                • memory/1764-513-0x0000000001340000-0x0000000001EAE000-memory.dmp

                                  Filesize

                                  11.4MB

                                • memory/1968-123-0x00000000009D0000-0x0000000001051000-memory.dmp

                                  Filesize

                                  6.5MB

                                • memory/1968-85-0x00000000009D0000-0x0000000001051000-memory.dmp

                                  Filesize

                                  6.5MB

                                • memory/2644-2-0x00000000000E1000-0x000000000010F000-memory.dmp

                                  Filesize

                                  184KB

                                • memory/2644-33-0x0000000006DD0000-0x0000000007295000-memory.dmp

                                  Filesize

                                  4.8MB

                                • memory/2644-1-0x0000000077E20000-0x0000000077E22000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/2644-3-0x00000000000E0000-0x00000000005A5000-memory.dmp

                                  Filesize

                                  4.8MB

                                • memory/2644-5-0x00000000000E0000-0x00000000005A5000-memory.dmp

                                  Filesize

                                  4.8MB

                                • memory/2644-0-0x00000000000E0000-0x00000000005A5000-memory.dmp

                                  Filesize

                                  4.8MB

                                • memory/2644-12-0x00000000000E0000-0x00000000005A5000-memory.dmp

                                  Filesize

                                  4.8MB

                                • memory/2644-16-0x00000000000E0000-0x00000000005A5000-memory.dmp

                                  Filesize

                                  4.8MB

                                • memory/2644-18-0x0000000006DD0000-0x0000000007295000-memory.dmp

                                  Filesize

                                  4.8MB

                                • memory/3036-336-0x0000000001120000-0x00000000015E5000-memory.dmp

                                  Filesize

                                  4.8MB

                                • memory/3036-67-0x0000000006B00000-0x000000000766E000-memory.dmp

                                  Filesize

                                  11.4MB

                                • memory/3036-42-0x0000000006B00000-0x000000000766E000-memory.dmp

                                  Filesize

                                  11.4MB

                                • memory/3036-304-0x0000000006B00000-0x0000000006DAA000-memory.dmp

                                  Filesize

                                  2.7MB

                                • memory/3036-142-0x0000000001120000-0x00000000015E5000-memory.dmp

                                  Filesize

                                  4.8MB

                                • memory/3036-44-0x0000000001120000-0x00000000015E5000-memory.dmp

                                  Filesize

                                  4.8MB

                                • memory/3036-20-0x0000000001120000-0x00000000015E5000-memory.dmp

                                  Filesize

                                  4.8MB

                                • memory/3036-19-0x0000000001121000-0x000000000114F000-memory.dmp

                                  Filesize

                                  184KB

                                • memory/3036-141-0x0000000006B00000-0x0000000006FA8000-memory.dmp

                                  Filesize

                                  4.7MB

                                • memory/3036-17-0x0000000001120000-0x00000000015E5000-memory.dmp

                                  Filesize

                                  4.8MB

                                • memory/3036-322-0x0000000006B00000-0x0000000006DAA000-memory.dmp

                                  Filesize

                                  2.7MB

                                • memory/3036-315-0x0000000001120000-0x00000000015E5000-memory.dmp

                                  Filesize

                                  4.8MB

                                • memory/3036-22-0x0000000001120000-0x00000000015E5000-memory.dmp

                                  Filesize

                                  4.8MB

                                • memory/3036-289-0x0000000006B00000-0x0000000007181000-memory.dmp

                                  Filesize

                                  6.5MB

                                • memory/3036-23-0x0000000001120000-0x00000000015E5000-memory.dmp

                                  Filesize

                                  4.8MB

                                • memory/3036-134-0x0000000006B00000-0x0000000006FA8000-memory.dmp

                                  Filesize

                                  4.7MB

                                • memory/3036-40-0x0000000001120000-0x00000000015E5000-memory.dmp

                                  Filesize

                                  4.8MB

                                • memory/3036-420-0x0000000001120000-0x00000000015E5000-memory.dmp

                                  Filesize

                                  4.8MB

                                • memory/3036-63-0x0000000006B00000-0x0000000006FA8000-memory.dmp

                                  Filesize

                                  4.7MB

                                • memory/3036-43-0x0000000006B00000-0x000000000766E000-memory.dmp

                                  Filesize

                                  11.4MB

                                • memory/3036-86-0x0000000006B00000-0x000000000766E000-memory.dmp

                                  Filesize

                                  11.4MB

                                • memory/3036-88-0x0000000006B00000-0x0000000007181000-memory.dmp

                                  Filesize

                                  6.5MB

                                • memory/3036-303-0x0000000006B00000-0x0000000007181000-memory.dmp

                                  Filesize

                                  6.5MB

                                • memory/3036-482-0x0000000001120000-0x00000000015E5000-memory.dmp

                                  Filesize

                                  4.8MB

                                • memory/3036-46-0x0000000001120000-0x00000000015E5000-memory.dmp

                                  Filesize

                                  4.8MB

                                • memory/3036-485-0x0000000001120000-0x00000000015E5000-memory.dmp

                                  Filesize

                                  4.8MB

                                • memory/3036-64-0x0000000006B00000-0x0000000006FA8000-memory.dmp

                                  Filesize

                                  4.7MB

                                • memory/3036-492-0x0000000001120000-0x00000000015E5000-memory.dmp

                                  Filesize

                                  4.8MB

                                • memory/3036-84-0x0000000006B00000-0x0000000007181000-memory.dmp

                                  Filesize

                                  6.5MB

                                • memory/3036-515-0x0000000001120000-0x00000000015E5000-memory.dmp

                                  Filesize

                                  4.8MB

                                • memory/3036-535-0x0000000001120000-0x00000000015E5000-memory.dmp

                                  Filesize

                                  4.8MB

                                • memory/3036-532-0x0000000001120000-0x00000000015E5000-memory.dmp

                                  Filesize

                                  4.8MB

                                • memory/3036-519-0x0000000001120000-0x00000000015E5000-memory.dmp

                                  Filesize

                                  4.8MB

                                • memory/3036-522-0x0000000001120000-0x00000000015E5000-memory.dmp

                                  Filesize

                                  4.8MB

                                • memory/3036-529-0x0000000001120000-0x00000000015E5000-memory.dmp

                                  Filesize

                                  4.8MB

                                • memory/3264-518-0x00000000740E0000-0x0000000074214000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/3264-517-0x00000000009B0000-0x00000000009C2000-memory.dmp

                                  Filesize

                                  72KB

                                • memory/3964-526-0x00000000009B0000-0x00000000009C2000-memory.dmp

                                  Filesize

                                  72KB