Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    05/12/2024, 18:28

General

  • Target

    d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe

  • Size

    3.1MB

  • MD5

    ed3fa7460523c5ec9d4568e754624405

  • SHA1

    88ad04cf36c7fe20644d48572ec2e70569c9581b

  • SHA256

    d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c

  • SHA512

    4ff0b5009effb0630cb3cd5dcd7291bc645cb2d59d1975eaef2cec17f379e00317c44de5ed4b07ec607745571521fff380acbfb98afe3710e5ec2dae36bd1add

  • SSDEEP

    49152:ktPTO+1ofLg4mtu3dBRdUMqbmIZgFv2Adk1Vf7Y5XnQ96BsohwyVw:G7O+1GLotutB/UMqyIbJf7Y5XnQmBw

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

gcleaner

C2

92.63.197.221

45.91.200.135

Extracted

Family

cryptbot

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://atten-supporse.biz/api

Extracted

Family

stealc

Botnet

drum

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

xworm

C2

185.196.8.239:7000

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    WindowsUpdaterConf.exe

  • telegram

    https://api.telegram.org/bot8070077125:AAEdRIyp1anHye9Y0jcV8uNF6U4mmijN8Pk/sendMessage?chat_id=1818813749

Extracted

Family

lumma

C2

https://dare-curbys.biz/api

https://se-blurry.biz/api

https://atten-supporse.biz/api

https://zinc-sneark.biz/api

https://dwell-exclaim.biz/api

https://formy-spill.biz/api

https://covery-mover.biz/api

https://print-vexer.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

  • Cryptbot family
  • Detect Xworm Payload 1 IoCs
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

  • Gcleaner family
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 16 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 11 IoCs
  • Identifies Wine through registry keys 2 TTPs 8 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 15 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 5 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 15 IoCs
  • Suspicious use of SendNotifyMessage 13 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe
    "C:\Users\Admin\AppData\Local\Temp\d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2568
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2484
      • C:\Users\Admin\AppData\Local\Temp\1012468001\92dfd41111.exe
        "C:\Users\Admin\AppData\Local\Temp\1012468001\92dfd41111.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2280
      • C:\Users\Admin\AppData\Local\Temp\1012469001\23df97b84f.exe
        "C:\Users\Admin\AppData\Local\Temp\1012469001\23df97b84f.exe"
        3⤵
        • Enumerates VirtualBox registry keys
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1756
      • C:\Users\Admin\AppData\Local\Temp\1012470001\rhnew.exe
        "C:\Users\Admin\AppData\Local\Temp\1012470001\rhnew.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2272
      • C:\Users\Admin\AppData\Local\Temp\1012471001\ab4d5787b4.exe
        "C:\Users\Admin\AppData\Local\Temp\1012471001\ab4d5787b4.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        PID:2148
      • C:\Users\Admin\AppData\Local\Temp\1012472001\8536346613.exe
        "C:\Users\Admin\AppData\Local\Temp\1012472001\8536346613.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1952
      • C:\Users\Admin\AppData\Local\Temp\1012473001\f6b11cc3cc.exe
        "C:\Users\Admin\AppData\Local\Temp\1012473001\f6b11cc3cc.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:988
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM firefox.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2648
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM chrome.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1796
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM msedge.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2156
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM opera.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1656
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM brave.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:984
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1704
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
            5⤵
            • Checks processor information in registry
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:2492
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.0.157119843\1506448151" -parentBuildID 20221007134813 -prefsHandle 1220 -prefMapHandle 1180 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8848fa71-4984-488c-9a74-12f21a09cf10} 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 1296 10fd5858 gpu
              6⤵
                PID:1248
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.1.865771156\685589675" -parentBuildID 20221007134813 -prefsHandle 1500 -prefMapHandle 1496 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {24f1dd15-e036-49a5-8333-0e86ec44caa0} 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 1512 d73958 socket
                6⤵
                  PID:2848
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.2.1140510278\564608440" -childID 1 -isForBrowser -prefsHandle 2064 -prefMapHandle 2060 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 908 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {afb2dfd1-f262-4f94-8837-7e8c7c72d415} 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 2076 1afcb558 tab
                  6⤵
                    PID:2688
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.3.1341630533\1996379942" -childID 2 -isForBrowser -prefsHandle 2640 -prefMapHandle 768 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 908 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8ef2a76d-cb5b-4e74-8314-96cb0eab9e78} 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 2652 d6bf58 tab
                    6⤵
                      PID:2444
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.4.437623077\1857447284" -childID 3 -isForBrowser -prefsHandle 3696 -prefMapHandle 3736 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 908 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {70fed9d3-a5d5-4543-a9d6-a8531ff65b31} 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 3760 1ec66e58 tab
                      6⤵
                        PID:3764
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.5.1002649926\1133845436" -childID 4 -isForBrowser -prefsHandle 3868 -prefMapHandle 3872 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 908 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0613c452-675d-48ac-b08d-e542ce5b9220} 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 3864 20533458 tab
                        6⤵
                          PID:3800
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.6.753351845\1797373074" -childID 5 -isForBrowser -prefsHandle 4060 -prefMapHandle 4064 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 908 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {43abf643-6388-4f92-a094-bdc76de6560c} 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 4048 20534058 tab
                          6⤵
                            PID:3808
                    • C:\Users\Admin\AppData\Local\Temp\1012474001\73ccf42900.exe
                      "C:\Users\Admin\AppData\Local\Temp\1012474001\73ccf42900.exe"
                      3⤵
                      • Modifies Windows Defender Real-time Protection settings
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Windows security modification
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3512
                    • C:\Users\Admin\AppData\Local\Temp\1012475001\wL3EGdM.exe
                      "C:\Users\Admin\AppData\Local\Temp\1012475001\wL3EGdM.exe"
                      3⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Adds Run key to start application
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3780
                      • C:\Users\Admin\AppData\Local\Temp\1012475001\wL3EGdM.exe
                        "C:\Users\Admin\AppData\Local\Temp\1012475001\wL3EGdM.exe"
                        4⤵
                        • Drops startup file
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Adds Run key to start application
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of SetWindowsHookEx
                        PID:9620
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1012475001\wL3EGdM.exe'
                          5⤵
                          • Command and Scripting Interpreter: PowerShell
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:10128
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'wL3EGdM.exe'
                          5⤵
                          • Command and Scripting Interpreter: PowerShell
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:10204
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\WindowsUpdaterConf.exe'
                          5⤵
                          • Command and Scripting Interpreter: PowerShell
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:6764
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsUpdaterConf.exe'
                          5⤵
                          • Command and Scripting Interpreter: PowerShell
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:6852
                        • C:\Windows\SysWOW64\schtasks.exe
                          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WindowsUpdaterConf" /tr "C:\Users\Admin\WindowsUpdaterConf.exe"
                          5⤵
                          • System Location Discovery: System Language Discovery
                          • Scheduled Task/Job: Scheduled Task
                          PID:6984
                      • C:\Windows\SysWOW64\cmd.exe
                        "cmd" /c timeout /t 1 && DEL /f wL3EGdM.exe
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:9704
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout /t 1
                          5⤵
                          • System Location Discovery: System Language Discovery
                          • Delays execution with timeout.exe
                          PID:9748
                • C:\Windows\system32\taskeng.exe
                  taskeng.exe {F26D9B6D-6EBB-4857-8570-0D6EE9B71585} S-1-5-21-2039016743-699959520-214465309-1000:PIDEURYY\Admin:Interactive:[1]
                  1⤵
                    PID:7272
                    • C:\Users\Admin\WindowsUpdaterConf.exe
                      C:\Users\Admin\WindowsUpdaterConf.exe
                      2⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:7308

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RLHRIIGD\download[1].htm

                    Filesize

                    1B

                    MD5

                    cfcd208495d565ef66e7dff9f98764da

                    SHA1

                    b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                    SHA256

                    5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                    SHA512

                    31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xmhyv50e.default-release\activity-stream.discovery_stream.json.tmp

                    Filesize

                    24KB

                    MD5

                    f2763d826a067f5ca87c9ae30446dec6

                    SHA1

                    8e0c4a5b29918fd22e0e0833b8d93c0b837f0295

                    SHA256

                    5691879b8d30ebac6047adfa8f2e84c671e9ada820f42049d9b597ca21ceef31

                    SHA512

                    458f89286e09ea75c2d472fbbcf9a965c6cc21339de4f944e8c389bff69e25d158245f8ddf768016d29fc9ab9e30adb49a0c12f1c118fd3f3b2d1de6aee7cf0f

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xmhyv50e.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

                    Filesize

                    15KB

                    MD5

                    96c542dec016d9ec1ecc4dddfcbaac66

                    SHA1

                    6199f7648bb744efa58acf7b96fee85d938389e4

                    SHA256

                    7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                    SHA512

                    cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                  • C:\Users\Admin\AppData\Local\Temp\1012468001\92dfd41111.exe

                    Filesize

                    1.9MB

                    MD5

                    d37030e80f50aa7d45f15e0983fad330

                    SHA1

                    906a1885d394107acab9d41402b0df195a327f82

                    SHA256

                    a5373b0a6fb3af6cc0166168bff40c602b6a67d9404962e438b61273e874c1bc

                    SHA512

                    1a06ed2cd745c8688b756656315c3bcb8b6465c9f616cc45b347d02070e9fc035efb82e03edffbca9a6765250deea26e01adba8ff99b132cebea071241ec413a

                  • C:\Users\Admin\AppData\Local\Temp\1012469001\23df97b84f.exe

                    Filesize

                    4.2MB

                    MD5

                    758ff78dfb784d7dd45d64c3414e65ab

                    SHA1

                    8867b7267b58752190b99bf8203305b2d3f88b27

                    SHA256

                    843567bec6b0f3cbace108b441cc48a352e085ddf485bc04ed47947fe759369b

                    SHA512

                    60c189db28534c4e7fd0ed7ef7283a1baae4d038c27a1ce724c0a06dbe2e66dac55ae4d66d5639ca51b5df7a3cae2bcb3a9358d90587323c4e3acbd43b07aeb1

                  • C:\Users\Admin\AppData\Local\Temp\1012470001\rhnew.exe

                    Filesize

                    1.8MB

                    MD5

                    90aa0042c2825073aac9d8cb97a3696d

                    SHA1

                    3bc907a5ddd6172fb9ce4b672feed48e3c2da961

                    SHA256

                    106d17aab9be8de992208dfce5f7fde982f0082d34dae389675ce1e19e168cae

                    SHA512

                    1547e0ef3dd94c4e05f430be114dadabaca8c29c589d9ca27d141e0eb3508d9b5557755cc0d081833b993397203b14d10248a947c92fcf0caf86416a07fc13f9

                  • C:\Users\Admin\AppData\Local\Temp\1012471001\ab4d5787b4.exe

                    Filesize

                    1.7MB

                    MD5

                    659626f9b237cc63c9312b4ee6779fe4

                    SHA1

                    28a0255714ac4f52d892d6e5c912ee35294d41b9

                    SHA256

                    46f5ccca9761ebfcaab4398177c12ce9138851f5d956ce77057b78e8e1ebcd23

                    SHA512

                    e608a5f0dc3cd39d7b5606020438cb7d3b762b00ade7de509c95cf8a1917046998f4439f6434111b4504c4bccead9a1fd6a5c4b4778800e92d34aafeb0c92ffb

                  • C:\Users\Admin\AppData\Local\Temp\1012472001\8536346613.exe

                    Filesize

                    5.0MB

                    MD5

                    3cefe657842d51dac2bae694606dcef9

                    SHA1

                    5d1a1be06fbf467999fafa247e2d9a88d79a5164

                    SHA256

                    069a2de7d9a3cf067a8870596b6da48938a3110698dba7db83c622a3b9f74843

                    SHA512

                    2dbf96f2d2a9683be5b4976dd3054a1b96780a13d52739c7a59406dcfa0389af47575b9d5a1c7b5e3d9e924420337cb402f080bc8ab3eb4853bb79e2d9036d10

                  • C:\Users\Admin\AppData\Local\Temp\1012473001\f6b11cc3cc.exe

                    Filesize

                    949KB

                    MD5

                    607b571347184731f35542f8625a85dd

                    SHA1

                    624b1a58c688cffcf2946b66c0100baca5b887fc

                    SHA256

                    12f682be3ebf7eadeca00dc0a5932c26268ff16d47760b68b44afed4e385df4c

                    SHA512

                    e885d78ec2c813e22c772ed99f09e68be16024334f867b8edacdbfbffbff527d2b02ccaf1df2f86b510bbc8e5a74d99298fec46a63a32c8678403067047d3194

                  • C:\Users\Admin\AppData\Local\Temp\1012474001\73ccf42900.exe

                    Filesize

                    2.7MB

                    MD5

                    38b7f3afd27a489ce0bb5dd6013336a6

                    SHA1

                    e0bd638da4d60d4d7da4018feaf6fe2660658b3f

                    SHA256

                    ecadc37e114a2038d48c9709791157d27e9233243726a65f2099856817a0c68a

                    SHA512

                    1ee01b32c2a16a8a389c3dd435a19dd6d22d255decb18486016b35d65224f4bee217ee4db0a79c3065cdc0ca9c0dd7e24fac8a699e68a8730e82458ae69f7e7c

                  • C:\Users\Admin\AppData\Local\Temp\1012475001\wL3EGdM.exe

                    Filesize

                    3.3MB

                    MD5

                    7823e902900881094372948957825fe1

                    SHA1

                    297a663f3b64fb9863164d10ac698bef03dd3a0f

                    SHA256

                    92d36e5fb3fdbf10ad10c7880c40013c2e21b8a49e20720137d2b4851681233f

                    SHA512

                    60d4ea35cfec5154cfa3cb767de7c839ca8b3987b27599ea218ec1c47f1d111a59f193cd3cfd1266ae384434ae653f1e0a297f7222a2592e529b2b4404dd6238

                  • C:\Users\Admin\AppData\Local\Temp\Cab2500.tmp

                    Filesize

                    70KB

                    MD5

                    49aebf8cbd62d92ac215b2923fb1b9f5

                    SHA1

                    1723be06719828dda65ad804298d0431f6aff976

                    SHA256

                    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                    SHA512

                    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                  • C:\Users\Admin\AppData\Local\Temp\Tar2522.tmp

                    Filesize

                    181KB

                    MD5

                    4ea6026cf93ec6338144661bf1202cd1

                    SHA1

                    a1dec9044f750ad887935a01430bf49322fbdcb7

                    SHA256

                    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                    SHA512

                    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                    Filesize

                    442KB

                    MD5

                    85430baed3398695717b0263807cf97c

                    SHA1

                    fffbee923cea216f50fce5d54219a188a5100f41

                    SHA256

                    a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                    SHA512

                    06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                    Filesize

                    8.0MB

                    MD5

                    a01c5ecd6108350ae23d2cddf0e77c17

                    SHA1

                    c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                    SHA256

                    345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                    SHA512

                    b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

                    Filesize

                    7KB

                    MD5

                    0003d5a3c41562251f038386ec2e0eeb

                    SHA1

                    f52da38b50fc386c82af5a76f789df056029db9a

                    SHA256

                    31835ae3ff0269aa77f5dab5f141421f9ac0e413f15f6800dd27fe03c6346ea9

                    SHA512

                    e0dbf55cb5bea8b82804e71fd240a94795a479077e63249b6eec82ba25aca013087e48575aaf0026f7a3618b06c4e595a234430cb5c39dc099627af90cfd0864

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\datareporting\glean\db\data.safe.bin

                    Filesize

                    2KB

                    MD5

                    4cbc7e827482e87d71d5f962825e30a9

                    SHA1

                    a048ea402799e82c7d38ed56f9fce580f3459b66

                    SHA256

                    cf222b6269c3a97de5723979b205e907549bbd63b53001492bb4aee75f704f5a

                    SHA512

                    7054798c86d40ed4cd4db22548a2a6f6bc65aaed26aab090d88b8e9a26d5d3e8f40ae322585ca930d8d6f760b87fbf7b3261595d09b9dd465f4d52403547df7d

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\datareporting\glean\pending_pings\00363589-204d-4c79-a95e-8d85d42392b9

                    Filesize

                    745B

                    MD5

                    39b14fba0374a3a2bd46667272734652

                    SHA1

                    342ed10481d5e7d332e253a697c0fc7b1980cd3d

                    SHA256

                    41916ab1ab093ce7477442cf34d08a2f10729773ee1acff094c22a29914459f9

                    SHA512

                    888ebe1ff0bdb0e2dc37952b85f8718c06fdc13ffd5364d12ae8f9793d2bb8fa935c45b7ab5282af8a40d3cbc8f1f3925c6e5bbb996294351dcffc494db2f6a9

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\datareporting\glean\pending_pings\87ef777d-7336-4dd0-bb7a-2a42ec4a57f0

                    Filesize

                    11KB

                    MD5

                    b6c96f1336a6f7528798ba2dbb68fe7e

                    SHA1

                    d05077f235fc2e2cd257c187e0893fde932114b0

                    SHA256

                    0d65523f7bd410933a58d0053c55a0ba2d3f333f3d0949a5a100aecbeb358d8a

                    SHA512

                    6ce491b05229006299905cba4864f75fda72220bbeb47e7662a55a28678bf609e554388b01c912c5cc47d91c7122a0499455a629ae83b34dd024209930f1caaf

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                    Filesize

                    997KB

                    MD5

                    fe3355639648c417e8307c6d051e3e37

                    SHA1

                    f54602d4b4778da21bc97c7238fc66aa68c8ee34

                    SHA256

                    1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                    SHA512

                    8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                    Filesize

                    116B

                    MD5

                    3d33cdc0b3d281e67dd52e14435dd04f

                    SHA1

                    4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                    SHA256

                    f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                    SHA512

                    a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                    Filesize

                    479B

                    MD5

                    49ddb419d96dceb9069018535fb2e2fc

                    SHA1

                    62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                    SHA256

                    2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                    SHA512

                    48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                    Filesize

                    372B

                    MD5

                    8be33af717bb1b67fbd61c3f4b807e9e

                    SHA1

                    7cf17656d174d951957ff36810e874a134dd49e0

                    SHA256

                    e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                    SHA512

                    6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                    Filesize

                    11.8MB

                    MD5

                    33bf7b0439480effb9fb212efce87b13

                    SHA1

                    cee50f2745edc6dc291887b6075ca64d716f495a

                    SHA256

                    8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                    SHA512

                    d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                    Filesize

                    1KB

                    MD5

                    688bed3676d2104e7f17ae1cd2c59404

                    SHA1

                    952b2cdf783ac72fcb98338723e9afd38d47ad8e

                    SHA256

                    33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                    SHA512

                    7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                    Filesize

                    1KB

                    MD5

                    937326fead5fd401f6cca9118bd9ade9

                    SHA1

                    4526a57d4ae14ed29b37632c72aef3c408189d91

                    SHA256

                    68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                    SHA512

                    b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\prefs-1.js

                    Filesize

                    6KB

                    MD5

                    96925bdfb8445fb329186c0ea42b8565

                    SHA1

                    2a3f1b3fbdc3d9d406e87a942609d09eead4fe7a

                    SHA256

                    4cef3e9ce04e295d4c55d9845b6065db9d6ef66f6dd92bb4354af313794f5352

                    SHA512

                    9fa961f473d786e676658914b9fa7b8922d51f16be6609cf553f1ab04b0ba85ae379429f8aacb7b51b35b2e568d3cb53c3fe7df87b576d042601030618d4bfef

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\prefs-1.js

                    Filesize

                    7KB

                    MD5

                    3a8cbf951f19e269ed80f90d4c5bd108

                    SHA1

                    92daaf518a8a31054ba2462e2f1a58ccc6b8b390

                    SHA256

                    12fb0445e06cc17aed753501bf6fe474f67312ce35f290ef7d4c96723522dc8b

                    SHA512

                    cdab451c4440e059b3772fdb848638a275dc193fe36cf05abdbefc7b573e86ee49a9184484433902e655de839c3108f0f533e54342439690a28c343e0993b64b

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\prefs-1.js

                    Filesize

                    7KB

                    MD5

                    d7fd121f57e6dedd75c4881336ea3f58

                    SHA1

                    78812c8f7bd3e7e2624d0e88dc9acecf7bffb594

                    SHA256

                    7a9a290cf4010a886250f48a503dc50210cce88b0bc7d78418684ce95951fd1b

                    SHA512

                    deb45f0d12d51914c2b4691be76b164d2d3aadfa10de6f900d92bf42450c7e9b56092ef9577435dc3abdec46bbfd8d1b385fb77b0b203728655a3b8cf262c4cd

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\sessionstore-backups\recovery.jsonlz4

                    Filesize

                    4KB

                    MD5

                    e1c7d84e9853adddcfde9c35ba53da3c

                    SHA1

                    13ede5de62e09bc84f2f152f43989937ad71e8fc

                    SHA256

                    c9817f575468cf819c36e58d36c8ca596faa70d26bb0af5ba9f57214df106bc4

                    SHA512

                    57488711d5beb550d9b2ac83d413b14cb76009a36a85328684067150d44db799ebc1a1236ab9aa4e99e5f8ea71bf0342b9899302dd498ae6ca739896f6715b14

                  • \Users\Admin\AppData\Local\Temp\Ev3e4eD8ERBE0f3f4ee\Y-Cleaner.exe

                    Filesize

                    1.4MB

                    MD5

                    a8cf5621811f7fac55cfe8cb3fa6b9f6

                    SHA1

                    121356839e8138a03141f5f5856936a85bd2a474

                    SHA256

                    614a0362ab87cee48d0935b5bb957d539be1d94c6fdeb3fe42fac4fbe182c10c

                    SHA512

                    4479d951435f222ca7306774002f030972c9f1715d6aaf512fca9420dd79cb6d08240f80129f213851773290254be34f0ff63c7b1f4d554a7db5f84b69e84bdd

                  • \Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

                    Filesize

                    3.1MB

                    MD5

                    ed3fa7460523c5ec9d4568e754624405

                    SHA1

                    88ad04cf36c7fe20644d48572ec2e70569c9581b

                    SHA256

                    d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c

                    SHA512

                    4ff0b5009effb0630cb3cd5dcd7291bc645cb2d59d1975eaef2cec17f379e00317c44de5ed4b07ec607745571521fff380acbfb98afe3710e5ec2dae36bd1add

                  • memory/1756-115-0x00000000008D0000-0x0000000001583000-memory.dmp

                    Filesize

                    12.7MB

                  • memory/1756-241-0x00000000008D0000-0x0000000001583000-memory.dmp

                    Filesize

                    12.7MB

                  • memory/1756-75-0x00000000008D0000-0x0000000001583000-memory.dmp

                    Filesize

                    12.7MB

                  • memory/1756-119-0x00000000008D0000-0x0000000001583000-memory.dmp

                    Filesize

                    12.7MB

                  • memory/1756-37522-0x00000000008D0000-0x0000000001583000-memory.dmp

                    Filesize

                    12.7MB

                  • memory/1952-141-0x0000000000A40000-0x0000000000F43000-memory.dmp

                    Filesize

                    5.0MB

                  • memory/2148-116-0x0000000001110000-0x0000000001590000-memory.dmp

                    Filesize

                    4.5MB

                  • memory/2148-146-0x0000000001110000-0x0000000001590000-memory.dmp

                    Filesize

                    4.5MB

                  • memory/2148-161-0x0000000001110000-0x0000000001590000-memory.dmp

                    Filesize

                    4.5MB

                  • memory/2148-37520-0x0000000001110000-0x0000000001590000-memory.dmp

                    Filesize

                    4.5MB

                  • memory/2272-95-0x0000000000A70000-0x0000000000F19000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/2272-370-0x0000000000A70000-0x0000000000F19000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/2272-142-0x0000000000A70000-0x0000000000F19000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/2272-129-0x0000000000A70000-0x0000000000F19000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/2280-78-0x0000000000400000-0x0000000000C68000-memory.dmp

                    Filesize

                    8.4MB

                  • memory/2280-96-0x0000000000400000-0x0000000000C68000-memory.dmp

                    Filesize

                    8.4MB

                  • memory/2280-50-0x0000000000400000-0x0000000000C68000-memory.dmp

                    Filesize

                    8.4MB

                  • memory/2280-371-0x0000000000400000-0x0000000000C68000-memory.dmp

                    Filesize

                    8.4MB

                  • memory/2280-37669-0x0000000000400000-0x0000000000C68000-memory.dmp

                    Filesize

                    8.4MB

                  • memory/2280-57-0x0000000010000000-0x000000001001C000-memory.dmp

                    Filesize

                    112KB

                  • memory/2280-145-0x0000000000400000-0x0000000000C68000-memory.dmp

                    Filesize

                    8.4MB

                  • memory/2484-45-0x0000000001050000-0x0000000001365000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/2484-52-0x0000000001050000-0x0000000001365000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/2484-98-0x0000000001050000-0x0000000001365000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/2484-113-0x0000000006B00000-0x00000000077B3000-memory.dmp

                    Filesize

                    12.7MB

                  • memory/2484-93-0x0000000006B00000-0x0000000007368000-memory.dmp

                    Filesize

                    8.4MB

                  • memory/2484-94-0x0000000006B00000-0x0000000006FA9000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/2484-49-0x0000000006B00000-0x0000000007368000-memory.dmp

                    Filesize

                    8.4MB

                  • memory/2484-77-0x0000000006B00000-0x0000000007368000-memory.dmp

                    Filesize

                    8.4MB

                  • memory/2484-74-0x0000000006B00000-0x00000000077B3000-memory.dmp

                    Filesize

                    12.7MB

                  • memory/2484-277-0x00000000064E0000-0x0000000006794000-memory.dmp

                    Filesize

                    2.7MB

                  • memory/2484-144-0x0000000001050000-0x0000000001365000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/2484-137-0x0000000006B00000-0x0000000007003000-memory.dmp

                    Filesize

                    5.0MB

                  • memory/2484-143-0x0000000006B00000-0x0000000006F80000-memory.dmp

                    Filesize

                    4.5MB

                  • memory/2484-23-0x0000000001051000-0x00000000010B9000-memory.dmp

                    Filesize

                    416KB

                  • memory/2484-1859-0x00000000064E0000-0x0000000006794000-memory.dmp

                    Filesize

                    2.7MB

                  • memory/2484-46-0x0000000006B00000-0x0000000007368000-memory.dmp

                    Filesize

                    8.4MB

                  • memory/2484-47-0x0000000001050000-0x0000000001365000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/2484-120-0x0000000006B00000-0x0000000006FA9000-memory.dmp

                    Filesize

                    4.7MB

                  • memory/2484-48-0x0000000001051000-0x00000000010B9000-memory.dmp

                    Filesize

                    416KB

                  • memory/2484-114-0x0000000006B00000-0x0000000006F80000-memory.dmp

                    Filesize

                    4.5MB

                  • memory/2484-138-0x0000000006B00000-0x0000000007003000-memory.dmp

                    Filesize

                    5.0MB

                  • memory/2484-51-0x0000000001050000-0x0000000001365000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/2484-28-0x0000000001050000-0x0000000001365000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/2484-26-0x0000000001050000-0x0000000001365000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/2484-24-0x0000000001050000-0x0000000001365000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/2484-22-0x0000000001050000-0x0000000001365000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/2484-390-0x0000000001050000-0x0000000001365000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/2568-1-0x0000000076F60000-0x0000000076F62000-memory.dmp

                    Filesize

                    8KB

                  • memory/2568-16-0x0000000006750000-0x0000000006A65000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/2568-17-0x0000000006750000-0x0000000006A65000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/2568-21-0x0000000000A51000-0x0000000000AB9000-memory.dmp

                    Filesize

                    416KB

                  • memory/2568-20-0x0000000000A50000-0x0000000000D65000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/2568-27-0x0000000000A50000-0x0000000000D65000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/2568-4-0x0000000000A50000-0x0000000000D65000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/2568-2-0x0000000000A51000-0x0000000000AB9000-memory.dmp

                    Filesize

                    416KB

                  • memory/2568-3-0x0000000000A50000-0x0000000000D65000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/2568-0-0x0000000000A50000-0x0000000000D65000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/3512-310-0x0000000001130000-0x00000000013E4000-memory.dmp

                    Filesize

                    2.7MB

                  • memory/3512-309-0x0000000001130000-0x00000000013E4000-memory.dmp

                    Filesize

                    2.7MB

                  • memory/3780-409-0x0000000005250000-0x0000000005402000-memory.dmp

                    Filesize

                    1.7MB

                  • memory/3780-401-0x0000000005250000-0x0000000005402000-memory.dmp

                    Filesize

                    1.7MB

                  • memory/3780-429-0x0000000005250000-0x0000000005402000-memory.dmp

                    Filesize

                    1.7MB

                  • memory/3780-431-0x0000000005250000-0x0000000005402000-memory.dmp

                    Filesize

                    1.7MB

                  • memory/3780-407-0x0000000005250000-0x0000000005402000-memory.dmp

                    Filesize

                    1.7MB

                  • memory/3780-435-0x0000000005250000-0x0000000005402000-memory.dmp

                    Filesize

                    1.7MB

                  • memory/3780-437-0x0000000005250000-0x0000000005402000-memory.dmp

                    Filesize

                    1.7MB

                  • memory/3780-421-0x0000000005250000-0x0000000005402000-memory.dmp

                    Filesize

                    1.7MB

                  • memory/3780-419-0x0000000005250000-0x0000000005402000-memory.dmp

                    Filesize

                    1.7MB

                  • memory/3780-417-0x0000000005250000-0x0000000005402000-memory.dmp

                    Filesize

                    1.7MB

                  • memory/3780-415-0x0000000005250000-0x0000000005402000-memory.dmp

                    Filesize

                    1.7MB

                  • memory/3780-413-0x0000000005250000-0x0000000005402000-memory.dmp

                    Filesize

                    1.7MB

                  • memory/3780-427-0x0000000005250000-0x0000000005402000-memory.dmp

                    Filesize

                    1.7MB

                  • memory/3780-411-0x0000000005250000-0x0000000005402000-memory.dmp

                    Filesize

                    1.7MB

                  • memory/3780-433-0x0000000005250000-0x0000000005402000-memory.dmp

                    Filesize

                    1.7MB

                  • memory/3780-425-0x0000000005250000-0x0000000005402000-memory.dmp

                    Filesize

                    1.7MB

                  • memory/3780-405-0x0000000005250000-0x0000000005402000-memory.dmp

                    Filesize

                    1.7MB

                  • memory/3780-403-0x0000000005250000-0x0000000005402000-memory.dmp

                    Filesize

                    1.7MB

                  • memory/3780-391-0x0000000005250000-0x0000000005408000-memory.dmp

                    Filesize

                    1.7MB

                  • memory/3780-392-0x0000000005250000-0x0000000005402000-memory.dmp

                    Filesize

                    1.7MB

                  • memory/3780-393-0x0000000005250000-0x0000000005402000-memory.dmp

                    Filesize

                    1.7MB

                  • memory/3780-395-0x0000000005250000-0x0000000005402000-memory.dmp

                    Filesize

                    1.7MB

                  • memory/3780-399-0x0000000005250000-0x0000000005402000-memory.dmp

                    Filesize

                    1.7MB

                  • memory/3780-423-0x0000000005250000-0x0000000005402000-memory.dmp

                    Filesize

                    1.7MB

                  • memory/3780-397-0x0000000005250000-0x0000000005402000-memory.dmp

                    Filesize

                    1.7MB

                  • memory/3780-389-0x0000000000120000-0x000000000047E000-memory.dmp

                    Filesize

                    3.4MB

                  • memory/7308-37691-0x0000000000950000-0x0000000000CAE000-memory.dmp

                    Filesize

                    3.4MB

                  • memory/9620-37589-0x0000000000080000-0x000000000009A000-memory.dmp

                    Filesize

                    104KB