Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    07/12/2024, 14:05

General

  • Target

    file.exe

  • Size

    4.9MB

  • MD5

    df2148240759f523a1f6222d9dde9593

  • SHA1

    909ac448b4c693897ad338a1584cd6b9e9bfecb8

  • SHA256

    c345aac946f217493e26b70406e93e028985d34c0575b087f208f3dd9c48075d

  • SHA512

    124831e7a863adc481f884663d61ce0d9423f5ce339c664e41aa2cd24d1b6216a04272d0ef3dbad1b40d10b542ef9f85adba8ab022f4bcb39a0229b4cc300b86

  • SSDEEP

    24576:LOt2F+kP9/rSK+V8RYMPfrAdVwMd2AV3xVHtivEDGCIN7/kJsvgTGDAEID1wD/sl:ityDlzP8dTlV3xQDvhVI4/l9X3Lnv

Malware Config

Extracted

Family

stealc

Botnet

drum

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://atten-supporse.biz/api

Extracted

Family

lumma

C2

https://atten-supporse.biz/api

https://se-blurry.biz/api

https://zinc-sneark.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 8 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 12 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Kills process with taskkill 5 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of FindShellTrayWindow 17 IoCs
  • Suspicious use of SendNotifyMessage 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1308
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
      2⤵
      • Uses browser remote debugging
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2772
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6ad9758,0x7fef6ad9768,0x7fef6ad9778
        3⤵
          PID:2656
        • C:\Windows\system32\ctfmon.exe
          ctfmon.exe
          3⤵
            PID:828
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1176 --field-trial-handle=1192,i,5506706809082906287,4399221526084385263,131072 /prefetch:2
            3⤵
              PID:2056
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1304 --field-trial-handle=1192,i,5506706809082906287,4399221526084385263,131072 /prefetch:8
              3⤵
                PID:2756
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1612 --field-trial-handle=1192,i,5506706809082906287,4399221526084385263,131072 /prefetch:8
                3⤵
                  PID:1556
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2248 --field-trial-handle=1192,i,5506706809082906287,4399221526084385263,131072 /prefetch:1
                  3⤵
                  • Uses browser remote debugging
                  PID:1288
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2492 --field-trial-handle=1192,i,5506706809082906287,4399221526084385263,131072 /prefetch:1
                  3⤵
                  • Uses browser remote debugging
                  PID:1732
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2504 --field-trial-handle=1192,i,5506706809082906287,4399221526084385263,131072 /prefetch:1
                  3⤵
                  • Uses browser remote debugging
                  PID:2444
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3608 --field-trial-handle=1192,i,5506706809082906287,4399221526084385263,131072 /prefetch:2
                  3⤵
                    PID:1036
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
                  2⤵
                  • Uses browser remote debugging
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  PID:1824
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef67f9758,0x7fef67f9768,0x7fef67f9778
                    3⤵
                      PID:2692
                    • C:\Windows\system32\ctfmon.exe
                      ctfmon.exe
                      3⤵
                        PID:2996
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1136 --field-trial-handle=1328,i,6697050354207310898,10258703253409914138,131072 /prefetch:2
                        3⤵
                          PID:2288
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1392 --field-trial-handle=1328,i,6697050354207310898,10258703253409914138,131072 /prefetch:8
                          3⤵
                            PID:2196
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1560 --field-trial-handle=1328,i,6697050354207310898,10258703253409914138,131072 /prefetch:8
                            3⤵
                              PID:316
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2212 --field-trial-handle=1328,i,6697050354207310898,10258703253409914138,131072 /prefetch:1
                              3⤵
                              • Uses browser remote debugging
                              PID:2428
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2356 --field-trial-handle=1328,i,6697050354207310898,10258703253409914138,131072 /prefetch:1
                              3⤵
                              • Uses browser remote debugging
                              PID:2232
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2468 --field-trial-handle=1328,i,6697050354207310898,10258703253409914138,131072 /prefetch:1
                              3⤵
                              • Uses browser remote debugging
                              PID:2228
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1136 --field-trial-handle=1328,i,6697050354207310898,10258703253409914138,131072 /prefetch:2
                              3⤵
                                PID:2632
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3812 --field-trial-handle=1328,i,6697050354207310898,10258703253409914138,131072 /prefetch:8
                                3⤵
                                  PID:2620
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\Documents\IIJDBGDGCG.exe"
                                2⤵
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                PID:2484
                                • C:\Users\Admin\Documents\IIJDBGDGCG.exe
                                  "C:\Users\Admin\Documents\IIJDBGDGCG.exe"
                                  3⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Loads dropped DLL
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Drops file in Windows directory
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of FindShellTrayWindow
                                  PID:2556
                                  • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                    "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
                                    4⤵
                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                    • Checks BIOS information in registry
                                    • Executes dropped EXE
                                    • Identifies Wine through registry keys
                                    • Loads dropped DLL
                                    • Adds Run key to start application
                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:1580
                                    • C:\Users\Admin\AppData\Local\Temp\1012962001\89ac37ab9d.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1012962001\89ac37ab9d.exe"
                                      5⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2464
                                    • C:\Users\Admin\AppData\Local\Temp\1012963001\91e42c55da.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1012963001\91e42c55da.exe"
                                      5⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2012
                                    • C:\Users\Admin\AppData\Local\Temp\1012964001\88694b1344.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1012964001\88694b1344.exe"
                                      5⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SendNotifyMessage
                                      PID:868
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /F /IM firefox.exe /T
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2228
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /F /IM chrome.exe /T
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2728
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /F /IM msedge.exe /T
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2112
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /F /IM opera.exe /T
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2420
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /F /IM brave.exe /T
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1512
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                                        6⤵
                                          PID:2936
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                                            7⤵
                                            • Checks processor information in registry
                                            • Modifies registry class
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            PID:892
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="892.0.2084620950\215075008" -parentBuildID 20221007134813 -prefsHandle 1212 -prefMapHandle 1188 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {28713fd3-2bae-4a67-8df5-c15f9aa58ac7} 892 "\\.\pipe\gecko-crash-server-pipe.892" 1340 ffd8b58 gpu
                                              8⤵
                                                PID:2812
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="892.1.1266563250\2130115822" -parentBuildID 20221007134813 -prefsHandle 1488 -prefMapHandle 1468 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {df729dc2-7c27-4dd9-a13c-a7fdb47f4b0c} 892 "\\.\pipe\gecko-crash-server-pipe.892" 1512 42eb258 socket
                                                8⤵
                                                  PID:1684
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="892.2.1215104442\492080279" -childID 1 -isForBrowser -prefsHandle 2056 -prefMapHandle 1716 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 596 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d72662e0-c117-41d7-b5af-952d8b0628d0} 892 "\\.\pipe\gecko-crash-server-pipe.892" 1984 1a0c6758 tab
                                                  8⤵
                                                    PID:580
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="892.3.46446607\559956096" -childID 2 -isForBrowser -prefsHandle 2932 -prefMapHandle 2928 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 596 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6927065b-9367-4382-bb0b-95ab152e4126} 892 "\\.\pipe\gecko-crash-server-pipe.892" 2944 1ba10b58 tab
                                                    8⤵
                                                      PID:880
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="892.4.872383883\1907486205" -childID 3 -isForBrowser -prefsHandle 3552 -prefMapHandle 3580 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 596 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba560326-2f24-4df7-a0b9-d565dfefbd1a} 892 "\\.\pipe\gecko-crash-server-pipe.892" 3520 1fcefb58 tab
                                                      8⤵
                                                        PID:3056
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="892.5.1574493063\189443574" -childID 4 -isForBrowser -prefsHandle 3928 -prefMapHandle 3932 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 596 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6bfd416-4bf5-4902-ab4a-27e1c10d26f5} 892 "\\.\pipe\gecko-crash-server-pipe.892" 3916 21289258 tab
                                                        8⤵
                                                          PID:2436
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="892.6.1141128629\1926079393" -childID 5 -isForBrowser -prefsHandle 4092 -prefMapHandle 4100 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 596 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {16b91d2b-5b23-4c7c-bd30-8f7da8bccd5b} 892 "\\.\pipe\gecko-crash-server-pipe.892" 4080 21288c58 tab
                                                          8⤵
                                                            PID:2136
                                                    • C:\Users\Admin\AppData\Local\Temp\1012965001\4dea08edc3.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\1012965001\4dea08edc3.exe"
                                                      5⤵
                                                      • Modifies Windows Defender Real-time Protection settings
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Windows security modification
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2012
                                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                              1⤵
                                                PID:1596
                                              • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                1⤵
                                                  PID:2896

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

                                                  Filesize

                                                  40B

                                                  MD5

                                                  4af14b992d16a9097ddb4009c70b96b9

                                                  SHA1

                                                  2606b4a060c324c2048ea8d54374d4f2402886eb

                                                  SHA256

                                                  6ed45c34d54bb5f6e8b2a14aeb78406c243ca3d5eecd7a00089957e8c98dc7ce

                                                  SHA512

                                                  3d7642f60e8a54040b80872747cd6f37017c77ad3ec3f4370fe5641f8a0b76ffbf59f6592f9851d35ee192789b525e2e20d9cabb4c52f00cc08ea3bd94fa8987

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000007.dbtmp

                                                  Filesize

                                                  16B

                                                  MD5

                                                  18e723571b00fb1694a3bad6c78e4054

                                                  SHA1

                                                  afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                                  SHA256

                                                  8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                                  SHA512

                                                  43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000009.dbtmp

                                                  Filesize

                                                  16B

                                                  MD5

                                                  979c29c2917bed63ccf520ece1d18cda

                                                  SHA1

                                                  65cd81cdce0be04c74222b54d0881d3fdfe4736c

                                                  SHA256

                                                  b3524365a633ee6d1fa9953638d2867946c515218c497a5ec2dbef7dc44a7c53

                                                  SHA512

                                                  e38f694fd6ab9f678ae156528230d7a8bfb7b59a13b227f59f9c38ab5617db11ebb6be1276323a905d09c4066a3fe820cf58077ab48bf201f3c467a98516ee7a

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000010.dbtmp

                                                  Filesize

                                                  16B

                                                  MD5

                                                  60e3f691077715586b918375dd23c6b0

                                                  SHA1

                                                  476d3eab15649c40c6aebfb6ac2366db50283d1b

                                                  SHA256

                                                  e91d13722e31f9b06c5df3582cad1ea5b73547ce3dc08b12ed461f095aad48ee

                                                  SHA512

                                                  d1c146d27bbf19362d6571e2865bb472ce4fe43dc535305615d92d6a2366f98533747a8a70a578d1f00199f716a61ce39fac5cab9dd67e9c044bc49e7343130e

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Code Cache\js\index

                                                  Filesize

                                                  24B

                                                  MD5

                                                  54cb446f628b2ea4a5bce5769910512e

                                                  SHA1

                                                  c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

                                                  SHA256

                                                  fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

                                                  SHA512

                                                  8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Extension Scripts\LOG

                                                  Filesize

                                                  192B

                                                  MD5

                                                  2efad16a969fda7837f51fac442dc745

                                                  SHA1

                                                  4c3e71b8733c5906188cf677b432c6341bf72d2f

                                                  SHA256

                                                  44ecfe208b1f5cbb9a2ccb82b0ac5097e6d6b74026426dae437b171ef11ac7df

                                                  SHA512

                                                  c9effb8dd92113f770f76c34e6ebf219cfd2a96f9aa509d5671866f32c92d15849b27050c424db9ce85d645344e0a47968db954083bd24c05dac1f51e1d1e46b

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Site Characteristics Database\000002.dbtmp

                                                  Filesize

                                                  16B

                                                  MD5

                                                  206702161f94c5cd39fadd03f4014d98

                                                  SHA1

                                                  bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                  SHA256

                                                  1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                  SHA512

                                                  0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Site Characteristics Database\LOG

                                                  Filesize

                                                  204B

                                                  MD5

                                                  914d2c1d1f0e9803c37d93d626b65afe

                                                  SHA1

                                                  3859d23ebcc3f992220f4a6e97fb261eec14f109

                                                  SHA256

                                                  9db54eab8f1a2c038b9541d203e91859064102dd7cf28608b09bdc44aca97490

                                                  SHA512

                                                  3e1c9b6de79a369826e1dbd8216ee866cce8c558e31ab269464b7623e66175d2d2e4e3fa1e8115aecaef7ba696ec27d01487e42071c49ee5d19dd0fa2c4e2440

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Site Characteristics Database\MANIFEST-000001

                                                  Filesize

                                                  41B

                                                  MD5

                                                  5af87dfd673ba2115e2fcf5cfdb727ab

                                                  SHA1

                                                  d5b5bbf396dc291274584ef71f444f420b6056f1

                                                  SHA256

                                                  f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                  SHA512

                                                  de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\000003.log

                                                  Filesize

                                                  46B

                                                  MD5

                                                  90881c9c26f29fca29815a08ba858544

                                                  SHA1

                                                  06fee974987b91d82c2839a4bb12991fa99e1bdd

                                                  SHA256

                                                  a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a

                                                  SHA512

                                                  15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\CURRENT

                                                  Filesize

                                                  16B

                                                  MD5

                                                  46295cac801e5d4857d09837238a6394

                                                  SHA1

                                                  44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                  SHA256

                                                  0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                  SHA512

                                                  8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\LOG

                                                  Filesize

                                                  192B

                                                  MD5

                                                  72fa914f96888d818ed92d39a720c6f1

                                                  SHA1

                                                  3fec035c55640b53283746a4de52462a96798b92

                                                  SHA256

                                                  3b0852845f2cc9650b0add19b5ad8ae0d453df5559789d49e3e0d097698e1d05

                                                  SHA512

                                                  92eaa9ddccf48d03f966ca6ad249124e40441c7c2abc4db5cda835eb439f1b47e5f02d43b66873a2fec4c5e15143a09758434d61b1d29ddaec94cfeda3182f48

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\MANIFEST-000002

                                                  Filesize

                                                  50B

                                                  MD5

                                                  22bf0e81636b1b45051b138f48b3d148

                                                  SHA1

                                                  56755d203579ab356e5620ce7e85519ad69d614a

                                                  SHA256

                                                  e292f241daafc3df90f3e2d339c61c6e2787a0d0739aac764e1ea9bb8544ee97

                                                  SHA512

                                                  a4cf1f5c74e0df85dda8750be9070e24e19b8be15c6f22f0c234ef8423ef9ca3db22ba9ef777d64c33e8fd49fada6fcca26c1a14ba18e8472370533a1c65d8d0

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Visited Links

                                                  Filesize

                                                  128KB

                                                  MD5

                                                  36f62b2c40d3d9f4079259e0350c4302

                                                  SHA1

                                                  25bde33128f5a96881a12799f0893e09092ac0b7

                                                  SHA256

                                                  0a98135e633289b7d9cf887b5108575c93c222e83abd9fd97387bf9b53070495

                                                  SHA512

                                                  1e4f97251c0fd95833687267dd571adb1b2bc2c351846cbaf1f95629c4adccd1359b63218836dc1dcfd0083c2404cab49c0aff94e9ff1d38ecc7bea3759ed1f4

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Web Data

                                                  Filesize

                                                  92KB

                                                  MD5

                                                  eecd16420001132bd86d66914968c2cd

                                                  SHA1

                                                  a66bd355556dcf44a519799e878ef95a310550d2

                                                  SHA256

                                                  fec0427d362b121b03230fee9bdf71a7e161c17dd4a1204ebb9c7ac1e520b23d

                                                  SHA512

                                                  705e37e7edc967f0671c46b60be1d602b50b3cd534c10a186f97a9b1c70a66f3e4d45a625e031f17d9700836cc0c9ff0118201ac65c6abf40f4f56240d8db26b

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

                                                  Filesize

                                                  14B

                                                  MD5

                                                  9eae63c7a967fc314dd311d9f46a45b7

                                                  SHA1

                                                  caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf

                                                  SHA256

                                                  4288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d

                                                  SHA512

                                                  bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

                                                  Filesize

                                                  264KB

                                                  MD5

                                                  f50f89a0a91564d0b8a211f8921aa7de

                                                  SHA1

                                                  112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                  SHA256

                                                  b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                  SHA512

                                                  bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Affiliation Database

                                                  Filesize

                                                  32KB

                                                  MD5

                                                  69e3a8ecda716584cbd765e6a3ab429e

                                                  SHA1

                                                  f0897f3fa98f6e4863b84f007092ab843a645803

                                                  SHA256

                                                  e0c9f1494a417f356b611ec769b975a4552c4065b0bc2181954fcbb4b3dfa487

                                                  SHA512

                                                  bb78069c17196da2ce8546046d2c9d9f3796f39b9868b749ecada89445da7a03c9b54a00fcf34a23eb0514c871e026ac368795d2891bbf37e1dc5046c29beaaa

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Code Cache\js\index-dir\temp-index

                                                  Filesize

                                                  48B

                                                  MD5

                                                  2d38b37bce6c040d4be976c86153d2b0

                                                  SHA1

                                                  cf53dac14b030f0df811a85f9537cd86d83633b6

                                                  SHA256

                                                  ffa4bd4e6d0340965ede22d38d4dfbd239d678e012f7a501fb579d44d2612ad4

                                                  SHA512

                                                  f93ad0f5cd5f8fb5ea128d92f7f334e3617830a9cb41c4430440c27538c31a649e97c73f3becdc2ad3efb1453bb57e87190dab945c783cb8287f8eeaa0ba6f66

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\000003.log

                                                  Filesize

                                                  76B

                                                  MD5

                                                  cc4a8cff19abf3dd35d63cff1503aa5f

                                                  SHA1

                                                  52af41b0d9c78afcc8e308db846c2b52a636be38

                                                  SHA256

                                                  cc5dacf370f324b77b50dddf5d995fd3c7b7a587cb2f55ac9f24c929d0cd531a

                                                  SHA512

                                                  0e9559cda992aa2174a7465745884f73b96755008384d21a0685941acf099c89c8203b13551de72a87b8e23cdaae3fa513bc700b38e1bf3b9026955d97920320

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\LOG

                                                  Filesize

                                                  193B

                                                  MD5

                                                  0dd0c9efe04c13f05310036178e3290b

                                                  SHA1

                                                  d528b674ffc8b53cd06193cf77843193b1c6590e

                                                  SHA256

                                                  aa8501fe50d2707e146e5f59d913460a66b11bcc487f7d3198466203aa749ba8

                                                  SHA512

                                                  e5b1713ffc61e81ddeb1cdfe5d7144cc40aa7788e7b9296b589e417c33180c10c899b8f038ee4c19f98befdac52bd7af80cd56f187677fc989592b8bdf15e3ad

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Favicons

                                                  Filesize

                                                  20KB

                                                  MD5

                                                  3eea0768ded221c9a6a17752a09c969b

                                                  SHA1

                                                  d17d8086ed76ec503f06ddd0ac03d915aec5cdc7

                                                  SHA256

                                                  6923fd51e36b8fe40d6d3dd132941c5a693b02f6ae4d4d22b32b5fedd0e7b512

                                                  SHA512

                                                  fb5c51adf5a5095a81532e3634f48f5aedb56b7724221f1bf1ccb626cab40f87a3b07a66158179e460f1d0e14eeb48f0283b5df6471dd7a6297af6e8f3efb1f9

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\History

                                                  Filesize

                                                  148KB

                                                  MD5

                                                  90a1d4b55edf36fa8b4cc6974ed7d4c4

                                                  SHA1

                                                  aba1b8d0e05421e7df5982899f626211c3c4b5c1

                                                  SHA256

                                                  7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

                                                  SHA512

                                                  ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Login Data

                                                  Filesize

                                                  46KB

                                                  MD5

                                                  02d2c46697e3714e49f46b680b9a6b83

                                                  SHA1

                                                  84f98b56d49f01e9b6b76a4e21accf64fd319140

                                                  SHA256

                                                  522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

                                                  SHA512

                                                  60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\000003.log

                                                  Filesize

                                                  40B

                                                  MD5

                                                  148079685e25097536785f4536af014b

                                                  SHA1

                                                  c5ff5b1b69487a9dd4d244d11bbafa91708c1a41

                                                  SHA256

                                                  f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8

                                                  SHA512

                                                  c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\LOG

                                                  Filesize

                                                  205B

                                                  MD5

                                                  f7b063d7ebf77e2c67b0e4487f057ce4

                                                  SHA1

                                                  777af4b6a6dc9bef6d534f6a22d5d51e8cb3f81f

                                                  SHA256

                                                  c6a1d9c8ecd215bed4fedc04cff20f78e551d6945258c08075e8e5971e204f9c

                                                  SHA512

                                                  f8954d0e65b07f52b1df5e01bb194dbad48048b833ae13a5bb3238483a794edd1178a235ed2a47edbc45387f8cad0fe875d5122cb995034b9a1daef0dc9c06d7

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\000004.dbtmp

                                                  Filesize

                                                  16B

                                                  MD5

                                                  6752a1d65b201c13b62ea44016eb221f

                                                  SHA1

                                                  58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                  SHA256

                                                  0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                  SHA512

                                                  9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\LOG

                                                  Filesize

                                                  193B

                                                  MD5

                                                  0debf4bdffb6dac25ceafef33103c6eb

                                                  SHA1

                                                  e3453fdc7be208ab8184835c13597c4175d1e94f

                                                  SHA256

                                                  a42613b0b8e5bad13db0a5b6bde17733fafbf5881594763754ccc269cf83bc37

                                                  SHA512

                                                  c399a8eb8fe30b0e59f9db2f5db5501510dfbdb500121ad309da34921b91a99d35919948cd968becd6f151d57e3f3423c3e0242b498986205581bc997e57bd15

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Visited Links

                                                  Filesize

                                                  128KB

                                                  MD5

                                                  8fd8e9271e4a96115597b4c92712f26d

                                                  SHA1

                                                  aed92c9e017448ae963982bb85e9e906d20d35d5

                                                  SHA256

                                                  63d095e65dc574aa800ba1672241a9e6732c39e8dacbab3bb2c296ed0454f841

                                                  SHA512

                                                  6c2b050b3e54137a2cdce4f4c89e3ede2a1883614e6a4628f1d1558c27c5845f34210c451252887a818df54a086bb585afe0053e7ffdb0903c4847a1881124a1

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Web Data

                                                  Filesize

                                                  92KB

                                                  MD5

                                                  796cce564e5e25582a5bfd599c159aaf

                                                  SHA1

                                                  c76c079a3bf1c83fefd48d5f2a2f71e79908eca4

                                                  SHA256

                                                  8ff3f0cf523a478b46bd524629cd88725567b9f3ca19542618a5162bebefb320

                                                  SHA512

                                                  cba9a778c7c1c65538acb30359abe018d93155071d5461c7db27e3fff198f5d26fb51ae5f33ff168ef3f39630c1ab6eb896467177d7734da3a65b467c4c5d701

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\shared_proto_db\metadata\000003.log

                                                  Filesize

                                                  126B

                                                  MD5

                                                  75fd43d5022bdd2d2627d6944561b2f6

                                                  SHA1

                                                  a23b313546c837e097f8900b207b9aebcf67acee

                                                  SHA256

                                                  3363fa9a21dc4db7dc25aa12fa1e9f4c42cf3d07a21814dc37e2a587462564a4

                                                  SHA512

                                                  624e947801c3c24ea5eac7b6c193dbffe2774b0c090ab37c9862ec9a8e366aca0c00dcf5ef63c77de40eb5d2af248a24e0f70a8395ba9671c33023a88fcc8a29

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\shared_proto_db\metadata\LOG

                                                  Filesize

                                                  200B

                                                  MD5

                                                  eb3d599fc7e8497bf296999a12449070

                                                  SHA1

                                                  c8c8159cf0e8b92e07740e82991d96d05f2c4eeb

                                                  SHA256

                                                  8e9e9f3fa9975eb6551ad478117ef99e582e5af9219e314389c1b2c81434c308

                                                  SHA512

                                                  4693aa1d40657fd6ccf3d71442c183a1b5175892629bd9324b8b2c371b416f98ab036863ad1c88435f6ebcc5adf100d3a50b77472e75c8b2e75afeed02635988

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

                                                  Filesize

                                                  86B

                                                  MD5

                                                  f732dbed9289177d15e236d0f8f2ddd3

                                                  SHA1

                                                  53f822af51b014bc3d4b575865d9c3ef0e4debde

                                                  SHA256

                                                  2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93

                                                  SHA512

                                                  b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                                  Filesize

                                                  2B

                                                  MD5

                                                  99914b932bd37a50b983c5e7c90ae93b

                                                  SHA1

                                                  bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                  SHA256

                                                  44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                  SHA512

                                                  27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n3lsnn48.default-release\activity-stream.discovery_stream.json.tmp

                                                  Filesize

                                                  23KB

                                                  MD5

                                                  d5353910372d7dcdc264e7db9da6ddfe

                                                  SHA1

                                                  e2f049604a8f284d35e3cf4b2785cd970594ad28

                                                  SHA256

                                                  82eba709582bc90121ced0db0055303d55c4949e8d2b2efc333b0f95c04b77f0

                                                  SHA512

                                                  cb40acc97b07306b121db3c236ed72295156ee1994397d25b0394405e7ac4c0949d6b3c8a88da76f8571de2e2d406d0d1bc8aebd6a5b6c2b0c642b772b9e3cb6

                                                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n3lsnn48.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

                                                  Filesize

                                                  15KB

                                                  MD5

                                                  96c542dec016d9ec1ecc4dddfcbaac66

                                                  SHA1

                                                  6199f7648bb744efa58acf7b96fee85d938389e4

                                                  SHA256

                                                  7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                                                  SHA512

                                                  cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                                                • C:\Users\Admin\AppData\Local\Temp\1012962001\89ac37ab9d.exe

                                                  Filesize

                                                  1.8MB

                                                  MD5

                                                  1a958ac926a6178dafabb0b90d0c96d4

                                                  SHA1

                                                  ff0d40ef38e64da1a505ba7149cb97bdd63f2bfb

                                                  SHA256

                                                  b8ff3c756db7a6b05dc3738e506876bb014b6aa39d07365d93755b4f739c4996

                                                  SHA512

                                                  db5b6dc64821f45db293456b7112bf5371f21522a7a8f00a6ca633c63cbfb4c17e44f5f0d1510d054ece1eb39a2da322b4257f370716de169243fb9533f8ffb2

                                                • C:\Users\Admin\AppData\Local\Temp\1012963001\91e42c55da.exe

                                                  Filesize

                                                  4.9MB

                                                  MD5

                                                  df2148240759f523a1f6222d9dde9593

                                                  SHA1

                                                  909ac448b4c693897ad338a1584cd6b9e9bfecb8

                                                  SHA256

                                                  c345aac946f217493e26b70406e93e028985d34c0575b087f208f3dd9c48075d

                                                  SHA512

                                                  124831e7a863adc481f884663d61ce0d9423f5ce339c664e41aa2cd24d1b6216a04272d0ef3dbad1b40d10b542ef9f85adba8ab022f4bcb39a0229b4cc300b86

                                                • C:\Users\Admin\AppData\Local\Temp\1012964001\88694b1344.exe

                                                  Filesize

                                                  947KB

                                                  MD5

                                                  0c2e94ec158d93fd011ac60d258e1572

                                                  SHA1

                                                  6f12d3b754a262926a26c9a04aa0613376b22f4b

                                                  SHA256

                                                  80e58cae2be491c158ed9ca1301e95133fe7d4c1ae463d7e2d50662463014706

                                                  SHA512

                                                  4979ee1f9941cd48e58a0a28568758ee5ad7aefa28e34f1faee6fa4ef1c4b4106f5af2e69a594b645bec06952c87be514bc30b14c072bdcd3cc8f759dcee66fb

                                                • C:\Users\Admin\AppData\Local\Temp\1012965001\4dea08edc3.exe

                                                  Filesize

                                                  2.7MB

                                                  MD5

                                                  8ed088e53b3a92096a5f1ede88fd960e

                                                  SHA1

                                                  e361a6da81c3beaefe3283dd76ea92c7fb9858d7

                                                  SHA256

                                                  a233b27a4acbac5d3ad78bb5ce6c5d71f5d92347839146e7ba6db5e0087984c4

                                                  SHA512

                                                  f357fc0c1f96340818d5da01d64aef4f35034403b80e6429139ccac096cafc988149648f67cd8321e38309ada28af1901416adb56b773fd9f3c35dff4aeaaf86

                                                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

                                                  Filesize

                                                  3.0MB

                                                  MD5

                                                  ea30f894fe762202951845239534c957

                                                  SHA1

                                                  afccc92d4cb80fd6cce247ebc4cd4f2ac19b3ff1

                                                  SHA256

                                                  e5028661c1ff34315d05df120da582b969dedd2c61478ae31673f266921e795e

                                                  SHA512

                                                  7ba7c3f7c3a326061e8ce8e6f0e1fc58a4eeea724d3467e005193e449e6a80d3a5a0a1eaf13a73d7d9129d4a9c10797a86163e740de4e8db24479e863789701c

                                                • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                  Filesize

                                                  442KB

                                                  MD5

                                                  85430baed3398695717b0263807cf97c

                                                  SHA1

                                                  fffbee923cea216f50fce5d54219a188a5100f41

                                                  SHA256

                                                  a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                                                  SHA512

                                                  06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                                                • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                  Filesize

                                                  8.0MB

                                                  MD5

                                                  a01c5ecd6108350ae23d2cddf0e77c17

                                                  SHA1

                                                  c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                                                  SHA256

                                                  345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                                                  SHA512

                                                  b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\datareporting\glean\db\data.safe.bin

                                                  Filesize

                                                  2KB

                                                  MD5

                                                  9430037a30f355e637a6f19919ce7e28

                                                  SHA1

                                                  554bbd92539516b5ed6ba632547cc789d7d1f6fd

                                                  SHA256

                                                  75190d71c7ee37971690d045e018b76535c827c4582e75415c707fdc599e117a

                                                  SHA512

                                                  248d44d14d4d01f9a93f729c182b4b3c8270583948fd63e8fd893f0c17ed8e43436d14987d11b0780843b1197338e1454e04d6bc264cf9ebd0cc70020ae34043

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\datareporting\glean\pending_pings\18780d24-7aa3-438f-b9c9-715e39653586

                                                  Filesize

                                                  745B

                                                  MD5

                                                  229abb66c4be76f62494559e2aba0d72

                                                  SHA1

                                                  0962395d3be760a79b06afb2df4eec694c4ddb6d

                                                  SHA256

                                                  3baa066a68672ee9ffee1d5e392be016b47c27864036e4c4e78271c6a9077995

                                                  SHA512

                                                  3fa153a6547bcd916154bb61bd62198832da201be870b9a2f89e1e3b99d1619dc913578c92c36ee86e4651ead65b2b1e0f60fa088ae27d9e7df32e3a35c78571

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\datareporting\glean\pending_pings\c408af90-c77f-4700-8d85-0eece59023eb

                                                  Filesize

                                                  12KB

                                                  MD5

                                                  f44c3abcbb67651ceac3750bcb405540

                                                  SHA1

                                                  a1d15685cb8677e4336cec128696553fe6872d3a

                                                  SHA256

                                                  f5cee22e06ef826e583a080c714fd279ffca849b5548d37ecb4c951989b9903e

                                                  SHA512

                                                  f2360d689020ff1956f2eb1b9035301cd9803f170c896d5e7599191355e21a18213ad906f97b3970c516891471d122605cdfd8178617329cbf195fbbec7ecf88

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                                                  Filesize

                                                  997KB

                                                  MD5

                                                  fe3355639648c417e8307c6d051e3e37

                                                  SHA1

                                                  f54602d4b4778da21bc97c7238fc66aa68c8ee34

                                                  SHA256

                                                  1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                                                  SHA512

                                                  8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                                                  Filesize

                                                  116B

                                                  MD5

                                                  3d33cdc0b3d281e67dd52e14435dd04f

                                                  SHA1

                                                  4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                                                  SHA256

                                                  f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                                                  SHA512

                                                  a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                                                  Filesize

                                                  479B

                                                  MD5

                                                  49ddb419d96dceb9069018535fb2e2fc

                                                  SHA1

                                                  62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                                                  SHA256

                                                  2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                                                  SHA512

                                                  48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                                                  Filesize

                                                  372B

                                                  MD5

                                                  8be33af717bb1b67fbd61c3f4b807e9e

                                                  SHA1

                                                  7cf17656d174d951957ff36810e874a134dd49e0

                                                  SHA256

                                                  e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                                                  SHA512

                                                  6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                                                  Filesize

                                                  11.8MB

                                                  MD5

                                                  33bf7b0439480effb9fb212efce87b13

                                                  SHA1

                                                  cee50f2745edc6dc291887b6075ca64d716f495a

                                                  SHA256

                                                  8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                                                  SHA512

                                                  d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  688bed3676d2104e7f17ae1cd2c59404

                                                  SHA1

                                                  952b2cdf783ac72fcb98338723e9afd38d47ad8e

                                                  SHA256

                                                  33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                                                  SHA512

                                                  7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  937326fead5fd401f6cca9118bd9ade9

                                                  SHA1

                                                  4526a57d4ae14ed29b37632c72aef3c408189d91

                                                  SHA256

                                                  68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                                                  SHA512

                                                  b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\prefs-1.js

                                                  Filesize

                                                  6KB

                                                  MD5

                                                  f341fa6fc58f0bfc0d566398c825a4c1

                                                  SHA1

                                                  8ac4be8ba1318c8b2da21dfa294587bc3d631605

                                                  SHA256

                                                  05879116b3e7b3ff0c16b676cf6c774d7c43706fad2b5cdae163a5be637e729b

                                                  SHA512

                                                  a77b2175636c71f3df33ac59b8995b8a9f3783010a00f539b9f420aa3952e3c85670b35b998cde21d6cd9cf0a3cfddfa240b58736dc6297192ecde9bf83fe678

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\prefs-1.js

                                                  Filesize

                                                  7KB

                                                  MD5

                                                  9d8e8866125707312a1f61ee82e0691b

                                                  SHA1

                                                  c9cb2d7af935a9b3fac47ba1d4b368a8e3fc8ca3

                                                  SHA256

                                                  b97bf9fe62ef69e89b71b9ad223675d49645697583920ec4227d9c7aafd8ab57

                                                  SHA512

                                                  98dc7c25e033785bdfd46716ed936cbe65c6d0ee3cb0e7d50e77416581ab3324ed297429ecd6e8dc5201271b996df52fd0f59c30b04b8a2956ae518fdbf91ed8

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\prefs-1.js

                                                  Filesize

                                                  7KB

                                                  MD5

                                                  338f04e11070197eb467dc683fa927c9

                                                  SHA1

                                                  b6c5521828dc5a508c8ec6d761b167efe458478e

                                                  SHA256

                                                  249b50829f851b983c7f06ee06d371af6d6d9aaa5a0a21abcc79ba1030b14514

                                                  SHA512

                                                  9e627687806afac044b7d088793fcff6241edbeae74474a32b6daa4aee0451ae830ae17c05f0bbd896971658f96ac5f883892a5a5a09c568f82f9fe017483e9b

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\prefs.js

                                                  Filesize

                                                  6KB

                                                  MD5

                                                  3f6c53e386b1ea8a5753e8951cd1f4b8

                                                  SHA1

                                                  97fe0238c6a39953ac4e48f1a44612229d6da8c2

                                                  SHA256

                                                  dc9fa93fe2c718154e858d485c1c48474a4c49167a8f245fdaa2cfdde125c549

                                                  SHA512

                                                  c77c5db833ed2c8c0728f21a04532ad82b83f0efc903c1e22e29062ec897be810617fd82457d28d63697808f66a70e1dfcf952980b920a137723a26fad3c8b8b

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\sessionstore-backups\recovery.jsonlz4

                                                  Filesize

                                                  4KB

                                                  MD5

                                                  246d45920d16395c758e27dc28d6fc6a

                                                  SHA1

                                                  40883b979fe47170c47365a297502bc09be2aff1

                                                  SHA256

                                                  65eefb6fc61420a20ff26915fcb652a67a90b676d33c120767528f45f33140ab

                                                  SHA512

                                                  1e4c6cb44dd9778effa485a405c41a9c0475955ddf2ad084c45ce07a04f6d281cb8fcaf4e5a5e5a57538b0c36f5c2f767586bf4ef01bc1cdbb96b232dff67bd9

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                                  Filesize

                                                  184KB

                                                  MD5

                                                  bece0acf9d7f19d01c7943c54d2ad372

                                                  SHA1

                                                  aef59ca4b0fe97f32db128e103bfb98aee3b5e29

                                                  SHA256

                                                  ce40f79585195148ac86928d18da80b963cc98d6feb83c1c2e75e8b6d6ef39f8

                                                  SHA512

                                                  105fb01521fca054766d1d1e46cf3bf177b8bab44800f7bbad9a84f388af32e745474b3cc4f70c1fd779b4e7bcf0912502860092e1824f7ba4b52c612ba5a70b

                                                • memory/1308-0-0x0000000000250000-0x0000000000747000-memory.dmp

                                                  Filesize

                                                  5.0MB

                                                • memory/1308-2-0x0000000000251000-0x000000000049A000-memory.dmp

                                                  Filesize

                                                  2.3MB

                                                • memory/1308-516-0x0000000000250000-0x0000000000747000-memory.dmp

                                                  Filesize

                                                  5.0MB

                                                • memory/1308-3-0x0000000000250000-0x0000000000747000-memory.dmp

                                                  Filesize

                                                  5.0MB

                                                • memory/1308-4-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                  Filesize

                                                  972KB

                                                • memory/1308-1-0x0000000077450000-0x0000000077452000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/1308-242-0x0000000000250000-0x0000000000747000-memory.dmp

                                                  Filesize

                                                  5.0MB

                                                • memory/1308-489-0x0000000000250000-0x0000000000747000-memory.dmp

                                                  Filesize

                                                  5.0MB

                                                • memory/1308-249-0x0000000000250000-0x0000000000747000-memory.dmp

                                                  Filesize

                                                  5.0MB

                                                • memory/1308-248-0x0000000000251000-0x000000000049A000-memory.dmp

                                                  Filesize

                                                  2.3MB

                                                • memory/1308-280-0x0000000000250000-0x0000000000747000-memory.dmp

                                                  Filesize

                                                  5.0MB

                                                • memory/1308-517-0x0000000000251000-0x000000000049A000-memory.dmp

                                                  Filesize

                                                  2.3MB

                                                • memory/1580-739-0x0000000006220000-0x00000000064D8000-memory.dmp

                                                  Filesize

                                                  2.7MB

                                                • memory/1580-535-0x0000000000FF0000-0x0000000001300000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/1580-866-0x0000000000FF0000-0x0000000001300000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/1580-867-0x0000000000FF0000-0x0000000001300000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/1580-567-0x0000000006880000-0x0000000006D77000-memory.dmp

                                                  Filesize

                                                  5.0MB

                                                • memory/1580-682-0x0000000006880000-0x0000000006D77000-memory.dmp

                                                  Filesize

                                                  5.0MB

                                                • memory/1580-565-0x0000000006880000-0x0000000006D77000-memory.dmp

                                                  Filesize

                                                  5.0MB

                                                • memory/1580-551-0x0000000006880000-0x0000000006D12000-memory.dmp

                                                  Filesize

                                                  4.6MB

                                                • memory/1580-741-0x0000000006220000-0x00000000064D8000-memory.dmp

                                                  Filesize

                                                  2.7MB

                                                • memory/1580-531-0x0000000000FF0000-0x0000000001300000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/1580-882-0x0000000000FF0000-0x0000000001300000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/1580-549-0x0000000000FF0000-0x0000000001300000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/1580-872-0x0000000000FF0000-0x0000000001300000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/1580-880-0x0000000000FF0000-0x0000000001300000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/1580-764-0x0000000000FF0000-0x0000000001300000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/1580-881-0x0000000000FF0000-0x0000000001300000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/1580-777-0x0000000000FF0000-0x0000000001300000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/1580-580-0x0000000000FF0000-0x0000000001300000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/1580-547-0x0000000006880000-0x0000000006D12000-memory.dmp

                                                  Filesize

                                                  4.6MB

                                                • memory/1580-856-0x0000000000FF0000-0x0000000001300000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/1580-534-0x0000000000FF0000-0x0000000001300000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/2012-776-0x00000000000B0000-0x0000000000368000-memory.dmp

                                                  Filesize

                                                  2.7MB

                                                • memory/2012-747-0x00000000000B0000-0x0000000000368000-memory.dmp

                                                  Filesize

                                                  2.7MB

                                                • memory/2012-746-0x00000000000B0000-0x0000000000368000-memory.dmp

                                                  Filesize

                                                  2.7MB

                                                • memory/2012-740-0x00000000000B0000-0x0000000000368000-memory.dmp

                                                  Filesize

                                                  2.7MB

                                                • memory/2012-566-0x0000000001180000-0x0000000001677000-memory.dmp

                                                  Filesize

                                                  5.0MB

                                                • memory/2012-568-0x0000000001180000-0x0000000001677000-memory.dmp

                                                  Filesize

                                                  5.0MB

                                                • memory/2464-548-0x0000000001140000-0x00000000015D2000-memory.dmp

                                                  Filesize

                                                  4.6MB

                                                • memory/2464-550-0x0000000001140000-0x00000000015D2000-memory.dmp

                                                  Filesize

                                                  4.6MB

                                                • memory/2484-513-0x0000000002260000-0x0000000002570000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/2484-532-0x0000000002260000-0x0000000002570000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/2556-514-0x0000000000300000-0x0000000000610000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/2556-528-0x0000000006DA0000-0x00000000070B0000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/2556-529-0x0000000000300000-0x0000000000610000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/2556-530-0x0000000006DA0000-0x00000000070B0000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/2556-533-0x0000000006DA0000-0x00000000070B0000-memory.dmp

                                                  Filesize

                                                  3.1MB