Analysis

  • max time kernel
    102s
  • max time network
    128s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250619-en
  • resource tags

    arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    30/06/2025, 17:11

General

  • Target

    2025-06-30_e6243f15c851977a055450fabfcad957_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe

  • Size

    22.0MB

  • MD5

    e6243f15c851977a055450fabfcad957

  • SHA1

    1f015ed1079bf02d1600c194b610a61b01f00404

  • SHA256

    8e09c50294d3bb0eef1ab0586d759944b78d7c0d158d7cdc65f341f01ebae61e

  • SHA512

    a7df59a779751de340e8cfae0af3b8a6f4f79bc51c1eb2ef1b54bb1650fb1ef286cfbaf10ca4ff82fc0a69e85b6eb2425cc42ba803046342955af94c4d8fedca

  • SSDEEP

    393216:YqooSBMrbYtWyW8xBHCm3WbL+9qz5bD7fEU27I94zz8vhsW0i5KWZ2qvJc:YzoSB88FW8rHCZ3+9q1f7fED7II8vdHe

Malware Config

Signatures

  • Uses browser remote debugging 2 TTPs 3 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • Drops startup file 2 IoCs
  • Loads dropped DLL 39 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 5 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-06-30_e6243f15c851977a055450fabfcad957_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-06-30_e6243f15c851977a055450fabfcad957_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2780
    • C:\Users\Admin\AppData\Local\Temp\2025-06-30_e6243f15c851977a055450fabfcad957_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2025-06-30_e6243f15c851977a055450fabfcad957_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe"
      2⤵
      • Drops startup file
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2272
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im opera.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4384
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im opera_gx.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5516
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im msedge.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:464
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /F /IM msedge.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1324
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --headless
        3⤵
        • Uses browser remote debugging
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1452
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7fff4306f208,0x7fff4306f214,0x7fff4306f220
          4⤵
            PID:3792
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2200,i,3955211046505890006,15711350094227264488,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:11
            4⤵
              PID:5380
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2160,i,3955211046505890006,15711350094227264488,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:2
              4⤵
                PID:5472
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2524,i,3955211046505890006,15711350094227264488,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:13
                4⤵
                  PID:2224
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3496,i,3955211046505890006,15711350094227264488,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
                  4⤵
                  • Uses browser remote debugging
                  PID:5916
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3520,i,3955211046505890006,15711350094227264488,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
                  4⤵
                  • Uses browser remote debugging
                  PID:3296
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5216,i,3955211046505890006,15711350094227264488,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
                  4⤵
                    PID:1696
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5208,i,3955211046505890006,15711350094227264488,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
                    4⤵
                      PID:4708
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5888,i,3955211046505890006,15711350094227264488,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
                      4⤵
                        PID:5188
                      • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=6096,i,3955211046505890006,15711350094227264488,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
                        4⤵
                          PID:5968
                        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=6096,i,3955211046505890006,15711350094227264488,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
                          4⤵
                            PID:1268
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=6220,i,3955211046505890006,15711350094227264488,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
                            4⤵
                              PID:1332
                              • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
                                cookie_exporter.exe --cookie-json=1136
                                5⤵
                                  PID:1456
                            • C:\Windows\SYSTEM32\taskkill.exe
                              taskkill /F /IM msedge.exe
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1912
                        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
                          1⤵
                            PID:3368

                          Network

                                MITRE ATT&CK Enterprise v16

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  280B

                                  MD5

                                  03b6ceee6d3294b477cb96be0a4821a2

                                  SHA1

                                  17508a8b887dac0d5b2fdf62cce6ee7989564165

                                  SHA256

                                  e373291cec4f23986133c23daa353551f05eda26aac4a4e3686c40f8bfda576e

                                  SHA512

                                  581fbd959baff647df5ac757c03b071653bca94c529807775b30e0f4b88ade1f0dd99850daaea1fa0861ce83d3e9d505a004e6c78d45e923ee39728a2d9efda9

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\74afc6fb-0f2b-4aa8-bb79-acfc91299cba.tmp

                                  Filesize

                                  108KB

                                  MD5

                                  06d55006c2dec078a94558b85ae01aef

                                  SHA1

                                  6a9b33e794b38153f67d433b30ac2a7cf66761e6

                                  SHA256

                                  088bb586f79dd99c5311d14e1560bbe0bb56225a1b4432727d2183341c762bcd

                                  SHA512

                                  ec190652af9c213ccbb823e69c21d769c64e3b9bae27bea97503c352163bf70f93c67cebbf327bfc73bfd632c9a3ae57283b6e4019af04750fe18a2410a68e60

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

                                  Filesize

                                  2B

                                  MD5

                                  99914b932bd37a50b983c5e7c90ae93b

                                  SHA1

                                  bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                  SHA256

                                  44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                  SHA512

                                  27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

                                  Filesize

                                  2B

                                  MD5

                                  d751713988987e9331980363e24189ce

                                  SHA1

                                  97d170e1550eee4afc0af065b78cda302a97674c

                                  SHA256

                                  4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                  SHA512

                                  b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b14deb1b-ecc1-4145-904f-20920019ae54\index-dir\the-real-index

                                  Filesize

                                  1KB

                                  MD5

                                  27d09de5cbb4ce495c61688b447f6fda

                                  SHA1

                                  3337da729277ab731f6781fc566505db7a694749

                                  SHA256

                                  7631970a4afe4c42ac9da42ee28edffd96c7a360a5f3c5e84358facfc50b6b7f

                                  SHA512

                                  d2aae0553a3ad8454006443a87c32569fb748069a72534ed0871fd42af6675be00f5d74e7930213a6a7f139fbbf966a6abeefce1e1a5ee933371f7d0045dd675

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b14deb1b-ecc1-4145-904f-20920019ae54\index-dir\the-real-index~RFe579eef.TMP

                                  Filesize

                                  1KB

                                  MD5

                                  0576c64c8d26b33774e5608f427b41a4

                                  SHA1

                                  294ad8541ff22f7ec265d58f0f4e1a9f8b4989b4

                                  SHA256

                                  e3a063d4232ebd6ddbcb930be68d0e349287404311ff14b58de4238889c8ebd6

                                  SHA512

                                  ad069ed5da81a115b9a7f7c4db2224e7b65fc4b3af73e6e11351002d99123e6b037dc3eb75c733b37de80470d7015eb8e15faed464520b4ae33802e1aeed4eeb

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

                                  Filesize

                                  22KB

                                  MD5

                                  329f5d68e3b2edc2ce88127050ce019d

                                  SHA1

                                  9c48eec083c66d3e351a60d4ff4ec3891b080ae6

                                  SHA256

                                  ee96b17fce8853ccad047832402124a0b3b7b2bf380cacaf90e8ab40aee024e3

                                  SHA512

                                  8a05dd231d4f10e7e9819c23b9708521073785308756f68e95be8564638930760b4b0029d55be0cb90c33a63a76e15ac4af201daf2aade8e30d0b2682b8ed6ca

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                  Filesize

                                  37KB

                                  MD5

                                  c58009b537e753df20c63afb6ed3f2ec

                                  SHA1

                                  a2acdb18392db5c422c6af13359bc259138edfe9

                                  SHA256

                                  ef89045dca03e36ba261c8ec755b8a8d6a1f6df12d9abe7e3370078bc630072a

                                  SHA512

                                  cae4cbf3536b267a54793e7357557298672bf51301104f1866ab0a6f83899c813ed23d18ca71dc75a69692e5f8bab33eee30f0f3b1ba3c20b45c1b88c2b48324

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\Cryptodome\Cipher\_raw_aes.pyd

                                  Filesize

                                  17KB

                                  MD5

                                  c27260c209c357fcc984b3bd259924e1

                                  SHA1

                                  99ba7f93c8e5f968a30ca34b7f8d5ec039392d4c

                                  SHA256

                                  4c731a9fa619d73a2085d3768925a94c110a9a28fcdcdb3068569cd8293698be

                                  SHA512

                                  f4729c3649d567bf71915ef9c0b98f56ea10d58c3e6e445ed62f173579c1efa01103fb25e54d62d015079bd9d19a76d1c8f6ff0d679543bec11e70bf4f93ae0c

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\Cryptodome\Util\_cpuid_c.pyd

                                  Filesize

                                  9KB

                                  MD5

                                  d826b873c1de4f2aaa48dca0927af486

                                  SHA1

                                  dfe5dfe99eb5600aea484ad6f72a57faa613f4e8

                                  SHA256

                                  bca02c5ce4d11fce60cc75cef97abc1a3dd6c811bd8ec9fe30ee62816d8cde70

                                  SHA512

                                  fd26440c1194f4cc0acb65dcc696ab619b6025cb6c683276488e11a8b5fa293dd2d809bc8330f3dbf49d71cf7e1393dc8315275a927a59b9d5dd4dd63b759828

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\VCRUNTIME140.dll

                                  Filesize

                                  106KB

                                  MD5

                                  4585a96cc4eef6aafd5e27ea09147dc6

                                  SHA1

                                  489cfff1b19abbec98fda26ac8958005e88dd0cb

                                  SHA256

                                  a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

                                  SHA512

                                  d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\VCRUNTIME140_1.dll

                                  Filesize

                                  48KB

                                  MD5

                                  7e668ab8a78bd0118b94978d154c85bc

                                  SHA1

                                  dbac42a02a8d50639805174afd21d45f3c56e3a0

                                  SHA256

                                  e4b533a94e02c574780e4b333fcf0889f65ed00d39e32c0fbbda2116f185873f

                                  SHA512

                                  72bb41db17256141b06e2eaeb8fc65ad4abdb65e4b5f604c82b9e7e7f60050734137d602e0f853f1a38201515655b6982f2761ee0fa77c531aa58591c95f0032

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\_asyncio.pyd

                                  Filesize

                                  37KB

                                  MD5

                                  80c155e092888174656c9c98b320bc05

                                  SHA1

                                  7bd55d6e0541d6749d82df3bbf4c3030fb2622c3

                                  SHA256

                                  2a7c9831564bab073130e588c38a4c9410ac91b14d1489d535527f648242629e

                                  SHA512

                                  f3a74fd1f86d02ad94b93738c76994de561df316afaec8a42e626819c3d5197e5602eee7dfec6af2ceeb37cad1b5f73854a5e87b3b9019512793f39c79fe91a8

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\_bz2.pyd

                                  Filesize

                                  48KB

                                  MD5

                                  952c6711be1b2ab7680be10a576e3e4f

                                  SHA1

                                  499a120c8d48529868c87686b3675a9f5492f858

                                  SHA256

                                  851eb2739e6ea60cdc1052579f61e7896dc8fc81fca37d8c4c5a21b3f7ae441a

                                  SHA512

                                  f103085229c3535d739d32fc84b5b5cc27b603013401ae4e8922ef346cdaff7d542e92311ee8972b965d7b2c69fa8ece5fb700bf0d4bebb51b000e0daee3e9c8

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\_cffi_backend.cp312-win_amd64.pyd

                                  Filesize

                                  71KB

                                  MD5

                                  94a963793144f26e8905e1e8ce3c28d9

                                  SHA1

                                  4606d58f98ea2755c30696a4253105da8dbc206f

                                  SHA256

                                  53ddba12f45666326a9c0c217d1cbc6c68f26829b3890dbc71b55f7eda8b30f2

                                  SHA512

                                  c946d32756a881ad23e5acb7b88b72047936ac35311579db9fb4c49dfc2bd526047d52df4eb4f34f4b1db0cbe2bef3ab040a9287262322a6692d45e634e90228

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\_ctypes.pyd

                                  Filesize

                                  59KB

                                  MD5

                                  a6d6d8f2a102364d1a3be27d394bedba

                                  SHA1

                                  a3ccf649df22393686da3cd1157d69bd40e6ed48

                                  SHA256

                                  08e75a6878a045e20597490b65bfe3608ae9551d4d008718c3e8b6a4647575ef

                                  SHA512

                                  c6a4bb8a65cd7c7782551d24a29298ddfcde448ebe4b134ca801a6cd7c96d1c793ba34a1e33386c269c8ff4ba9a965961e28ac44ed9ed6f7a067c5b446511c55

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\_decimal.pyd

                                  Filesize

                                  105KB

                                  MD5

                                  6d91f1ca9c0a2fd069d271ceaad5ee27

                                  SHA1

                                  194e9d731e253aea2a580238ba2146538fa1c74c

                                  SHA256

                                  6bd36ff0bc14d359945318786ce549708655ad6ed4109e661f45b14e884313c4

                                  SHA512

                                  e7475904edbea968b0eddacd1d5c83dc703b7f893020ac3826ae1a828118e1bac5978c31e187d50e7f88277ce31e0114d15fd9b43cc170dd067a589d6f086de1

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\_elementtree.pyd

                                  Filesize

                                  59KB

                                  MD5

                                  038cc7b4decd8df0ccbcc8720fef8221

                                  SHA1

                                  ef5ffa037e4274726a4f8a34690188bcd78c0448

                                  SHA256

                                  e9d6f41e10899cb9c3eed3cd282d3eab1e657ac308fadc917bae5701a26b6ffa

                                  SHA512

                                  ccc911a57ec7635651b6c75e0b41b1bbfbc288ce1906ad9633f9054f0b83ea3bf4b51cabce785d54fe25d733ecfab2c460cf04d2a631891c63f34d7530616265

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\_hashlib.pyd

                                  Filesize

                                  35KB

                                  MD5

                                  22efd8aa6a80c1a6688325dd949f350b

                                  SHA1

                                  d642acaca968b265e63953af419c4dc15f9e016f

                                  SHA256

                                  567122aedde94177892eb3d8a5ee8dc2b2639ce119ae79d7346fbdece87c1741

                                  SHA512

                                  d24eb5281700cecf59feb01310cfce170259054c481c63b2a0620685a467d91754b5b6f119be0575741628acf52db84cdb5b12af8d9e18549e69989f6ef3c8cd

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\_lzma.pyd

                                  Filesize

                                  85KB

                                  MD5

                                  5220b72fcbc170a74aae0f869ed984d6

                                  SHA1

                                  c97dcc30507c416bdb974dfbbe39dbc7c895c723

                                  SHA256

                                  244c5c409005884509d77c1026cc68a2db929181ef21673ca3738785a42ea49f

                                  SHA512

                                  cbbebb7e2bef3246484b1e5abe26eee20fbcabd22452a9f1044de767177f60a3947b38606fe3eae202a0e4dd4af935eceb9b39a52a9ae115063c25287b7ade83

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\_multiprocessing.pyd

                                  Filesize

                                  27KB

                                  MD5

                                  7ae6edb97538f95a8fc8d763602b80c2

                                  SHA1

                                  b3b9544fb57b9310820565820c504edc09b5ab17

                                  SHA256

                                  5948c0603e4d966b649029f0908950b8216c6c7ee2c923b0cc4d01c78aebad4e

                                  SHA512

                                  7b02343038fc5589ef07b649014cca260f16c55f7e89aecda18c73252805982ce601051dcb16e51417e42e3cea0ebd287466815527d8849a19dd398e6bc81fae

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\_overlapped.pyd

                                  Filesize

                                  33KB

                                  MD5

                                  9089cdfddf30d48a36c3cef8f7e7122c

                                  SHA1

                                  ee4cb3b69fe457cee93a8d240cb0e6bc74ea8057

                                  SHA256

                                  51ef644948b031805ba862fb11c5506e844f5159f77175a849e500390ad9b369

                                  SHA512

                                  f9c77347ca226365071480ecc2aee05a7dce4834de2b79f2f31cc8fc138fafd821a56a16f45e2b0c1e31d45208a4ae9e558fec94f90e0379f430f2fe8bd605a3

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\_queue.pyd

                                  Filesize

                                  26KB

                                  MD5

                                  1c7efdc2c88314a7bb52f7a3e9c591f2

                                  SHA1

                                  8f8bf4ae5c320b10a272c377bb787cee49e8bc03

                                  SHA256

                                  fbc2677a615f220a9bf98d9e0a5f5b9fc80ce4ec60ce5dc5b2af0ccb99058279

                                  SHA512

                                  3af89b47deb1481d0631eb2c6e828a07573131f4f1a4900de7b7dbbb271c9f6502715a5608a51bad0e8f89e3c995b586e9e36c4a42bcf7dedc7f1a243179a1f0

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\_socket.pyd

                                  Filesize

                                  44KB

                                  MD5

                                  d1e6edc3870e122e85006aa8ab84312f

                                  SHA1

                                  b373dbc1c887256951da05ba756c874c10a97db5

                                  SHA256

                                  03ae38714bef826c4aeb043844966e5cc41fa9fe085010cc5d1b4f77831d8c3c

                                  SHA512

                                  6383f3592917a5b48f93d54037a703d59e5cf89d515d14574c883cc86e82a39718b5b50b8fefa39d5b5250089b02d90704df5c27d850072d7f4061fb647ce9aa

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\_sqlite3.pyd

                                  Filesize

                                  57KB

                                  MD5

                                  7c71aac32d1b4bd05bfb6cae2607667e

                                  SHA1

                                  ce52307ed6a813e36434864846c4c0b36df99ffc

                                  SHA256

                                  1c073f2b602cc97eefc042207e1a573373686f33b37347ce611a877b10660606

                                  SHA512

                                  b4561961ba0276ef02e547f3a2bed21b44c7cc1a06a6b5a3193053021aec7233559040219d0ca155f5e0a76294c2991e8abc67df9900cc6819ddb4495c9b05f8

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\_ssl.pyd

                                  Filesize

                                  65KB

                                  MD5

                                  d3fd48d121a9bcac935057e5e57b33ee

                                  SHA1

                                  157dd5978b30dd7a5bd844d5ea08dde265d1ea0f

                                  SHA256

                                  296141c7cff0483ab1cd8ba9bcd623b73c897323752f6d3e00cac860f2f2ea20

                                  SHA512

                                  d3b30458616623dff1c2c0d40413dd63be8b5918fbb67833836900e1e8be7f4d372133e55710cd0b34f6f624eed4e91831ad4d456f4c04c70459dedb79b9ef52

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\_tkinter.pyd

                                  Filesize

                                  38KB

                                  MD5

                                  bc1ca587d49cf50ade69bb6c0bc3b590

                                  SHA1

                                  7916a82233098310ba622008dc110e702175d741

                                  SHA256

                                  9e6287c316d465149b8255018a805f0253067640c350a3c9d020768dc7c1ecbc

                                  SHA512

                                  b2a9c582213e219ef2644d39122501538a269c7765d9a8c00a6f23e64507300872106b477b53fa3f3ab38e54c5ad0a4508d4e5699b17952ace80e205a7db7e24

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\_uuid.pyd

                                  Filesize

                                  24KB

                                  MD5

                                  3c8737723a903b08d5d718336900fd8c

                                  SHA1

                                  2ad2d0d50f6b52291e59503222b665b1823b0838

                                  SHA256

                                  bb418e91e543c998d11f9e65fd2a4899b09407ff386e059a88fe2a16aed2556b

                                  SHA512

                                  1d974ec1c96e884f30f4925cc9a03fb5af78687a267dec0d1582b5d7561d251fb733cf733e0cc00faee86f0fef6f73d36a348f3461c6d34b0238a75f69320d10

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\_wmi.pyd

                                  Filesize

                                  28KB

                                  MD5

                                  bf56a25a3757c3e80bca545e1b0edb10

                                  SHA1

                                  cce5e3e104e9c9a7a3e2f6acef3736c1670fc00e

                                  SHA256

                                  76ac15dc3a7018d523475d6079bca6e8b8b1ed4b1a96808c850a71c7aa81472c

                                  SHA512

                                  b6d0750a9c234eab7e5e6adf374296ce0638b0e6cb0b896ef52015fdcee99e78fc9d4e5da6a427cbb2bdd0fe3ef3e4142626fab9e0fe0f7b9e3ffdb877c7b619

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\base_library.zip

                                  Filesize

                                  1.3MB

                                  MD5

                                  1d8a38a5042bec4cb843de04303fe981

                                  SHA1

                                  91e045fcdb5029662161c5af0041028b3a528b7a

                                  SHA256

                                  84c76c910e25de0345e3658eff19bce4532bf3e29eeb706b6acd861610a2837a

                                  SHA512

                                  9892a3707e575fcc8c36f50a6406c8b7b2cd5ec051cb84e07f819c43380c015ab96809cf427f24324cf04f09834e10e58b8a5d8b5cc8409c68a70d63703430a2

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\libcrypto-3.dll

                                  Filesize

                                  1.6MB

                                  MD5

                                  08c227b90e920c88b1c933933daea3a7

                                  SHA1

                                  250e3fe3c6a969e9168f80895a68a47badca3d6b

                                  SHA256

                                  477e2dc2c2147fc0286ea064883bfa3b22310c4a888a4d780000db88767dcc59

                                  SHA512

                                  f4f2343a4e232480c4a4a694d6a605fc40932d5b0802e882610c10a12c6a18c6254adcf5435cda5f1c6c6e74c588e77a08cd5c55858782d695fb3e1e010ae185

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\libffi-8.dll

                                  Filesize

                                  29KB

                                  MD5

                                  fb18ee22749696cf9ede99f211544e75

                                  SHA1

                                  a4e1a9332c464c566c681af32e063d60130d9449

                                  SHA256

                                  8edba78618e85b8fa8d7ce767b4bfd0ca17c3c57dd233b4ff516ff6bf2ba17cf

                                  SHA512

                                  2f33a1f5a756c670d496e9ac89183491f60d47fdf6c9cf1b40e60c7f55dc4619ed2004e91cddc1a0b0c683f78769876b8910148ddf53b6852ab61f39d0c6eb55

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\libssl-3.dll

                                  Filesize

                                  223KB

                                  MD5

                                  8dd6662f04111dcbb721a91d815da88f

                                  SHA1

                                  a9035b732514e22461b9cec5cc25b10d7156c776

                                  SHA256

                                  a550ca304b8d8a2faa6f9079762a07fb2f50db986000ae1de3f14555f975098c

                                  SHA512

                                  b9b9cf8ca560e2cf9d408ff064b9cef8c44941e9f0ee40476f4e56d5e1e2a39ab9dcf518a0eae8849e3a098b695945ad45406d39c743e336e638de53739bfd52

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\pyexpat.pyd

                                  Filesize

                                  88KB

                                  MD5

                                  e25bd5aa1224449c253d6212cd0b6074

                                  SHA1

                                  d8274e921b9e1c27e969fcd4916a0ddff021aa65

                                  SHA256

                                  1c9fb7277e701cc85ba7c574caf22c429684db62c3804a1bb2416cecd0c32919

                                  SHA512

                                  dbfb4db3ae3a7f9cec2efe1f148489dcddeb3c0a731370d0a998f120c348b7e93cf3eb80c0a2123138e884dba8b28229ee795d14d0659dc48ec4035153148757

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\python3.DLL

                                  Filesize

                                  66KB

                                  MD5

                                  77896345d4e1c406eeff011f7a920873

                                  SHA1

                                  ee8cdd531418cfd05c1a6792382d895ac347216f

                                  SHA256

                                  1e9224ba7190b6301ef47befa8e383d0c55700255d04a36f7dac88ea9573f2fb

                                  SHA512

                                  3e98b1b605d70244b42a13a219f9e124944da199a88ad4302308c801685b0c45a037a76ded319d08dbf55639591404665befe2091f0f4206a9472fee58d55c22

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\python312.dll

                                  Filesize

                                  1.7MB

                                  MD5

                                  71fe51a2c45e725214784e1cfec8584e

                                  SHA1

                                  bc2e6d46077e1298a1b483bc9ed2d5695be43066

                                  SHA256

                                  679dba446f0db100cb02b116f402a9c19c3519756135f9b034e2580ea028f392

                                  SHA512

                                  6427025c6775c0b9dbe2f18e0c59ae9d7c876ce1c0516060bfab6bed6e02ded9241c0145040ff8af6d0df84eb164d79aa221fbc0a00f31a1c613521f0522e8e5

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\pywin32_system32\pywintypes312.dll

                                  Filesize

                                  62KB

                                  MD5

                                  29ab89ecbfbdbc2a4472803fdb018150

                                  SHA1

                                  4ca4f269f31f4dd9f31a9e60848fd32c50d3f141

                                  SHA256

                                  5d4eb1e781aaa81e336696bc0241b8d7576ccc7a79f92dedd078a3376b754573

                                  SHA512

                                  cce1ee1a5a166ba7fa7029b3c1cd157a691bb6702f8650f2394e53fd85c51e0b44e521785325b6fcb18329fbf4d76c34504d98f63185feb00ebedc14218b0024

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\select.pyd

                                  Filesize

                                  25KB

                                  MD5

                                  08a8932c89ae1ba8f118858694f5758e

                                  SHA1

                                  4bb0978bf554afd22beb3d99b66dd02436c83e53

                                  SHA256

                                  4b6e3792dc7830c15de3b1b37f06b800feeead96aa4cb63ffe47c7ede6ff5588

                                  SHA512

                                  2545a45d50d744d79a22378c4a967ab311f877b00145279bddf5329b8f619f0831d841228421687c39fb2e71697bc08e78e4e99cf675e426204bf675bdc2f184

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\INSTALLER

                                  Filesize

                                  4B

                                  MD5

                                  365c9bfeb7d89244f2ce01c1de44cb85

                                  SHA1

                                  d7a03141d5d6b1e88b6b59ef08b6681df212c599

                                  SHA256

                                  ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

                                  SHA512

                                  d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\setuptools\_vendor\jaraco\text\Lorem ipsum.txt

                                  Filesize

                                  1KB

                                  MD5

                                  4ce7501f6608f6ce4011d627979e1ae4

                                  SHA1

                                  78363672264d9cd3f72d5c1d3665e1657b1a5071

                                  SHA256

                                  37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b

                                  SHA512

                                  a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\sqlite3.dll

                                  Filesize

                                  622KB

                                  MD5

                                  6dbd9a7221be6179db0b22e59dc2bc70

                                  SHA1

                                  f0ec0f0ad08fa65578c4d12f63746b396b41bb07

                                  SHA256

                                  8037e2d0c48393f71b81b2f83370755bc2b3e8e8f96e96799333e4e666211ed0

                                  SHA512

                                  7ed7a38728bbf4f6e662df9119373deb0d751578147573711c2b13914cee1ce5d1292a20a5ed92f8fd9820e288b195c1b3961a4f7a04eaa3cbedeedf024a8dd5

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\tcl86t.dll

                                  Filesize

                                  651KB

                                  MD5

                                  8126ea234fe2251af90312917350831d

                                  SHA1

                                  f9fd9b2441f35cb5a10ce52f6bd0e32a97a6eb8d

                                  SHA256

                                  4b92a1cb3d61298f0b9290d7c1e3ffd888de97d300363a342edb14bcac2c9bb2

                                  SHA512

                                  30a96102f5d8f48e5364254ad80295795fb27b8913d47d08785d8a084557c4c73ed1e3ce9586d0ae918a87fbcad092db836b7a3e5ffa7f1a67af03c209446fc3

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\tk86t.dll

                                  Filesize

                                  624KB

                                  MD5

                                  7da2bd00604b49de68df52595e5b5d6a

                                  SHA1

                                  7af15391220242055a522dbe9e3b1f9d3a7bec6c

                                  SHA256

                                  731d0678255a34a9f86c6fc08b440fa94b762a0b347d63ecc951d35b11d8bfbd

                                  SHA512

                                  6431a09afcb8b24eaa60200db716ccdf36176b3f3c0494a5c8c957726e6769f2ea4963fce539ab0eb4c8655b3d6da11e17c30286a53b12658dcfee7ec057348a

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\unicodedata.pyd

                                  Filesize

                                  295KB

                                  MD5

                                  1f4e7bb9654070b5313e5778f34d7bf5

                                  SHA1

                                  0f50c3a698f08add7687cabdf2b3a6fb1f4e7b07

                                  SHA256

                                  6f7f0abee5fbddea7e54108c1cd76f5a6e5bb5a9f865fbcbe536ea7d370442bc

                                  SHA512

                                  ccf44cef8250521216e7017e22822a2ed0ea0a7f3c1067aa7795c4c4127c7199eb230f035147ff6d3d768983df34e6494f2993b2f2211bca17afef6bed85ac71

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\win32\win32crypt.pyd

                                  Filesize

                                  52KB

                                  MD5

                                  e2c191bdbbcfd3c73fad9a0d1babcd0e

                                  SHA1

                                  829aa3d63d6a931456793b992b44cb54a99f45ed

                                  SHA256

                                  d4e2cee3cf54aa1b3b5c9d19348a72374a76ac4cd9cc098cd538b3ff004e8bd5

                                  SHA512

                                  051896eaf9fa9ec02085dcb539db9eab141606293019d549445555908cf7ee7f5cd16c6818ba3553ebf84f7a11eea3200bd8d02a0b8d482145449e459b58dc27

                                • C:\Users\Admin\AppData\Local\Temp\_MEI27802\zlib1.dll

                                  Filesize

                                  76KB

                                  MD5

                                  a8de51d75e64ca70cd563921d9d21ecc

                                  SHA1

                                  095f1986f3529488dd6d582f54d6478f423016e0

                                  SHA256

                                  6a4f794085202619c86223c285924972599337cd02e0134b3d06b4030394be46

                                  SHA512

                                  8589aa318bc753e68674c9af7ca6bd07b4acbc36e8fd4bd9228346ee4987be0200ac9b3b3513480cb71907271352daa05dab35360cc4488200142af9977417a2

                                • C:\Users\Admin\AppData\Local\Temp\tmp0tmmnabz\Collected_Data\ss\Screenshot.png

                                  Filesize

                                  311KB

                                  MD5

                                  c67cc941939a84265ce6c659c29d24e1

                                  SHA1

                                  0d76950364cc96d4559c97aa86d2324e3472e8cd

                                  SHA256

                                  d901360c2a661e8242cbf7608f8e8d7cc0696770275d2126cd929cf2405883d6

                                  SHA512

                                  164c56c9b3a3ba13b749fc2cd971c9b69284df968bd60ad9103221b0e22bef757ac6b670cc3a944fdaeb9e621e4bd9e34e3c7e5f360ae0fdbdd7ee4be323f9fb

                                • memory/2272-1436-0x00007FFF55200000-0x00007FFF5522F000-memory.dmp

                                  Filesize

                                  188KB

                                • memory/2272-1893-0x00007FFF5DCD0000-0x00007FFF5DCF5000-memory.dmp

                                  Filesize

                                  148KB

                                • memory/2272-1424-0x00007FFF546B0000-0x00007FFF547CB000-memory.dmp

                                  Filesize

                                  1.1MB

                                • memory/2272-1426-0x00007FFF553F0000-0x00007FFF55414000-memory.dmp

                                  Filesize

                                  144KB

                                • memory/2272-1428-0x00007FFF43690000-0x00007FFF43807000-memory.dmp

                                  Filesize

                                  1.5MB

                                • memory/2272-1410-0x00007FFF591D0000-0x00007FFF591DD000-memory.dmp

                                  Filesize

                                  52KB

                                • memory/2272-1416-0x00007FFF549A0000-0x00007FFF55070000-memory.dmp

                                  Filesize

                                  6.8MB

                                • memory/2272-1452-0x00007FFF55100000-0x00007FFF55112000-memory.dmp

                                  Filesize

                                  72KB

                                • memory/2272-1451-0x00007FFF55130000-0x00007FFF55142000-memory.dmp

                                  Filesize

                                  72KB

                                • memory/2272-1450-0x00007FFF551D0000-0x00007FFF551E6000-memory.dmp

                                  Filesize

                                  88KB

                                • memory/2272-1449-0x00007FFF5A3A0000-0x00007FFF5A3B5000-memory.dmp

                                  Filesize

                                  84KB

                                • memory/2272-1448-0x00007FFF54680000-0x00007FFF546AE000-memory.dmp

                                  Filesize

                                  184KB

                                • memory/2272-1447-0x00007FFF43320000-0x00007FFF434B9000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/2272-1446-0x00007FFF434C0000-0x00007FFF4368A000-memory.dmp

                                  Filesize

                                  1.8MB

                                • memory/2272-1445-0x00007FFF550D0000-0x00007FFF550E6000-memory.dmp

                                  Filesize

                                  88KB

                                • memory/2272-1444-0x00007FFF550F0000-0x00007FFF550FC000-memory.dmp

                                  Filesize

                                  48KB

                                • memory/2272-1443-0x00007FFF43810000-0x00007FFF43D32000-memory.dmp

                                  Filesize

                                  5.1MB

                                • memory/2272-1441-0x00007FFF55120000-0x00007FFF5512B000-memory.dmp

                                  Filesize

                                  44KB

                                • memory/2272-1417-0x00007FFF58350000-0x00007FFF58384000-memory.dmp

                                  Filesize

                                  208KB

                                • memory/2272-1418-0x00007FFF59100000-0x00007FFF5910D000-memory.dmp

                                  Filesize

                                  52KB

                                • memory/2272-1433-0x00007FFF55230000-0x00007FFF5525A000-memory.dmp

                                  Filesize

                                  168KB

                                • memory/2272-1420-0x00007FFF581E0000-0x00007FFF582AD000-memory.dmp

                                  Filesize

                                  820KB

                                • memory/2272-1453-0x00007FFF430B0000-0x00007FFF4331D000-memory.dmp

                                  Filesize

                                  2.4MB

                                • memory/2272-1454-0x00007FFF43E10000-0x00007FFF43E97000-memory.dmp

                                  Filesize

                                  540KB

                                • memory/2272-1458-0x00007FFF546B0000-0x00007FFF547CB000-memory.dmp

                                  Filesize

                                  1.1MB

                                • memory/2272-1457-0x00007FFF544C0000-0x00007FFF544E8000-memory.dmp

                                  Filesize

                                  160KB

                                • memory/2272-1456-0x00007FFF59110000-0x00007FFF5911D000-memory.dmp

                                  Filesize

                                  52KB

                                • memory/2272-1455-0x00007FFF54670000-0x00007FFF5467B000-memory.dmp

                                  Filesize

                                  44KB

                                • memory/2272-1468-0x00007FFF553F0000-0x00007FFF55414000-memory.dmp

                                  Filesize

                                  144KB

                                • memory/2272-1421-0x00007FFF59110000-0x00007FFF5911D000-memory.dmp

                                  Filesize

                                  52KB

                                • memory/2272-1419-0x00007FFF58310000-0x00007FFF58343000-memory.dmp

                                  Filesize

                                  204KB

                                • memory/2272-1406-0x00007FFF43810000-0x00007FFF43D32000-memory.dmp

                                  Filesize

                                  5.1MB

                                • memory/2272-1511-0x00007FFF43690000-0x00007FFF43807000-memory.dmp

                                  Filesize

                                  1.5MB

                                • memory/2272-1404-0x00007FFF5A3A0000-0x00007FFF5A3B5000-memory.dmp

                                  Filesize

                                  84KB

                                • memory/2272-1373-0x00007FFF5DEB0000-0x00007FFF5DEBF000-memory.dmp

                                  Filesize

                                  60KB

                                • memory/2272-1541-0x00007FFF55230000-0x00007FFF5525A000-memory.dmp

                                  Filesize

                                  168KB

                                • memory/2272-1598-0x00007FFF550D0000-0x00007FFF550E6000-memory.dmp

                                  Filesize

                                  88KB

                                • memory/2272-1608-0x00007FFF43320000-0x00007FFF434B9000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/2272-1601-0x00007FFF434C0000-0x00007FFF4368A000-memory.dmp

                                  Filesize

                                  1.8MB

                                • memory/2272-1806-0x00007FFF430B0000-0x00007FFF4331D000-memory.dmp

                                  Filesize

                                  2.4MB

                                • memory/2272-1905-0x00007FFF581E0000-0x00007FFF582AD000-memory.dmp

                                  Filesize

                                  820KB

                                • memory/2272-1911-0x00007FFF551D0000-0x00007FFF551E6000-memory.dmp

                                  Filesize

                                  88KB

                                • memory/2272-1898-0x00007FFF43810000-0x00007FFF43D32000-memory.dmp

                                  Filesize

                                  5.1MB

                                • memory/2272-1409-0x00007FFF59120000-0x00007FFF59139000-memory.dmp

                                  Filesize

                                  100KB

                                • memory/2272-1892-0x00007FFF549A0000-0x00007FFF55070000-memory.dmp

                                  Filesize

                                  6.8MB

                                • memory/2272-1943-0x00007FFF54430000-0x00007FFF5443B000-memory.dmp

                                  Filesize

                                  44KB

                                • memory/2272-1376-0x00007FFF5A5D0000-0x00007FFF5A5E9000-memory.dmp

                                  Filesize

                                  100KB

                                • memory/2272-1402-0x00007FFF59490000-0x00007FFF594BD000-memory.dmp

                                  Filesize

                                  180KB

                                • memory/2272-1372-0x00007FFF5DCD0000-0x00007FFF5DCF5000-memory.dmp

                                  Filesize

                                  148KB

                                • memory/2272-2063-0x00007FFF54660000-0x00007FFF5466F000-memory.dmp

                                  Filesize

                                  60KB

                                • memory/2272-1362-0x00007FFF549A0000-0x00007FFF55070000-memory.dmp

                                  Filesize

                                  6.8MB

                                • memory/2272-2112-0x00007FFF5DCD0000-0x00007FFF5DCF5000-memory.dmp

                                  Filesize

                                  148KB

                                • memory/2272-2123-0x00007FFF544C0000-0x00007FFF544E8000-memory.dmp

                                  Filesize

                                  160KB

                                • memory/2272-2127-0x00007FFF55230000-0x00007FFF5525A000-memory.dmp

                                  Filesize

                                  168KB

                                • memory/2272-2126-0x00007FFF43690000-0x00007FFF43807000-memory.dmp

                                  Filesize

                                  1.5MB

                                • memory/2272-2125-0x00007FFF553F0000-0x00007FFF55414000-memory.dmp

                                  Filesize

                                  144KB

                                • memory/2272-2124-0x00007FFF55200000-0x00007FFF5522F000-memory.dmp

                                  Filesize

                                  188KB

                                • memory/2272-2122-0x00007FFF58310000-0x00007FFF58343000-memory.dmp

                                  Filesize

                                  204KB

                                • memory/2272-2121-0x00007FFF59100000-0x00007FFF5910D000-memory.dmp

                                  Filesize

                                  52KB

                                • memory/2272-2120-0x00007FFF58350000-0x00007FFF58384000-memory.dmp

                                  Filesize

                                  208KB

                                • memory/2272-2119-0x00007FFF591D0000-0x00007FFF591DD000-memory.dmp

                                  Filesize

                                  52KB

                                • memory/2272-2118-0x00007FFF59120000-0x00007FFF59139000-memory.dmp

                                  Filesize

                                  100KB

                                • memory/2272-2117-0x00007FFF551D0000-0x00007FFF551E6000-memory.dmp

                                  Filesize

                                  88KB

                                • memory/2272-2116-0x00007FFF5A3A0000-0x00007FFF5A3B5000-memory.dmp

                                  Filesize

                                  84KB

                                • memory/2272-2115-0x00007FFF59490000-0x00007FFF594BD000-memory.dmp

                                  Filesize

                                  180KB

                                • memory/2272-2114-0x00007FFF59110000-0x00007FFF5911D000-memory.dmp

                                  Filesize

                                  52KB

                                • memory/2272-2113-0x00007FFF5A5D0000-0x00007FFF5A5E9000-memory.dmp

                                  Filesize

                                  100KB

                                • memory/2272-2110-0x00007FFF430B0000-0x00007FFF4331D000-memory.dmp

                                  Filesize

                                  2.4MB

                                • memory/2272-2109-0x00007FFF54680000-0x00007FFF546AE000-memory.dmp

                                  Filesize

                                  184KB

                                • memory/2272-2107-0x00007FFF434C0000-0x00007FFF4368A000-memory.dmp

                                  Filesize

                                  1.8MB

                                • memory/2272-2106-0x00007FFF550D0000-0x00007FFF550E6000-memory.dmp

                                  Filesize

                                  88KB

                                • memory/2272-2105-0x00007FFF550F0000-0x00007FFF550FC000-memory.dmp

                                  Filesize

                                  48KB

                                • memory/2272-2104-0x00007FFF55100000-0x00007FFF55112000-memory.dmp

                                  Filesize

                                  72KB

                                • memory/2272-2103-0x00007FFF55120000-0x00007FFF5512B000-memory.dmp

                                  Filesize

                                  44KB

                                • memory/2272-2096-0x00007FFF546B0000-0x00007FFF547CB000-memory.dmp

                                  Filesize

                                  1.1MB

                                • memory/2272-2095-0x00007FFF581E0000-0x00007FFF582AD000-memory.dmp

                                  Filesize

                                  820KB

                                • memory/2272-2088-0x00007FFF43810000-0x00007FFF43D32000-memory.dmp

                                  Filesize

                                  5.1MB

                                • memory/2272-2111-0x00007FFF5DEB0000-0x00007FFF5DEBF000-memory.dmp

                                  Filesize

                                  60KB

                                • memory/2272-2108-0x00007FFF43320000-0x00007FFF434B9000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/2272-2102-0x00007FFF55130000-0x00007FFF55142000-memory.dmp

                                  Filesize

                                  72KB

                                • memory/2272-2131-0x00007FFF54660000-0x00007FFF5466F000-memory.dmp

                                  Filesize

                                  60KB

                                • memory/2272-2130-0x00007FFF54430000-0x00007FFF5443B000-memory.dmp

                                  Filesize

                                  44KB

                                • memory/2272-2129-0x00007FFF54670000-0x00007FFF5467B000-memory.dmp

                                  Filesize

                                  44KB

                                • memory/2272-2128-0x00007FFF43E10000-0x00007FFF43E97000-memory.dmp

                                  Filesize

                                  540KB

                                • memory/2272-2082-0x00007FFF549A0000-0x00007FFF55070000-memory.dmp

                                  Filesize

                                  6.8MB