Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    06/12/2024, 00:17

General

  • Target

    458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe

  • Size

    1.8MB

  • MD5

    cd86e4c2fbaf81cb17606d69108fff47

  • SHA1

    97117dadf1a95214ceaf1d1d9337dae317c6a358

  • SHA256

    458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e

  • SHA512

    42393ee97337b197a176032276b9da8bd3ba26d5e5a36751130271422a9cb0a91d50a22c9f75e4de77083b47d8b6c7f54c5f1ebccd09f97dbba8eb6591554748

  • SSDEEP

    49152:1hYf1buEc90mDAkzorHA/GJKEmQVhiln:Mf1qEcvDTSNXmQVh6

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

xworm

C2

185.196.8.239:7000

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    WindowsUpdaterConf.exe

  • telegram

    https://api.telegram.org/bot8070077125:AAEdRIyp1anHye9Y0jcV8uNF6U4mmijN8Pk/sendMessage?chat_id=1818813749

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://atten-supporse.biz/api

Extracted

Family

stealc

Botnet

drum

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

gcleaner

C2

92.63.197.221

45.91.200.135

Extracted

Family

lumma

C2

https://atten-supporse.biz/api

https://se-blurry.biz/api

https://zinc-sneark.biz/api

https://dwell-exclaim.biz/api

https://formy-spill.biz/api

https://covery-mover.biz/api

https://dare-curbys.biz/api

https://print-vexer.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Detect Xworm Payload 1 IoCs
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

  • Gcleaner family
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 13 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 20 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 5 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of FindShellTrayWindow 16 IoCs
  • Suspicious use of SendNotifyMessage 13 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe
    "C:\Users\Admin\AppData\Local\Temp\458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1448
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2868
      • C:\Users\Admin\AppData\Local\Temp\1012382001\i1A5m12.exe
        "C:\Users\Admin\AppData\Local\Temp\1012382001\i1A5m12.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2848
        • C:\Users\Admin\AppData\Local\Temp\is-HMOUS.tmp\i1A5m12.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-HMOUS.tmp\i1A5m12.tmp" /SL5="$80216,3291517,54272,C:\Users\Admin\AppData\Local\Temp\1012382001\i1A5m12.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1248
          • C:\Windows\SysWOW64\net.exe
            "C:\Windows\system32\net.exe" pause raf_encoder_1252
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1052
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 pause raf_encoder_1252
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2148
          • C:\Users\Admin\AppData\Local\RAF Encoder 1.0.1.55\rafencoder.exe
            "C:\Users\Admin\AppData\Local\RAF Encoder 1.0.1.55\rafencoder.exe" -i
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Modifies system certificate store
            PID:2120
      • C:\Users\Admin\AppData\Local\Temp\1012475001\wL3EGdM.exe
        "C:\Users\Admin\AppData\Local\Temp\1012475001\wL3EGdM.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:632
        • C:\Users\Admin\AppData\Local\Temp\1012475001\wL3EGdM.exe
          "C:\Users\Admin\AppData\Local\Temp\1012475001\wL3EGdM.exe"
          4⤵
          • Drops startup file
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:5108
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1012475001\wL3EGdM.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2760
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'wL3EGdM.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2600
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\WindowsUpdaterConf.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:1632
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsUpdaterConf.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:892
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WindowsUpdaterConf" /tr "C:\Users\Admin\WindowsUpdaterConf.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:3160
        • C:\Windows\SysWOW64\cmd.exe
          "cmd" /c timeout /t 1 && DEL /f wL3EGdM.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1180
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 1
            5⤵
            • System Location Discovery: System Language Discovery
            • Delays execution with timeout.exe
            PID:636
      • C:\Users\Admin\AppData\Local\Temp\1012549001\a4f04596a1.exe
        "C:\Users\Admin\AppData\Local\Temp\1012549001\a4f04596a1.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        PID:4932
      • C:\Users\Admin\AppData\Local\Temp\1012550001\348e03bb82.exe
        "C:\Users\Admin\AppData\Local\Temp\1012550001\348e03bb82.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        PID:3452
      • C:\Users\Admin\AppData\Local\Temp\1012551001\919e5e3042.exe
        "C:\Users\Admin\AppData\Local\Temp\1012551001\919e5e3042.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4308
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM firefox.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4388
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM chrome.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4568
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM msedge.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4656
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM opera.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1596
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM brave.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1520
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
          4⤵
            PID:1884
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
              5⤵
              • Checks processor information in registry
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:608
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="608.0.958296279\1822373202" -parentBuildID 20221007134813 -prefsHandle 1228 -prefMapHandle 1220 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {97f4b98d-5084-460d-b90a-edab2b0c8960} 608 "\\.\pipe\gecko-crash-server-pipe.608" 1292 117f3858 gpu
                6⤵
                  PID:1548
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="608.1.1811131672\1158441175" -parentBuildID 20221007134813 -prefsHandle 1496 -prefMapHandle 1492 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {283b4490-5d36-489c-9dbf-69f3dcb60e4e} 608 "\\.\pipe\gecko-crash-server-pipe.608" 1508 d71558 socket
                  6⤵
                    PID:2780
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="608.2.1923937345\1959328136" -childID 1 -isForBrowser -prefsHandle 2096 -prefMapHandle 1916 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 792 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4f49d344-f00f-45a3-b022-914b3d214ab4} 608 "\\.\pipe\gecko-crash-server-pipe.608" 2108 1a5ca858 tab
                    6⤵
                      PID:1308
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="608.3.2146878614\516570608" -childID 2 -isForBrowser -prefsHandle 2948 -prefMapHandle 2944 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 792 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {53abb527-e46d-4a9d-821f-8edd7eb37459} 608 "\\.\pipe\gecko-crash-server-pipe.608" 2960 d5d258 tab
                      6⤵
                        PID:3464
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="608.4.180954198\864184680" -childID 3 -isForBrowser -prefsHandle 3732 -prefMapHandle 3728 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 792 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {61aa08ab-c35d-4119-bb4f-289e512f7bc8} 608 "\\.\pipe\gecko-crash-server-pipe.608" 3744 1f78d058 tab
                        6⤵
                          PID:4748
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="608.5.537799698\1120326077" -childID 4 -isForBrowser -prefsHandle 3852 -prefMapHandle 3856 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 792 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {88112841-7c41-465f-a682-c68fb83099ab} 608 "\\.\pipe\gecko-crash-server-pipe.608" 3840 1f78df58 tab
                          6⤵
                            PID:3036
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="608.6.1549473343\229366962" -childID 5 -isForBrowser -prefsHandle 4052 -prefMapHandle 4056 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 792 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba9b0375-272e-4088-911a-7b47b2d872db} 608 "\\.\pipe\gecko-crash-server-pipe.608" 4040 1feb2e58 tab
                            6⤵
                              PID:1844
                      • C:\Users\Admin\AppData\Local\Temp\1012552001\f20db32785.exe
                        "C:\Users\Admin\AppData\Local\Temp\1012552001\f20db32785.exe"
                        3⤵
                        • Modifies Windows Defender Real-time Protection settings
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Windows security modification
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2844
                      • C:\Users\Admin\AppData\Local\Temp\1012553001\eec1130907.exe
                        "C:\Users\Admin\AppData\Local\Temp\1012553001\eec1130907.exe"
                        3⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Loads dropped DLL
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • System Location Discovery: System Language Discovery
                        PID:3388
                  • C:\Windows\system32\taskeng.exe
                    taskeng.exe {B14851AD-09F7-4F91-8325-78173D5D17CF} S-1-5-21-1488793075-819845221-1497111674-1000:UPNECVIU\Admin:Interactive:[1]
                    1⤵
                      PID:4212
                      • C:\Users\Admin\WindowsUpdaterConf.exe
                        C:\Users\Admin\WindowsUpdaterConf.exe
                        2⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4632
                      • C:\Users\Admin\WindowsUpdaterConf.exe
                        C:\Users\Admin\WindowsUpdaterConf.exe
                        2⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5088

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      Filesize

                      342B

                      MD5

                      0698bc248686cf560e7b8dfc83f5dac9

                      SHA1

                      dd6488d5082d9c52ec3660b018062eb0802b7c33

                      SHA256

                      bedfe9c5703ce2e5ef39ca2497e6b3b48c547dcf03163d8e7c5c14fb7d1cf87a

                      SHA512

                      24b6785af1308991ba37f449f32cdbaeee5050b6b4bac3abb565374b8bc0dca35b452c8277173a8553c615467a26a48b657e900a73611e7f846e5f7c0060b896

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PLSLTMYI\download[1].htm

                      Filesize

                      1B

                      MD5

                      cfcd208495d565ef66e7dff9f98764da

                      SHA1

                      b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                      SHA256

                      5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                      SHA512

                      31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1009pdhg.default-release\activity-stream.discovery_stream.json.tmp

                      Filesize

                      30KB

                      MD5

                      196b8690a68da78546177d7194f8a3b3

                      SHA1

                      59624f649ad63e487256c9d79be4838b63ddf4c4

                      SHA256

                      561085325bbb0cda4373be858d301f2c891852ba5c431d6e99a9e7b4dfcaaa26

                      SHA512

                      845c91d85f9b20d25e11aa71f2030d94250be5ebf726d4314d13df8ae58a5ece0d9deab52a518fd64a8007e02fbfde2e0c1803e326d66de1c0066a2c98ed2692

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1009pdhg.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

                      Filesize

                      15KB

                      MD5

                      96c542dec016d9ec1ecc4dddfcbaac66

                      SHA1

                      6199f7648bb744efa58acf7b96fee85d938389e4

                      SHA256

                      7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                      SHA512

                      cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                    • C:\Users\Admin\AppData\Local\Temp\1012382001\i1A5m12.exe

                      Filesize

                      3.4MB

                      MD5

                      3a16d0e4e4522073da3c8a5a9f9e790b

                      SHA1

                      7a42a21a348d2e49c67b426d333a5c354ed2c83e

                      SHA256

                      ccc4dd64df98c26da462a17a8df9f927d02e202d88ada8cfba92b7bbeb954c3e

                      SHA512

                      1213c3e077b660afa65133f0b5943bd866f02d736284791dc99ae4d30c6ed7705eb55999cb4a3be1cc0a394111904154bc72a2d0f1fdc453893ecf9a4a25b99a

                    • C:\Users\Admin\AppData\Local\Temp\1012475001\wL3EGdM.exe

                      Filesize

                      3.3MB

                      MD5

                      7823e902900881094372948957825fe1

                      SHA1

                      297a663f3b64fb9863164d10ac698bef03dd3a0f

                      SHA256

                      92d36e5fb3fdbf10ad10c7880c40013c2e21b8a49e20720137d2b4851681233f

                      SHA512

                      60d4ea35cfec5154cfa3cb767de7c839ca8b3987b27599ea218ec1c47f1d111a59f193cd3cfd1266ae384434ae653f1e0a297f7222a2592e529b2b4404dd6238

                    • C:\Users\Admin\AppData\Local\Temp\1012548001\rhnew.exe

                      Filesize

                      612B

                      MD5

                      e3eb0a1df437f3f97a64aca5952c8ea0

                      SHA1

                      7dd71afcfb14e105e80b0c0d7fce370a28a41f0a

                      SHA256

                      38ffd4972ae513a0c79a8be4573403edcd709f0f572105362b08ff50cf6de521

                      SHA512

                      43573b0cbaac6e2e1646e6217d2d10c40ad10b9db1f4492d6740545e793c891b5e39283a082896c0392b88eb319dfa9392421b1c89c094c9ce9f31b53d37ebaf

                    • C:\Users\Admin\AppData\Local\Temp\1012549001\a4f04596a1.exe

                      Filesize

                      1.8MB

                      MD5

                      14553b3e4f83021e14520e0f62f95a24

                      SHA1

                      35f37fc3ed8d53920b96b8485e741097cfcd05ba

                      SHA256

                      d31671f91056db4b63277269b84841872b047643116fce88f5952393daa22691

                      SHA512

                      9f1a23fa7632155407bdbe9eb2a21708b241906d817c9eaa8cfef2ca65acf67135d8b8e7249b580f67685ccec9b487b65ff1c48378af6418bc7976393dbfdc90

                    • C:\Users\Admin\AppData\Local\Temp\1012550001\348e03bb82.exe

                      Filesize

                      4.9MB

                      MD5

                      ebe3d112a464bca87d0600558998c287

                      SHA1

                      e24f303f33d3d4bd2afc5bc0392de5f14e4bd72a

                      SHA256

                      08c78546997ccfbffb833a115f8888ad128e5c4d43bddd9e01e2105132ef0824

                      SHA512

                      fcfd10bd5c930ec50bfa011752db8a28526994712ecb3b905d2d892099df69dcc90ff881669f5b323b99ae9a19061cb5c8abb86b18fc31012d9b91b653c24bed

                    • C:\Users\Admin\AppData\Local\Temp\1012551001\919e5e3042.exe

                      Filesize

                      948KB

                      MD5

                      9e7ce696dfdb127b028a0610a441047d

                      SHA1

                      79a7805f957617896fd16ec5d1db102d9809f667

                      SHA256

                      bcb1df1e3ce692f4e284bf91f1873696933a5f2ffd87ac966b719e492b43d1eb

                      SHA512

                      b226a736eee638e1ef2dc4dfdb6193b23756b525d665209efc6094ba119ddff3004844b8439034e67d79ded9ddff82369edf6d735f72a0e916763dedfa6d1c0a

                    • C:\Users\Admin\AppData\Local\Temp\1012552001\f20db32785.exe

                      Filesize

                      2.6MB

                      MD5

                      10f89bc59dd3ebb89c8437a590abbb97

                      SHA1

                      cb65670a5597fe2bca2423648b7e8325eedbe112

                      SHA256

                      252af078fcf7992ce1afa0449ffa8591725bf9c46219b19d85369fdc657c8b00

                      SHA512

                      60d3cedf0b29d9dfdf0eb030ffa817fb102f72bbe6cc5e105d17cd9ddd355c3e9e4374f10bef70919d033f83b3eb1f311bf868bc922633ba8482a9776c84db5d

                    • C:\Users\Admin\AppData\Local\Temp\1012553001\eec1130907.exe

                      Filesize

                      1.9MB

                      MD5

                      89109257f23f068de9f04a3c59df2b15

                      SHA1

                      03ea7063a9d7b54bcdea8f11a990e668d9346121

                      SHA256

                      74567ee5c75fd4a34c44dc8c75e9f4ea1dcf3c60d6d3fff4e8d8526460e49b10

                      SHA512

                      b3203b1dbbb28a8f0e69e067c9b48e6a930e05046674f3b7f82a76b4b2ff0f8535150ed46dddbe8421fe4ced283f9edf76e2d15f54c454d43771f4e350655f48

                    • C:\Users\Admin\AppData\Local\Temp\CabB933.tmp

                      Filesize

                      70KB

                      MD5

                      49aebf8cbd62d92ac215b2923fb1b9f5

                      SHA1

                      1723be06719828dda65ad804298d0431f6aff976

                      SHA256

                      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                      SHA512

                      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                    • C:\Users\Admin\AppData\Local\Temp\TarB956.tmp

                      Filesize

                      181KB

                      MD5

                      4ea6026cf93ec6338144661bf1202cd1

                      SHA1

                      a1dec9044f750ad887935a01430bf49322fbdcb7

                      SHA256

                      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                      SHA512

                      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

                      Filesize

                      1.8MB

                      MD5

                      cd86e4c2fbaf81cb17606d69108fff47

                      SHA1

                      97117dadf1a95214ceaf1d1d9337dae317c6a358

                      SHA256

                      458d36f8118c122fcd17e2ea1859282fd29e5f774ab7998787150c4f21ed360e

                      SHA512

                      42393ee97337b197a176032276b9da8bd3ba26d5e5a36751130271422a9cb0a91d50a22c9f75e4de77083b47d8b6c7f54c5f1ebccd09f97dbba8eb6591554748

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                      Filesize

                      442KB

                      MD5

                      85430baed3398695717b0263807cf97c

                      SHA1

                      fffbee923cea216f50fce5d54219a188a5100f41

                      SHA256

                      a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                      SHA512

                      06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                      Filesize

                      8.0MB

                      MD5

                      a01c5ecd6108350ae23d2cddf0e77c17

                      SHA1

                      c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                      SHA256

                      345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                      SHA512

                      b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

                      Filesize

                      7KB

                      MD5

                      2662a9600ccd59babd54e97f51aa90ba

                      SHA1

                      ee58912ec6d633df026a86b97dc1600226b5a8b6

                      SHA256

                      1491d0a4c702b279cdadcff9b19c30765e0efad67e62cd7c3aa605e5eb080de5

                      SHA512

                      8da4a0e94a6c5f82f5bd0ed6c8788051500cd5ff8985a027b91a015e204f881626eb365f860000e5521829c53d2c67520c3598132f036c5e0d0e63b189cfc24f

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\datareporting\glean\db\data.safe.bin

                      Filesize

                      9KB

                      MD5

                      d2929e0f60418bc6fdf14ffbea108ba8

                      SHA1

                      19ba0cd29b7f7300db39e8f11bcfe3ba754940f2

                      SHA256

                      4a488ba89536a3c8ea3d41f7f4ee745e8c322f28f3f7aef7135677f231c1b074

                      SHA512

                      e378cafcb552b915fd8d01d41f48954e7d6db52c6e00b8fdf08cac7c272888c923a6a0aa2536dc352c738664b6206579aba34a48a67173be4a5968004cd8382d

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\datareporting\glean\pending_pings\a95c4b6c-b031-404f-9822-b820a690332a

                      Filesize

                      733B

                      MD5

                      6519958242077f4f8e3f1f56b4c146dc

                      SHA1

                      478b320acaf5f62e2e77370419f98133eaef5b24

                      SHA256

                      b751b482770c2e863f43cd275a7bb477820bf1c0f2c804e9c3862d32438c9891

                      SHA512

                      3fce71636cb6634dc15fe87ecd4fbfb7e320bc8319d45b7a3472b6987c7e5dece683f63f6701e7bb6cd5961a44dfd6cc6bd408d2252d10defbe7f9dfd1a491a8

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                      Filesize

                      997KB

                      MD5

                      fe3355639648c417e8307c6d051e3e37

                      SHA1

                      f54602d4b4778da21bc97c7238fc66aa68c8ee34

                      SHA256

                      1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                      SHA512

                      8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                      Filesize

                      116B

                      MD5

                      3d33cdc0b3d281e67dd52e14435dd04f

                      SHA1

                      4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                      SHA256

                      f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                      SHA512

                      a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                      Filesize

                      479B

                      MD5

                      49ddb419d96dceb9069018535fb2e2fc

                      SHA1

                      62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                      SHA256

                      2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                      SHA512

                      48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                      Filesize

                      372B

                      MD5

                      8be33af717bb1b67fbd61c3f4b807e9e

                      SHA1

                      7cf17656d174d951957ff36810e874a134dd49e0

                      SHA256

                      e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                      SHA512

                      6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                      Filesize

                      11.8MB

                      MD5

                      33bf7b0439480effb9fb212efce87b13

                      SHA1

                      cee50f2745edc6dc291887b6075ca64d716f495a

                      SHA256

                      8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                      SHA512

                      d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                      Filesize

                      1KB

                      MD5

                      688bed3676d2104e7f17ae1cd2c59404

                      SHA1

                      952b2cdf783ac72fcb98338723e9afd38d47ad8e

                      SHA256

                      33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                      SHA512

                      7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                      Filesize

                      1KB

                      MD5

                      937326fead5fd401f6cca9118bd9ade9

                      SHA1

                      4526a57d4ae14ed29b37632c72aef3c408189d91

                      SHA256

                      68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                      SHA512

                      b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\prefs-1.js

                      Filesize

                      6KB

                      MD5

                      18b4b540e57b35bbba9f1c766c9d8f29

                      SHA1

                      d19bab482f6bda68994c075a1fdf710e52eaa5ff

                      SHA256

                      059429a7d3f71ed603dc37e25ed0bf9793558ae73a9f14e51917da03b431bd65

                      SHA512

                      575fc671d32e7675c9f1aee365943696838d154aef65f91df9ed4a42965ca7ba407f1682611250710a0f75deaa04da8444e200b283d0010dfe93ab2fbe22edda

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\prefs-1.js

                      Filesize

                      7KB

                      MD5

                      c86b3f084fbb7b89d0ac359d924fd45a

                      SHA1

                      688e9d793790e07d0219638c7fcbb65535578580

                      SHA256

                      1c8ce416332ef727f95b3a86b20922ebff35b290eb9952c4f1c8a759853a3fe9

                      SHA512

                      7033ab834512d0ba885e3ce6b7ebd09c16bdd0172115dac36c698c29dd85934fea133ddf05526357100458f3954d083f8dd18e71dd1f3614c4f7c5b4a30f9ee4

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\prefs-1.js

                      Filesize

                      7KB

                      MD5

                      fc8f911edd88aa04e7176e29a423d70b

                      SHA1

                      fa529cda71a03355d3a79b9bc7e47a94e66b6f8d

                      SHA256

                      0dc11c9d248d3f390815844eacf72a98a3a6aa9257aee08ce2070dd7fdeb351d

                      SHA512

                      25ca6ab8930fe6a44cb7983b0a969d3387a3b569905ad1702655c9f81d64083a9b4a20f81555adf9e111bf6fbd228c64d5965308bc2505de4f9c07259f8a6a3a

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\prefs.js

                      Filesize

                      6KB

                      MD5

                      fe79c287f7eaa45653547fab4635cbb5

                      SHA1

                      034a07048ab5a1c5e5274df8a6ca2e732d4ff7a8

                      SHA256

                      6eb9651a68c3dc6d1a1fdd47791485c21754aaa4f47a1d3ebdb67554be13d7af

                      SHA512

                      82653c9b461ff8ecb485209717d4303dc0f269ef013ddcd62ce438f683d585a2db26069956da3990cefae6c1e7ceb0a44c51e50e2adec7b1e119206e7be3cfbe

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\sessionstore-backups\recovery.jsonlz4

                      Filesize

                      4KB

                      MD5

                      8bcdd220c60a0157d4519979b0513750

                      SHA1

                      bbb59529a9fbf8adeacc9c8aeb6d259e5804bc4d

                      SHA256

                      94075b140afe06d951dbe711d87c0564a7743600faaac40a2959899eeff0e938

                      SHA512

                      f60978b0c7cbeb8a15b7baa85fd0143364202d68f8b3372b3484000676d7d94943e006bfb965137b063d5bb558329d18aed8eabd0010f9feb5f6103f5542e50f

                    • \Users\Admin\AppData\Local\RAF Encoder 1.0.1.55\rafencoder.exe

                      Filesize

                      2.8MB

                      MD5

                      b466bf1dc60388a22cb73be01ca6bf57

                      SHA1

                      21eb9665e42d6c4a8d9e764627049b2a6e3a69a4

                      SHA256

                      e5f0f0c3383080fc2702779e3040c490ab022af69a4bc8c61bf9b1f6514ae7ad

                      SHA512

                      6cb51dae17b3bcef6254ecf6538ecc49cdd53c40c979fd743f49987b28d05c033781b1047dbf25b203b02bf70ce4205dcc1cc5bbea46119cb0e2cd0ce140cbe2

                    • \Users\Admin\AppData\Local\RAF Encoder 1.0.1.55\sqlite3.dll

                      Filesize

                      630KB

                      MD5

                      e477a96c8f2b18d6b5c27bde49c990bf

                      SHA1

                      e980c9bf41330d1e5bd04556db4646a0210f7409

                      SHA256

                      16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

                      SHA512

                      335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

                    • \Users\Admin\AppData\Local\Temp\Vw95Zefd39B3f8\Y-Cleaner.exe

                      Filesize

                      1.4MB

                      MD5

                      a8cf5621811f7fac55cfe8cb3fa6b9f6

                      SHA1

                      121356839e8138a03141f5f5856936a85bd2a474

                      SHA256

                      614a0362ab87cee48d0935b5bb957d539be1d94c6fdeb3fe42fac4fbe182c10c

                      SHA512

                      4479d951435f222ca7306774002f030972c9f1715d6aaf512fca9420dd79cb6d08240f80129f213851773290254be34f0ff63c7b1f4d554a7db5f84b69e84bdd

                    • \Users\Admin\AppData\Local\Temp\is-DJTDS.tmp\_isetup\_iscrypt.dll

                      Filesize

                      2KB

                      MD5

                      a69559718ab506675e907fe49deb71e9

                      SHA1

                      bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                      SHA256

                      2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                      SHA512

                      e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                    • \Users\Admin\AppData\Local\Temp\is-DJTDS.tmp\_isetup\_shfoldr.dll

                      Filesize

                      22KB

                      MD5

                      92dc6ef532fbb4a5c3201469a5b5eb63

                      SHA1

                      3e89ff837147c16b4e41c30d6c796374e0b8e62c

                      SHA256

                      9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

                      SHA512

                      9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

                    • \Users\Admin\AppData\Local\Temp\is-HMOUS.tmp\i1A5m12.tmp

                      Filesize

                      689KB

                      MD5

                      e672d5907f1ce471d9784df64d8a306b

                      SHA1

                      6d094cae150d72b587c5480c15127d7059e16932

                      SHA256

                      9f9250be71bd6254790a9630990f4560d53995db3d8737b7f49986e3551283e5

                      SHA512

                      9cf10e997d8d99e6eb2f6ccac00ab365f63e03d96c2e2354fdf67683b85553a60cd9542cfb21cbea468c6a2bda454cde71937c0d21c4b738451b5e2c30690c39

                    • memory/632-141-0x00000000051F0000-0x00000000053A2000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/632-113-0x00000000051F0000-0x00000000053A2000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/632-131-0x00000000051F0000-0x00000000053A2000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/632-129-0x00000000051F0000-0x00000000053A2000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/632-127-0x00000000051F0000-0x00000000053A2000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/632-125-0x00000000051F0000-0x00000000053A2000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/632-167-0x00000000051F0000-0x00000000053A2000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/632-165-0x00000000051F0000-0x00000000053A2000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/632-163-0x00000000051F0000-0x00000000053A2000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/632-161-0x00000000051F0000-0x00000000053A2000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/632-159-0x00000000051F0000-0x00000000053A2000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/632-155-0x00000000051F0000-0x00000000053A2000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/632-153-0x00000000051F0000-0x00000000053A2000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/632-151-0x00000000051F0000-0x00000000053A2000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/632-149-0x00000000051F0000-0x00000000053A2000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/632-147-0x00000000051F0000-0x00000000053A2000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/632-135-0x00000000051F0000-0x00000000053A2000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/632-145-0x00000000051F0000-0x00000000053A2000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/632-143-0x00000000051F0000-0x00000000053A2000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/632-108-0x0000000000F00000-0x000000000125E000-memory.dmp

                      Filesize

                      3.4MB

                    • memory/632-139-0x00000000051F0000-0x00000000053A2000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/632-133-0x00000000051F0000-0x00000000053A2000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/632-109-0x00000000051F0000-0x00000000053A8000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/632-137-0x00000000051F0000-0x00000000053A2000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/632-123-0x00000000051F0000-0x00000000053A2000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/632-121-0x00000000051F0000-0x00000000053A2000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/632-119-0x00000000051F0000-0x00000000053A2000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/632-117-0x00000000051F0000-0x00000000053A2000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/632-115-0x00000000051F0000-0x00000000053A2000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/632-157-0x00000000051F0000-0x00000000053A2000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/632-110-0x00000000051F0000-0x00000000053A2000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/632-111-0x00000000051F0000-0x00000000053A2000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/1248-37234-0x0000000003CE0000-0x0000000003FBF000-memory.dmp

                      Filesize

                      2.9MB

                    • memory/1248-83-0x0000000003CE0000-0x0000000003FBF000-memory.dmp

                      Filesize

                      2.9MB

                    • memory/1448-20-0x0000000006BA0000-0x0000000007065000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/1448-1-0x0000000077300000-0x0000000077302000-memory.dmp

                      Filesize

                      8KB

                    • memory/1448-21-0x0000000006BA0000-0x0000000007065000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/1448-3-0x0000000000810000-0x0000000000CD5000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/1448-19-0x0000000000810000-0x0000000000CD5000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/1448-5-0x0000000000810000-0x0000000000CD5000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/1448-10-0x0000000000810000-0x0000000000CD5000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/1448-0-0x0000000000810000-0x0000000000CD5000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/1448-2-0x0000000000811000-0x000000000083F000-memory.dmp

                      Filesize

                      184KB

                    • memory/2120-87-0x0000000000400000-0x00000000006DF000-memory.dmp

                      Filesize

                      2.9MB

                    • memory/2120-37236-0x0000000000400000-0x00000000006DF000-memory.dmp

                      Filesize

                      2.9MB

                    • memory/2120-89-0x0000000000400000-0x00000000006DF000-memory.dmp

                      Filesize

                      2.9MB

                    • memory/2844-37596-0x00000000011E0000-0x0000000001490000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/2844-37582-0x00000000011E0000-0x0000000001490000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/2844-37524-0x00000000011E0000-0x0000000001490000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/2844-37526-0x00000000011E0000-0x0000000001490000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/2844-37527-0x00000000011E0000-0x0000000001490000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/2848-40-0x0000000000400000-0x0000000000414000-memory.dmp

                      Filesize

                      80KB

                    • memory/2868-93-0x0000000000370000-0x0000000000835000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/2868-86-0x0000000000370000-0x0000000000835000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/2868-37568-0x0000000006ED0000-0x0000000007754000-memory.dmp

                      Filesize

                      8.5MB

                    • memory/2868-37322-0x0000000006ED0000-0x00000000073C4000-memory.dmp

                      Filesize

                      5.0MB

                    • memory/2868-37570-0x0000000006ED0000-0x0000000007754000-memory.dmp

                      Filesize

                      8.5MB

                    • memory/2868-37521-0x0000000006550000-0x0000000006800000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/2868-37581-0x0000000006550000-0x0000000006800000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/2868-37502-0x0000000006ED0000-0x00000000073C4000-memory.dmp

                      Filesize

                      5.0MB

                    • memory/2868-37601-0x0000000006ED0000-0x0000000007754000-memory.dmp

                      Filesize

                      8.5MB

                    • memory/2868-22-0x0000000000370000-0x0000000000835000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/2868-37484-0x0000000006ED0000-0x00000000073C4000-memory.dmp

                      Filesize

                      5.0MB

                    • memory/2868-37249-0x0000000006ED0000-0x0000000007396000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/2868-37274-0x0000000006ED0000-0x0000000007396000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/2868-26-0x0000000000370000-0x0000000000835000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/2868-37323-0x0000000006ED0000-0x00000000073C4000-memory.dmp

                      Filesize

                      5.0MB

                    • memory/2868-24-0x0000000000370000-0x0000000000835000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/2868-23-0x0000000000370000-0x0000000000835000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/3388-37569-0x0000000000400000-0x0000000000C84000-memory.dmp

                      Filesize

                      8.5MB

                    • memory/3388-37603-0x0000000000400000-0x0000000000C84000-memory.dmp

                      Filesize

                      8.5MB

                    • memory/3388-74895-0x0000000000400000-0x0000000000C84000-memory.dmp

                      Filesize

                      8.5MB

                    • memory/3452-37326-0x0000000000900000-0x0000000000DF4000-memory.dmp

                      Filesize

                      5.0MB

                    • memory/3452-37324-0x0000000000900000-0x0000000000DF4000-memory.dmp

                      Filesize

                      5.0MB

                    • memory/4632-37651-0x0000000000240000-0x000000000059E000-memory.dmp

                      Filesize

                      3.4MB

                    • memory/4932-37251-0x0000000000910000-0x0000000000DD6000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/4932-37379-0x0000000000910000-0x0000000000DD6000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/4932-37276-0x0000000000910000-0x0000000000DD6000-memory.dmp

                      Filesize

                      4.8MB

                    • memory/5088-74943-0x00000000011C0000-0x000000000151E000-memory.dmp

                      Filesize

                      3.4MB

                    • memory/5108-37268-0x0000000000400000-0x000000000041A000-memory.dmp

                      Filesize

                      104KB