bumblebee | hxxps://bugzilla-software[.]tech/

Analysis

max time kernel
225s
max time network
234s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2023 15:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bugzilla-software.tech/

Score

10^/10

bumblebee bz2106 trojan

Malware Config

Extracted

Family

bumblebee

Botnet

bz2106

176.111.174.70:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Executes dropped EXE 1 IoCs

pid	Process
472	InstallerBugzilla.exe

Loads dropped DLL 1 IoCs

pid	Process
4904	regsvr32.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4904	regsvr32.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DD475EBC-D960-4AF4-BB8A-BE91FA942756}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D47.tmp	msiexec.exe
File created	C:\Windows\Installer\e573c6f.msi	msiexec.exe
File created	C:\Windows\Installer\e573c6d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e573c6d.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000003c70357fb409b87e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800003c70357f0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d012000000000000000032000000ffffffff0000000007000100006809003c70357f000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01232000000000020ed0d000000ffffffff0000000007000100006809193c70357f000000000000d0123200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003c70357f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	InstallerBugzilla.exe
Key created	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	InstallerBugzilla.exe
Key created	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Bugzilla_506.msi:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Bugzilla_512.msi:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1688	msiexec.exe
1688	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
472	InstallerBugzilla.exe
1784	7zFM.exe
6832	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4272	firefox.exe
Token: SeDebugPrivilege	4272	firefox.exe
Token: SeDebugPrivilege	4272	firefox.exe
Token: SeShutdownPrivilege	3540	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3540	msiexec.exe
Token: SeSecurityPrivilege	1688	msiexec.exe
Token: SeCreateTokenPrivilege	3540	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3540	msiexec.exe
Token: SeLockMemoryPrivilege	3540	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3540	msiexec.exe
Token: SeMachineAccountPrivilege	3540	msiexec.exe
Token: SeTcbPrivilege	3540	msiexec.exe
Token: SeSecurityPrivilege	3540	msiexec.exe
Token: SeTakeOwnershipPrivilege	3540	msiexec.exe
Token: SeLoadDriverPrivilege	3540	msiexec.exe
Token: SeSystemProfilePrivilege	3540	msiexec.exe
Token: SeSystemtimePrivilege	3540	msiexec.exe
Token: SeProfSingleProcessPrivilege	3540	msiexec.exe
Token: SeIncBasePriorityPrivilege	3540	msiexec.exe
Token: SeCreatePagefilePrivilege	3540	msiexec.exe
Token: SeCreatePermanentPrivilege	3540	msiexec.exe
Token: SeBackupPrivilege	3540	msiexec.exe
Token: SeRestorePrivilege	3540	msiexec.exe
Token: SeShutdownPrivilege	3540	msiexec.exe
Token: SeDebugPrivilege	3540	msiexec.exe
Token: SeAuditPrivilege	3540	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3540	msiexec.exe
Token: SeChangeNotifyPrivilege	3540	msiexec.exe
Token: SeRemoteShutdownPrivilege	3540	msiexec.exe
Token: SeUndockPrivilege	3540	msiexec.exe
Token: SeSyncAgentPrivilege	3540	msiexec.exe
Token: SeEnableDelegationPrivilege	3540	msiexec.exe
Token: SeManageVolumePrivilege	3540	msiexec.exe
Token: SeImpersonatePrivilege	3540	msiexec.exe
Token: SeCreateGlobalPrivilege	3540	msiexec.exe
Token: SeBackupPrivilege	4648	vssvc.exe
Token: SeRestorePrivilege	4648	vssvc.exe
Token: SeAuditPrivilege	4648	vssvc.exe
Token: SeBackupPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeDebugPrivilege	4272	firefox.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
4272	firefox.exe
4272	firefox.exe
4272	firefox.exe
4272	firefox.exe
3540	msiexec.exe
3540	msiexec.exe
1784	7zFM.exe
1784	7zFM.exe
1784	7zFM.exe
1784	7zFM.exe
1784	7zFM.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4272	firefox.exe
4272	firefox.exe
4272	firefox.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
4272	firefox.exe
4272	firefox.exe
4272	firefox.exe
4272	firefox.exe
4272	firefox.exe
4272	firefox.exe
4272	firefox.exe
4272	firefox.exe
4272	firefox.exe
4272	firefox.exe
6832	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 4272	1116	firefox.exe	85
PID 1116 wrote to memory of 4272	1116	firefox.exe	85
PID 1116 wrote to memory of 4272	1116	firefox.exe	85
PID 1116 wrote to memory of 4272	1116	firefox.exe	85
PID 1116 wrote to memory of 4272	1116	firefox.exe	85
PID 1116 wrote to memory of 4272	1116	firefox.exe	85
PID 1116 wrote to memory of 4272	1116	firefox.exe	85
PID 1116 wrote to memory of 4272	1116	firefox.exe	85
PID 1116 wrote to memory of 4272	1116	firefox.exe	85
PID 1116 wrote to memory of 4272	1116	firefox.exe	85
PID 1116 wrote to memory of 4272	1116	firefox.exe	85
PID 4272 wrote to memory of 1004	4272	firefox.exe	86
PID 4272 wrote to memory of 1004	4272	firefox.exe	86
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 3712	4272	firefox.exe	87
PID 4272 wrote to memory of 2092	4272	firefox.exe	88
PID 4272 wrote to memory of 2092	4272	firefox.exe	88
PID 4272 wrote to memory of 2092	4272	firefox.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://bugzilla-software.tech/
1⤵
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://bugzilla-software.tech/
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4272.0.1426624149\1363556365" -parentBuildID 20221007134813 -prefsHandle 1860 -prefMapHandle 1856 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fac2ff8e-075b-4447-8df4-8ede43ed4d14} 4272 "\\.\pipe\gecko-crash-server-pipe.4272" 1936 19d63817758 gpu
    3⤵
    PID:1004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4272.1.474610764\527903725" -parentBuildID 20221007134813 -prefsHandle 2340 -prefMapHandle 2336 -prefsLen 21706 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {94e73998-f013-45a0-92ae-1d34cefcd3a1} 4272 "\\.\pipe\gecko-crash-server-pipe.4272" 2352 19d5596fb58 socket
    3⤵
    PID:3712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4272.2.1130408135\284829239" -childID 1 -isForBrowser -prefsHandle 1668 -prefMapHandle 2940 -prefsLen 21854 -prefMapSize 232675 -jsInitHandle 1464 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d6c57152-f257-4835-b8e6-dde7ce1ae61a} 4272 "\\.\pipe\gecko-crash-server-pipe.4272" 2820 19d65f04d58 tab
    3⤵
    PID:2092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4272.3.1186479648\1445310070" -childID 2 -isForBrowser -prefsHandle 3972 -prefMapHandle 3968 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1464 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {549c3d9f-966d-42f4-b815-8f1db45c5771} 4272 "\\.\pipe\gecko-crash-server-pipe.4272" 3984 19d67939e58 tab
    3⤵
    PID:4848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4272.6.649509467\203707530" -childID 5 -isForBrowser -prefsHandle 5156 -prefMapHandle 5160 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1464 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5b91060-eee4-4708-af8d-9d8d1d6e9024} 4272 "\\.\pipe\gecko-crash-server-pipe.4272" 5152 19d68e5b858 tab
    3⤵
    PID:4380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4272.5.1648163820\1244399089" -childID 4 -isForBrowser -prefsHandle 4964 -prefMapHandle 4968 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1464 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {06c5811b-7a9e-4d0e-87e2-926774fc6ffc} 4272 "\\.\pipe\gecko-crash-server-pipe.4272" 4956 19d68ac8f58 tab
    3⤵
    PID:4256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4272.4.472843823\1847100921" -childID 3 -isForBrowser -prefsHandle 4772 -prefMapHandle 4732 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1464 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d193e5c9-90b8-4307-884c-7e191c8e791d} 4272 "\\.\pipe\gecko-crash-server-pipe.4272" 4824 19d64f16c58 tab
    3⤵
    PID:64

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\Bugzilla_506.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3540

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1688
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3484
- C:\Windows\system32\regsvr32.exe
  regsvr32 "C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\bz.dll"
  2⤵
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  PID:4904
- C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\InstallerBugzilla.exe
  "C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\InstallerBugzilla.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:472

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4648

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "F:\bugzilla-STABLE.tar.gz"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1784

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6796

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:6832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e573c6e.rbs

Filesize
7KB

MD5
cc4e5c00049c8dbbcb16db6e4cc92c8e

SHA1
e5d50511c3928ac368ec3117016ab758ad5a336b

SHA256
6a2200ed804b5a9965d7d1976e67025120db4e55c8444002725b5f24644a6ef2

SHA512
b40eb1052677552bc324cb9536f4eef5774350c1e79c055ad0a7564b26b27577480095dcc839efeb2a4a397ce1f7363e3b27cac456f89ebebb135caeb09eeed4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
bec6d71058f690457ae2f54a177c69a1

SHA1
011903140132d8d6135fe918519577a905756175

SHA256
9412ca252c5e321a8d574f432a1d85647c79ef527d7f171333c398db195bf886

SHA512
84fd56326910806168ae0dff2ba10fd4240d928f7bd2ab778b89b01300f4bd00c5e120bfa5a85c0eb0103829c4df41d8a3ad950eb777738f686b59be3d75a8d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
8458cfbed223b6264b59b465a5b019be

SHA1
0644df4988061656cdb0c96d8c3eac7ec52184f2

SHA256
40ff20d4893c61b9820a9540fdead9fbfbf7ab729f562c89d20fe6e67db25beb

SHA512
613c65525fba715c82ad440109c9952ac1f5f04b501db627be45a40c76edfc39b2b4e4a542208e531c68ccb89435fa3479142df96b7384ad19803e5f3b6e09b6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0b3n2faz.default-release\activity-stream.discovery_stream.json.tmp

Filesize
154KB

MD5
e9d4022891f397eee5dcd7ab442f7c07

SHA1
c1acb8eb4bae0c0e11634c2a55b5040f433f1867

SHA256
7d6f9488446e06ab3460b055dea8c683569dd2c41d363901a712d44bcfd5556e

SHA512
a02d248e0063fc55c92bc872c906323fb0c8263d72a9972cbb31f4045bbff10d67bbf3611cc4eeb9cee0e65fec916b9184211afe7245ce826742b648521084a8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0b3n2faz.default-release\cache2\entries\118BB2BA245AAA64B01692DF29396B97E11FC1A0

Filesize
14KB

MD5
b94167b6d2ff62f2815bab90678d3932

SHA1
63061ddd9673077bc235012b005c7174270c4801

SHA256
5a42eb94b0a25ee3b2fbc5120fe4f3b349458bd14038dcfb8e94ce43a1529a4e

SHA512
2371480f813b0e457cba2f4a70206991be2c01bd49a912f5cdff92aaca5e5100dffcea1add998a3dbf3a86acea8ee9b2001f3a77be65899b35d5da3c34842b1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\InstallerBugzilla.exe

Filesize
290KB

MD5
c582e466993bfd6f8b5cb7761e6f9a10

SHA1
142e6278733940eb85074db43fee3de7a3fd441e

SHA256
6597b6ecd9d1744a460a8aefdd246e5c606ee955323443d1fdcf8dcd9405780f

SHA512
f6d91df511c81034d25dce5ce012a7366aabc86ab578c23bc4d9d53cbb02b1e53f84535804baceafa98010508245127eb1399310c0463adb02929f489c0be9e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\InstallerBugzilla.exe

Filesize
290KB

MD5
c582e466993bfd6f8b5cb7761e6f9a10

SHA1
142e6278733940eb85074db43fee3de7a3fd441e

SHA256
6597b6ecd9d1744a460a8aefdd246e5c606ee955323443d1fdcf8dcd9405780f

SHA512
f6d91df511c81034d25dce5ce012a7366aabc86ab578c23bc4d9d53cbb02b1e53f84535804baceafa98010508245127eb1399310c0463adb02929f489c0be9e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\bz.dll

Filesize
1.3MB

MD5
b2a58d30b4127c8ddc6f1e6ce5cd2821

SHA1
e07292fa3dc3b23bff6c4de6df79449acad23f88

SHA256
0f6215613e34ea753587ee98d7098bd713874fcba395df052ec970d19ecac7f9

SHA512
7d6c0d3071a4c8f98a618d8726d15a2b8cde4cf9abcdbb3b36be2f1bfccb4d80a9da48197516d42720d399dabbaf37747ea1d93446ddf7e1387e46fa84349c63

Download Submit
C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\bz.dll

Filesize
1.3MB

MD5
b2a58d30b4127c8ddc6f1e6ce5cd2821

SHA1
e07292fa3dc3b23bff6c4de6df79449acad23f88

SHA256
0f6215613e34ea753587ee98d7098bd713874fcba395df052ec970d19ecac7f9

SHA512
7d6c0d3071a4c8f98a618d8726d15a2b8cde4cf9abcdbb3b36be2f1bfccb4d80a9da48197516d42720d399dabbaf37747ea1d93446ddf7e1387e46fa84349c63

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0b3n2faz.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0b3n2faz.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0b3n2faz.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0b3n2faz.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0b3n2faz.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0b3n2faz.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0b3n2faz.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0b3n2faz.default-release\prefs-1.js

Filesize
8KB

MD5
423ded29187bbde7af84ff4f8605be78

SHA1
6dad60d6c8a6c5cf81c94ba846456ba67494553f

SHA256
263179884489308e412159841977a4e0840c27b4a0aebd7ce91cd75e2e1fb9e7

SHA512
18adc02dc7e0d3c05fe97cf26c29812b233c264273d240c70d26d6d08f374d1ea0c7b13d2b281be36a3d3f1741cbfe8e49b57d18419f2070c2472340dce1862c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0b3n2faz.default-release\prefs-1.js

Filesize
7KB

MD5
36d45a802250fcc247ec8b1cd1aed770

SHA1
1b9126515d908d08a8f98aec6de6f5c0a9bbbb0e

SHA256
7e06a0fc8d049441b0cd3512d06023f5a485e8b2e23777447217e07582172ac2

SHA512
674dd0a61dbd96ad8801a6ce8b54cae72a78c128d6c26ef6443b81d9ce61234377d9e7774d6c4034427c5821540e3fda4a21bd02286456b77b5dfbb791c56d87

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0b3n2faz.default-release\prefs.js

Filesize
6KB

MD5
de9abd38a939cac31be594ac2f90fea0

SHA1
78585520c10d87d5154c7b8eb03f535ceed3bacf

SHA256
9a91fa8b13b6c444cc5fcbdda02b4cfbf5a08fa2af664b36a0c645cd01f52ff0

SHA512
0394924e748323f4aef4a9753a14d021f655afc4698a05578af383c0a7ceda3e84784b9599b80a468c9e6caa92e8020befeb7acec2ae7876a68d44a59db82c3a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0b3n2faz.default-release\prefs.js

Filesize
6KB

MD5
d5156b1bf4bb19e0761604c9dfd94274

SHA1
52ecb2d6d1f3f760b31424e9141dde7565902256

SHA256
e221ecbb9ed1ca1fc051c3f4520570365cc1509ba7ff3f75e20f1f442fbad2af

SHA512
43e782185911ae45a1a209ddc9da4328aec9481bf0d2795e7f9cf386a49a78d0f2cc8ea208eb6958c70fecdb0c9cbb25c9ca1e3d1974e8f3013b63055f3fed83

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0b3n2faz.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
26KB

MD5
2f7f4359995d7f287226257bca7179de

SHA1
08437e553b8eb13fac0e7eb0ed3b7e22e9f197ec

SHA256
4059231cb49b15ccd15905942ca93338f28db438c1afed549c4786115662912c

SHA512
b5c5641f559b174da37fe5638875aa1c6deb6d623179a38c51969c8450a33b25b67882a2f1d583932f60f5fb367ab6b9ab70b961446aaf51b61ef949e45ea670

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0b3n2faz.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
26KB

MD5
edde28528748c213a609d9448305fac0

SHA1
8e307fcd383236e418d5cedd954eda721ae3a35a

SHA256
7dc071316a386cbceb1bd7746b2eae6f73255d0d083921a8ca88da9b6109ceaf

SHA512
57a6f8519504e5003fea8c6242a3e7364229c41b0548a833fa5f10c6e91bc7d766e61f596771a4e72e8853e796348765de736d5e218c7d8e3c218115202a476f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0b3n2faz.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
26KB

MD5
b063b4dd5ad7988ab63955b90d4e51e3

SHA1
a5cedc00b00e312aeaf5a59c5aa7bfeea6b20918

SHA256
9c78d0eb19678ce75db9c99f12643fe1b5b3c4390bce0fbadde077a5c9302a32

SHA512
d4048bbcfe3b94cefeb4dcd6b0dde3fcbaf9658c4aee3dd61981c4a1c22efcf3c2c08a10106c897f732967415dfbb6490c54716ffac356ce6b49ad96ed8d9dfb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0b3n2faz.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
26KB

MD5
cb8e042a28beb3fcd0a636c1428d3fe9

SHA1
d4a9a0f05fd17ae9d53f0b95927ef5563fcae42b

SHA256
bbf912fd080931fd56ac42703c835f84ea6ac287645efa8f5ef4dbcfc494b943

SHA512
b7bb80086479d57ea913a95727db265fc6d160a907803aba07e3d0567a8b50ec6f39764bbcdee316f9761e0022ac49a040cf64785ac97d06dbe10298a874d1eb

Download Submit
C:\Users\Admin\Downloads\Bugzilla_506.msi

Filesize
920KB

MD5
c0f4b1036b8580f84418356dbcb4f7f0

SHA1
81ecafb47459a430b7210a076179029d27675148

SHA256
b778aa7ab828dd28dacf29d33b595bff3dd29718ad5706548d53797ead57d3c8

SHA512
ce4222b4cb9785ed207703067e9a2e9cd30973585cabcc674be8139d2d38e3799e004ae8ce9258dbf16249f92cf1c247de8ca9cd8cd60f8713d4b5fd8d34ca4b

Download Submit
C:\Users\Admin\Downloads\Bugzilla_506.xqFJ1WCA.msi.part

Filesize
63KB

MD5
eb18445ff380309e7da369ff20d046b3

SHA1
88b6f6cbd7c6a9add15f70895bcde7ca94d74dec

SHA256
f8a1f2616ca022d90ace33453a64f795cd85644e18aae602100b8d3fedc14a3e

SHA512
add8e8927b6ec17056102263cb0678acc23472afdbe94674ed1b25f7778a5502597eee23f40cafd89437c3d3bc289a3d2674ba2466c38d7329d5b09b824c0347

Download Submit
F:\bugzilla-STABLE.tar.gz

Filesize
3.8MB

MD5
f291254bc7971c95bd7b1fc04b28081a

SHA1
bef85c8e7e031ca21d7c59f3c2dc083f52b3d7b1

SHA256
dd41a4b0a3a1df0d193bc056f2e3711d7b5605718a00bf6e5d4177bf1be86f77

SHA512
8ca47ea1be2b433a6ce68e1a595d72f3d0f0fede44d1194dc6bc9a116dbde3ab7285212c71995e200d31544876e4c3c57b63da1f877a0cb22747ab87a5d598de

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.0MB

MD5
a4eb53ea04bee68f4ee3738476300421

SHA1
1ef602a2003a1bc67c33f49d6c35708cb6d3859c

SHA256
ec13c735248e97dab305eb62846c45af63193ffd9138cbc99c586ff465f62d53

SHA512
7879305b99d18c7ea7360b8353fc2628448676d6fe2366584bc217c470b377d419f7c4f363b3504acd038b470142dbe61e25646bb7b433acf4be4118c5ca0cfb

Download Submit
\??\Volume{7f35703c-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{6516ade5-d88f-4313-9b12-7237433a8415}_OnDiskSnapshotProp

Filesize
5KB

MD5
10757aa3677383cae7f4244b129a4ae5

SHA1
183e565e12dd0173b4124d63a96be412b413f43a

SHA256
ffcb7628b5773f0c151a2a5e6b8e89e9982a0410989f6798cad62a678d841515

SHA512
6d13e81a9c6c9b0c2a8f5803d591887e62322ac2603e9e4f9e428fab6f3a5a5442736466055b62d6214d5a87e67b058f45ceb9de2df6a44eabc764f85eb3f818

Download Submit
memory/472-337-0x0000000008170000-0x00000000081A8000-memory.dmp

Filesize
224KB

Download
memory/472-340-0x0000000004B90000-0x0000000004BA0000-memory.dmp

Filesize
64KB

Download
memory/472-373-0x0000000004B90000-0x0000000004BA0000-memory.dmp

Filesize
64KB

Download
memory/472-372-0x0000000004B90000-0x0000000004BA0000-memory.dmp

Filesize
64KB

Download
memory/472-369-0x0000000008E60000-0x0000000008EF2000-memory.dmp

Filesize
584KB

Download
memory/472-368-0x0000000009710000-0x0000000009CB4000-memory.dmp

Filesize
5.6MB

Download
memory/472-327-0x0000000000180000-0x00000000001CE000-memory.dmp

Filesize
312KB

Download
memory/472-336-0x00000000075F0000-0x00000000075F8000-memory.dmp

Filesize
32KB

Download
memory/472-338-0x0000000008140000-0x000000000814E000-memory.dmp

Filesize
56KB

Download
memory/472-339-0x0000000004B90000-0x0000000004BA0000-memory.dmp

Filesize
64KB

Download
memory/472-374-0x0000000004B90000-0x0000000004BA0000-memory.dmp

Filesize
64KB

Download
memory/472-341-0x0000000004B90000-0x0000000004BA0000-memory.dmp

Filesize
64KB

Download
memory/4904-346-0x0000000002E30000-0x0000000002F91000-memory.dmp

Filesize
1.4MB

Download
memory/4904-347-0x0000000002E30000-0x0000000002F91000-memory.dmp

Filesize
1.4MB

Download
memory/4904-348-0x0000000002E30000-0x0000000002F91000-memory.dmp

Filesize
1.4MB

Download
memory/4904-349-0x0000000002E30000-0x0000000002F91000-memory.dmp

Filesize
1.4MB

Download
memory/4904-350-0x0000000002E30000-0x0000000002F91000-memory.dmp

Filesize
1.4MB

Download
memory/4904-351-0x0000000002C40000-0x0000000002CCC000-memory.dmp

Filesize
560KB

Download