adc1bbfadcc79258c378134dc9f3fb65366df6d7bc81a3e1fe79d3d9d57cdab4

Analysis

max time kernel
214s
max time network
225s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
05-05-2024 20:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

osurx.exe
Size

20.1MB
MD5

3fcb67a0a6291be47899d929876320bf
SHA1

2210fc1708fe193911b80a469813effeeaf76203
SHA256

adc1bbfadcc79258c378134dc9f3fb65366df6d7bc81a3e1fe79d3d9d57cdab4
SHA512

9ba51e490f7bfd32f4edc5ee7ce10abf1d22f4914b64cff8bef22dd9513ada0c5a3c901c94548f24fb812a2d522ad4fda7dab0220d64296587985080fa1f8674
SSDEEP

393216:KWMzd6T5VDF/mshj0Ob93ZWXqa7V4LCHmr7crNMj:KWMh+5VB/mshHb93ZgR4L0eOMj

Score

8^/10

agilenet

Malware Config

Signatures

Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

osu!install.exeosu!.exeim.exe

pid process

1944 osu!install.exe
4384 osu!.exe
3288 im.exe

pid	process
1944	osu!install.exe
4384	osu!.exe
3288	im.exe

Loads dropped DLL 64 IoCs

Processes:

osurx.exeosu!.exe

pid	process
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
4384	osu!.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/3388-1479-0x0000000016CE0000-0x0000000016CFC000-memory.dmp	agile_net

Drops desktop.ini file(s) 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 46 IoCs

Processes:

osurx.exe

pid	process
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exesvchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 2 IoCs

Processes:

svchost.exefirefox.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2551177587-3778486488-1329702901-1000\{4C585455-8908-4AB6-9D1B-8C898A8E14DA}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

Processes:

firefox.exe

description ioc process

File created C:\Users\Admin\Downloads\osu!install.exe:Zone.Identifier firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\osu!install.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

osurx.exe

pid	process
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe
3388	osurx.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

osurx.exefirefox.exeAUDIODG.EXEosu!install.exeosu!.exeim.exe

description	pid	process
Token: SeDebugPrivilege	3388	osurx.exe
Token: SeDebugPrivilege	3388	osurx.exe
Token: SeDebugPrivilege	2176	firefox.exe
Token: SeDebugPrivilege	2176	firefox.exe
Token: 33	2568	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2568	AUDIODG.EXE
Token: SeDebugPrivilege	2176	firefox.exe
Token: SeDebugPrivilege	2176	firefox.exe
Token: SeDebugPrivilege	2176	firefox.exe
Token: SeDebugPrivilege	1944	osu!install.exe
Token: SeDebugPrivilege	4384	osu!.exe
Token: SeDebugPrivilege	3288	im.exe

Suspicious use of FindShellTrayWindow 8 IoCs

Processes:

firefox.exe

pid process

2176 firefox.exe
2176 firefox.exe
2176 firefox.exe
2176 firefox.exe
2176 firefox.exe
2176 firefox.exe
2176 firefox.exe
2176 firefox.exe
Suspicious use of SendNotifyMessage 7 IoCs

Processes:

firefox.exe

pid process

2176 firefox.exe
2176 firefox.exe
2176 firefox.exe
2176 firefox.exe
2176 firefox.exe
2176 firefox.exe
2176 firefox.exe

pid	process
2176	firefox.exe
2176	firefox.exe
2176	firefox.exe
2176	firefox.exe
2176	firefox.exe
2176	firefox.exe
2176	firefox.exe
2176	firefox.exe

pid	process
2176	firefox.exe
2176	firefox.exe
2176	firefox.exe
2176	firefox.exe
2176	firefox.exe
2176	firefox.exe
2176	firefox.exe

Suspicious use of SetWindowsHookEx 24 IoCs

Processes:

osurx.exefirefox.exeOpenWith.exe

pid	process
3388	osurx.exe
2176	firefox.exe
2176	firefox.exe
2176	firefox.exe
2176	firefox.exe
2176	firefox.exe
2176	firefox.exe
2176	firefox.exe
2176	firefox.exe
2176	firefox.exe
2176	firefox.exe
2176	firefox.exe
2176	firefox.exe
2176	firefox.exe
2176	firefox.exe
2176	firefox.exe
2176	firefox.exe
2176	firefox.exe
2176	firefox.exe
2176	firefox.exe
2176	firefox.exe
2176	firefox.exe
2176	firefox.exe
4428	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 2076 wrote to memory of 2176	2076	firefox.exe	firefox.exe
PID 2076 wrote to memory of 2176	2076	firefox.exe	firefox.exe
PID 2076 wrote to memory of 2176	2076	firefox.exe	firefox.exe
PID 2076 wrote to memory of 2176	2076	firefox.exe	firefox.exe
PID 2076 wrote to memory of 2176	2076	firefox.exe	firefox.exe
PID 2076 wrote to memory of 2176	2076	firefox.exe	firefox.exe
PID 2076 wrote to memory of 2176	2076	firefox.exe	firefox.exe
PID 2076 wrote to memory of 2176	2076	firefox.exe	firefox.exe
PID 2076 wrote to memory of 2176	2076	firefox.exe	firefox.exe
PID 2076 wrote to memory of 2176	2076	firefox.exe	firefox.exe
PID 2076 wrote to memory of 2176	2076	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 3116	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 5004	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 5004	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 5004	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 5004	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 5004	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 5004	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 5004	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 5004	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 5004	2176	firefox.exe	firefox.exe
PID 2176 wrote to memory of 5004	2176	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\osurx.exe
"C:\Users\Admin\AppData\Local\Temp\osurx.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3388

C:\Users\Admin\AppData\Local\Temp\im.exe
"C:\Users\Admin\AppData\Local\Temp\im.exe" 2856 4384 C:\Users\Admin\AppData\Local\Temp\\a.bin 3388
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3288

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2076

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.0.1572412321\2082300940" -parentBuildID 20230214051806 -prefsHandle 1756 -prefMapHandle 1744 -prefsLen 22074 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {af9e66b0-d7c7-404b-ab35-386c09bb7b52} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 1848 2694c523758 gpu
3⤵
PID:3116

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.1.1671238459\1907969765" -parentBuildID 20230214051806 -prefsHandle 2360 -prefMapHandle 2348 -prefsLen 22110 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {473ebeed-caa3-4de6-a75b-83d0af5cac9e} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 2372 2693f889f58 socket
3⤵
PID:5004

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.2.2029644884\151884907" -childID 1 -isForBrowser -prefsHandle 2880 -prefMapHandle 3020 -prefsLen 22148 -prefMapSize 235121 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {df28aa9f-e525-4fbe-b0d5-0ed7144e9692} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 2912 2694f506b58 tab
3⤵
PID:3700

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.3.1823874391\72992071" -childID 2 -isForBrowser -prefsHandle 3608 -prefMapHandle 3604 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dafb5c8a-6b09-4d8e-8063-ae9c3511e0bd} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 3620 26952062e58 tab
3⤵
PID:2280

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.4.981522523\1715763770" -childID 3 -isForBrowser -prefsHandle 5140 -prefMapHandle 5136 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d498230-050c-4a22-8993-37765154b405} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 5128 26953ecd258 tab
3⤵
PID:4244

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.5.1226714183\354064512" -childID 4 -isForBrowser -prefsHandle 5332 -prefMapHandle 5340 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1346ed53-b1e7-4edf-8193-b610bc62eeaf} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 5324 26954b0e258 tab
3⤵
PID:4844

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.6.658194681\395967034" -childID 5 -isForBrowser -prefsHandle 5512 -prefMapHandle 5520 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {af1b0427-dc5a-4d2c-9601-c05c694f1da8} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 5500 26954bbb758 tab
3⤵
PID:4768

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.7.854484361\227521381" -childID 6 -isForBrowser -prefsHandle 5540 -prefMapHandle 5544 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4dfc65f7-02c4-44d5-a25b-93488619d09c} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 5976 26955bdfc58 tab
3⤵
PID:1628

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.8.157017601\1762029168" -parentBuildID 20230214051806 -prefsHandle 4416 -prefMapHandle 6172 -prefsLen 28096 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {97c6e0c1-e864-469d-844a-8467be4155ae} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 3916 269534edf58 rdd
3⤵
PID:4184

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.9.67923013\300862050" -parentBuildID 20230214051806 -sandboxingKind 1 -prefsHandle 4952 -prefMapHandle 4948 -prefsLen 28096 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9be518a9-1a66-4ea4-84ad-b4dfc04f5a5c} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 2976 269534ec158 utility
3⤵
PID:752

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.10.1237117324\1231306194" -parentBuildID 20230214051806 -sandboxingKind 0 -prefsHandle 6220 -prefMapHandle 6172 -prefsLen 28096 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1f9ad5b4-a998-4fba-95ef-a742aa33e346} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 6232 26953e3f858 utility
3⤵
PID:2068

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.11.1455227450\1578521950" -childID 7 -isForBrowser -prefsHandle 5228 -prefMapHandle 5240 -prefsLen 28175 -prefMapSize 235121 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {40249c86-83de-429e-a4d0-1b50f4ac15b5} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 5164 26953936258 tab
3⤵
PID:1692

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.12.886316967\1635586287" -childID 8 -isForBrowser -prefsHandle 10736 -prefMapHandle 10748 -prefsLen 28175 -prefMapSize 235121 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {93d78469-3ef3-49f4-a4ac-211270dfb29c} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 10728 2695115a058 tab
3⤵
PID:4764

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.13.838515872\509575392" -childID 9 -isForBrowser -prefsHandle 10588 -prefMapHandle 10584 -prefsLen 28175 -prefMapSize 235121 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d2a9e4d-ed78-46d4-8e6a-9bc9c25c0cb0} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 10596 2695115b258 tab
3⤵
PID:3428

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.14.813557557\1184854939" -childID 10 -isForBrowser -prefsHandle 6424 -prefMapHandle 6252 -prefsLen 28175 -prefMapSize 235121 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ffc28340-24ca-4d19-8377-4921be012824} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 6420 269572bf258 tab
3⤵
PID:4940

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.15.1189989294\914511562" -childID 11 -isForBrowser -prefsHandle 6132 -prefMapHandle 6212 -prefsLen 28175 -prefMapSize 235121 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8cc610b0-15ee-4469-9834-dd3e3c4d90d4} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 7956 269572bda58 tab
3⤵
PID:2996

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.16.694391343\1105830172" -childID 12 -isForBrowser -prefsHandle 10740 -prefMapHandle 7084 -prefsLen 28175 -prefMapSize 235121 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aba42adf-3f1a-4837-b20f-96d224e534b7} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 5692 26957799958 tab
3⤵
PID:756

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.17.1001696673\885181471" -childID 13 -isForBrowser -prefsHandle 9220 -prefMapHandle 7440 -prefsLen 28175 -prefMapSize 235121 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9174c2e2-0fe5-47e0-a9fa-025a7d24af1a} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 7628 26958018a58 tab
3⤵
PID:1760

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.18.2018276564\1548131556" -childID 14 -isForBrowser -prefsHandle 3636 -prefMapHandle 4876 -prefsLen 28175 -prefMapSize 235121 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fdb9aa87-f945-40b7-96fc-15b8ffeb6460} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 4680 26958341158 tab
3⤵
PID:3364

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.19.538658433\650234392" -childID 15 -isForBrowser -prefsHandle 10204 -prefMapHandle 10200 -prefsLen 28175 -prefMapSize 235121 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7257613-2af4-4b53-b188-c48c0a2c0fd5} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 7452 26958341d58 tab
3⤵
PID:2796

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.20.1914186614\2013741123" -childID 16 -isForBrowser -prefsHandle 4420 -prefMapHandle 3812 -prefsLen 28175 -prefMapSize 235121 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a606a10b-4894-4ac5-abaf-6ea665947953} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 4380 269582e3b58 tab
3⤵
PID:5384

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.21.1261717604\2105204676" -childID 17 -isForBrowser -prefsHandle 7684 -prefMapHandle 7712 -prefsLen 28224 -prefMapSize 235121 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {74ace8bb-bab0-4218-9845-0c2d8fd68c08} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 8332 26954b9f158 tab
3⤵
PID:5556

C:\Users\Admin\Downloads\osu!install.exe
"C:\Users\Admin\Downloads\osu!install.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1944

C:\Users\Admin\AppData\Local\osu!\osu!.exe
"C:\Users\Admin\AppData\Local\osu!\osu!.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4384

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004DC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2712

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
PID:5804

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:5924

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
Filesize
765B

MD5
9f3f8403dd7890d14eeffa39807cc22b

SHA1
6fe7624cc861a07f86934c9eac6e725fdf855db2

SHA256
2f647aba54d9fc4215cd907f22f716c6e23e5ced1e2c3d79e52d6823e867b301

SHA512
26cfa2bd6f9b9578ac0524efe7e5ce39ba2eb10dfb6b9a9391f7eec64a4280ef726e0254b3c228fd91356c9d0ff2f5e306ee9da62748471172b15d316bb5034e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AEACCDA8653DD8D7B2EA32F21D15D44F_C99E84AF904BD8598CB3FED576528926
Filesize
637B

MD5
b0330f84b862b4690aca84cda7c77b5f

SHA1
c3793e30b5e3f96d98cbcbbb7d67890ee252250c

SHA256
85357b17915ea61d8cf64a21d6bfed2786ea5a401387e0c8cf4d6f95b8573f2a

SHA512
091a5ab6f45a3740f8d04e8c9af265d1a69b9a2f8b8205035ec878d278199fd83429902acd16a42c7d60e6991399d6c9165bb665e619e00b8f0eceb30e11be31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Filesize
1KB

MD5
e16854fbde5af5baa52f1fad5d78f019

SHA1
4880314a303ccd0c4fe465414e76ade84370cefe

SHA256
fe33a7340cb794a32d3dcd1202f63c0ea261f7b117d7a5fd4b4382c73be2837c

SHA512
017099968630c9dcb46dc69e56753ec768dd856797f65f5955285bd5c4998f24c8de7c985d82d2c4689392454d67d8cdb59e0d2c6074b01cc06a4775c9b31878

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
Filesize
484B

MD5
1b1019eeb2c841b99c977f3c83647a96

SHA1
1e541972e8977e2504fd6928a62da626731ed130

SHA256
0d1c70a499f02f9cc15415b77326eefad8ba33157a68f4cadd11fa16c122315f

SHA512
13469fcfafedae88ae1871e3d394fa73be91e8ec1d908ba463501bb9e3fdcb4d832e4c1c65bb9114cf27b376231cc4bf0de641e3ad81abd8874f66ee56c6d4e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AEACCDA8653DD8D7B2EA32F21D15D44F_C99E84AF904BD8598CB3FED576528926
Filesize
488B

MD5
f0b3b2b2de449b48a30fe9ff2c6bbc63

SHA1
7bd529d1fe5d862039fe32ddaf40fcd702ab5965

SHA256
d62f124caf785e82a7b4e3550ebb117ba7f467f21b57faab1171253d7bd94be0

SHA512
2d8946eababf135aadb501f05039c0b506df0e622cdae723b7830e8073a9b82a9724f22873fe0b707aa33b3407437647a29b89a05fb76f1ec39a5a53c92244c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Filesize
482B

MD5
97fb425d11e210ad777ff2909eca69ef

SHA1
8de11e2c63d74e9fbad2660c981813bc03356633

SHA256
00110144ebbba159c6bd32e88221e262ceeff8dd93745b03536374f13fd1c9c4

SHA512
ef14b4efaf5e263f49d09a5e9938b0dc6d7306e2b7f7fccf0c5f6a7850ec047b6314c3924dbb710a37013667b044334cebfc305cb53d26768b2d733c596e01c2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\prbn7a8y.default-release\activity-stream.discovery_stream.json.tmp
Filesize
23KB

MD5
329eeea8d59fcfa74eb7aff1869569ea

SHA1
24dcfb1f89fea8fa1f5489af3beb75153c6f216a

SHA256
1863dedbefdfc2bb2f61d18edc25403d1f97aaa8045d255ef29ab0d8fe4ecc73

SHA512
6c11d48fdbea52c3efc3a8fa04f2e7725909efd12c13c1d4b6e84e8c76c8076270e5839dc5c144e5f4227eb1bef1fc227c11f325ee3212c2692c0a96c0f74f1f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\prbn7a8y.default-release\cache2\doomed\11044
Filesize
20KB

MD5
1e8b2879ba7e3f5225491201fcfdbd7f

SHA1
ebd80bafddbfdf960a77e0a483af07648efe934f

SHA256
0eec004094968f465f2a269828e8496d12d170a1153c51950eb9605e7cdd0df0

SHA512
13cc84e7b449a230c1f481427ad46f58c32ab00daf1fab2bb072aaa7654d81105a517bbb83f73e96ac3ad01a790bd785311baf8a68362ff8c3bde0aff7490782

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\prbn7a8y.default-release\cache2\entries\186EC640AECE54B44244A4F358D6F84ED427BA9D
Filesize
210KB

MD5
1fb426cfff468916bb4cfcb8ac6c84a6

SHA1
4ad000322e997c99408778bae512a209d903fdd5

SHA256
6b3a3c29a48dd9e23fb02510c92f2ee1f205402d20ac6d243286c85fd6f725ec

SHA512
a36c2db82d41707799402d7d49256488b13a588e365e8c8612a7d4c6ae154c8b83b71eab542d2335862c0703121f4023b4f83eaed74e3443abd442c17dd87205

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\prbn7a8y.default-release\cache2\entries\1F4EE80161108BE95F29EBD42E65216A6DE85E3D
Filesize
96KB

MD5
06681e4b03228fc1687f9931f5ce1c70

SHA1
26067f93cd66a631c5668c6ea34dd776dc191f36

SHA256
2b383b5d6b549029a7e7b2a0a39dcf3ba43b731353b625a89cd532c0e3ef7004

SHA512
b14ede14cef2d10898368565ce33f249324096e1c2c9e28120ea76daa39da3cbb76b646a1e29a592db9435d19e06a2de7a6779b52c59693aa1cd756f37daa313

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\prbn7a8y.default-release\cache2\entries\3E60B1F6F25CFE891C65390EF158CF1420907CD8
Filesize
60KB

MD5
5272400f92431b91bfcf6dd8540e5727

SHA1
98e2454e0dbd658ad3969210379f19a9561a7b4d

SHA256
dbf6831cf227e773ae5a6391906f09370f2ccf3ff48290c6bf7a720baeb2f3e8

SHA512
739b1cdb63e5edacceee2c7b74213de57bf0181c02a0d442805032622fb8d32fa8ccdcfb169fee4409bdb5e1cc46c0e3f8df5b0335ad320f95c3fca8edc3158f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\prbn7a8y.default-release\cache2\entries\46C625DB4964C00323A8EF4C60828B52A454EBB4
Filesize
1.1MB

MD5
b68fe94a5b8edf71ceed41ba6cd3ab11

SHA1
2bb05a30fa6ef286883b6b205974961e3a396a38

SHA256
4aedfd31540e4eddf108e4fc7df7aa3041798f95cd75bb9d65d425bca6f372fc

SHA512
ef2a39df2a84e45fd678c50c08a0e4b8fa096ef3c2586a0ea264b106afe6d0b2b1f7146305ac38e1fe65208570a016e57308f1c1581c2620195f0e34bd1563c0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\prbn7a8y.default-release\cache2\entries\5AE6D89F9E02E65CE57A707F37A56F985F9BE4BA
Filesize
68KB

MD5
53aadf57a02f1bc8512fd3386cb440c2

SHA1
684ab8205494222f7c3d024b612d1b871287b61d

SHA256
6a034db77c88d9578cb006fb754ed85602fef3fb8e62cfb5a5d932cbe13f805b

SHA512
dba0c8315915ee4f01a93c427e96d0c5d4b44f1cdb361918e3e15645d8787207cdd98668a4b4d977d4901d248fe584fa851d4e7f488a8bcad97fbfd5d852842f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\prbn7a8y.default-release\cache2\entries\80BB96996C8133B0FE5E0D6E5EA21B26135E8EA2
Filesize
110KB

MD5
3d689dd30a41d290eb70363a28733403

SHA1
489ca02e267a8c3cde76838d3730c0c34e428e7d

SHA256
aa2798c3859d01f18a97b31b350faffc70491d5f19c9f23e0c8b3f8f6e3d927d

SHA512
d3e4194dbdf78eca54aed38c1000eda22a8cf93f59b1ade14f7d5c9df8cbc67f55d0609df42986d4f6f0b0c6460ad3b3a0b6661530582d5d904b460064cd9e97

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\prbn7a8y.default-release\cache2\entries\971254C7341460E85C93D0821B91E9985A0B32D6
Filesize
2.0MB

MD5
517d817484cc03e96931435e9920ca6b

SHA1
542c3289e6d0c65407b8c885c0b39cd03f213785

SHA256
f5dc3bd579b41d820fa13afdbc930775612d8d56cb5e10634f2efb27c720e491

SHA512
c1e55eaf96d0dbf555ac92f55e93a15c3fa19e40628193b8eba3807d930a17dbc4f56118f9dc4ee49facca4335e67256de52ac63d7854ac18a42533cddfc1609

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\prbn7a8y.default-release\cache2\entries\A18B323E560F819736EDD0F625CF420E81E8431E
Filesize
47KB

MD5
e63318c6ce4cc633cd2142bf0eae7cb8

SHA1
85850c379384d597fcf2c52a79f50034a3d65dcb

SHA256
3001de42a6ca24fe5390a86639e73805af0a380059b179924e7b335a94348132

SHA512
b78ce275c163b1bbce12e36b1176d5ec302bd4baea327f5badbe2abdd5234b82c543dc649b33b70834acae30c54eb3411908c05a6d483c33a3cb807bff3ee037

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\prbn7a8y.default-release\thumbnails\447c1d819532470f427483b5c2ad32a6.png
Filesize
70KB

MD5
e83fe4d8787682f133869c1ac73592dd

SHA1
3abd202280c6f86cccc357c8ef2623baf368ed1d

SHA256
798a45b75a5e8f2bc26c239693bfbb926117a57b77d85e95f06e36fac0fbdfcb

SHA512
4a6a7ceaa6ac4c2bd6d45ca324ce0b612a9199ff182d3a7dca1c623cfae90410f30e11c23a63d87b344533838144183213f38c1df92b027d7ae8d6fbc6094bdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\a.bin
Filesize
40KB

MD5
af753d00642bbdb68d96020f515d21ed

SHA1
088a992eb46190f9d7a5742ca0bf442f5975ee29

SHA256
788074170b2f5ad79f00adf8254fc564ae3d7ab4217aa10ade4264462ad3519d

SHA512
575fbd1ac2ed1fda9c73310422958317fc3c4f71ca675c873624ebca490b948b5a083bd796fad04fa83eac0fef589865c66b806b5b7cbbc7d37e0f9af8209d9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb585A.tmp
Filesize
1KB

MD5
251e9ec6834f5c7a36a732f25a54fc75

SHA1
5a141dc35d5bfb97fe5a663e8868c83696173a88

SHA256
f5aadbb31fd7e0cbbee98fa82135f569b966d4839bea6d148ff63b207174902f

SHA512
73d0376aa9337e8c07b6840f76e5eca8967c14626627c3065ce0b77ab7319544c355c86caf81447e3cef8891cf4254c38b4c051eacb80791883735203ee094d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb589A.tmp
Filesize
1KB

MD5
5f9c731c58960a4dd5183702813d4574

SHA1
580f37fbf290ce66ba0065d41f4d7c5bb0378549

SHA256
d2f19945688a269f08efdd93dd61a9558415d145f04bb75d013446dff0e54d6e

SHA512
cf2adb523ad2c28be1dd1809602fda6a54c89e4633cf3c964069613b20a458c91e0599170f425c73f4711f35b0956d4ab142eafa501ada17c8e7b0a02f1c3d50

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb6293.tmp
Filesize
1KB

MD5
a23eb4d609a432cfee41221b2588794c

SHA1
5a2f467b8a42ddc6ecca0e3829f5bc64c20d0f85

SHA256
d1f77741dd17220196fce44bff80f5264525bea3c9f9ea07a4ea14ab328a1cc2

SHA512
27e69f6631d8bc651a7465a6e02e6f276d13b2bdb943760705725a0893e4c616f17b150ba993be0805359cadaf67b55397a8bc56295464035c833f56e420c9c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb62C7.tmp
Filesize
1KB

MD5
4e38c7b774dc14991614a36cb923536f

SHA1
3edc69841c239f6bc12ea40546558f293e021447

SHA256
a39c8b9629fd354b0d15e8ea8811cfbe289e7090e0b10528c9117a1d2a859bb9

SHA512
de2872f36eaa955feb42fcaeb260aa02d6ca6e1a16e6e341483c5a7899fd77c8ac56fe748800fecf7dbce933e219d3409eef04144de4509be4ad72655cfd24af

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb6587.tmp
Filesize
1KB

MD5
26fc5802d3da1539a5b4a4e9d1c0be94

SHA1
4451ad10ddd3a9910f3706e957ce32ae142fbf58

SHA256
d1781882a8f4ed09d0f0237271a72522b7679aca3112755c75f9b60e5db18840

SHA512
5dd81590049e6574e3e1325b637a4f2fb62bfc77635f8ad86b6125ff2a91f04a88182cc896e855b3054ed281545c6985e0db05c36ed55f0819ed5260ab27b44c

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb6942.tmp
Filesize
1KB

MD5
a8d20389688eb5bb2217374daac56135

SHA1
84206edd4f55aeede510e916137c9f3c49a11ff5

SHA256
5a1e88a2bcb9de8eab56724555cad7edf1c35f5a82782e7cd9d953b1e4206172

SHA512
a1b5db7e0ddd8f354e1f4d1eb58f5b73af8e1028b7aa3dcf2802dd4359c3e0331a2a095d1e5bda1249c2869ad302175101401483b0fa2ff41246d6ed26ca8978

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb6973.tmp
Filesize
1KB

MD5
f0425b8ed398010d2c94792f8f898715

SHA1
430effc2cea89e3f888c62d1df06fe9fa5d858cd

SHA256
4c56ed6a4fc6c769f4e9df43bbc3fec94170f6451f55b946cf7449ec217ae495

SHA512
f0489d7e62b9c779daa546f3d18266a3aef0d37ef752dfa082b9294b5fe98e6154b666a7e488e4c8c5576e8c800f0ea06c3b90e038628301e840dcee3c0ac26f

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb69D3.tmp
Filesize
1KB

MD5
fe682cb37293e5b74db6c033ed169a4a

SHA1
6944ffda86656a542881eb6133cec42c6f376216

SHA256
326a7920c0f6c80013bbf22b61b3767b3478a6d00f9fa587d9b816e0d20c74c3

SHA512
23c780847eb9225526193d23152bb1bc1e3a94475076546c57f4731adef45b28e053ec6cfe14d151ea7e264467d9d029191766a4c35482f19a3d776d530eadc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb6A42.tmp
Filesize
1KB

MD5
e67e1b46e10f426c16970df0e8efae58

SHA1
5c1aa2c31fc1b178851707baa2bf3dd457c347ba

SHA256
667e13563ae447a53e7ab9b03e76e190cc91a4578fc3cbd912c5533c9f770b6a

SHA512
f36d5bbd29469003ec109132c6a113ff7064195bc27399a2d0f873933011b7595f8fdb00c4eb83feacaa391d7115d5f2d8da8544ebc8bcdbdc5f2a219d6ef86b

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb7214.tmp
Filesize
1KB

MD5
132b75f62813ba25fe493185a108d10a

SHA1
1f4eef1b5e2047afeba3ff6bf7dcfedaa8ad004b

SHA256
7be8262e0bd4f1fb6b10c622322820307304f391a31191b892224c0ac2c27903

SHA512
48d3c8232b99fd086424564d7b946d46255e57e085dc13afa069fc182fc75022a82d022207fd0a9830ebaf2966e856f99613abde801981c37c50ed309b90619d

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb7226.tmp
Filesize
1KB

MD5
e5cb65f3af8aa02347029d440230bcc0

SHA1
bf2e43b6c9909fcfbe8cba529f7c15697d0596b5

SHA256
74c23a45997ab20761d96faef2b79520b1091399214666f624545efd99798cfb

SHA512
a234402b64962c58a3a9e6660f0b67cd4b0437517507b239bf11493cdf8348921264c3ca79307a510dfad4ac50563ffd6d4a927536afcf54a0a194b80dbc92dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\im.exe
Filesize
457KB

MD5
13af4fab3355023d0f14b1f72b6934b3

SHA1
1095ce66f3c73683f5aa81cda438cb01f9aaa1f7

SHA256
1fb0a49932cfcd8def83be1746eaea84fe5351fc016d00a0e7c7208c243a14d8

SHA512
4c232cd15b417f34f088163b0bcef8ad4c3f99b51a295308dd8becca330a096f29d70a1fec0a37ef0dccea0d21a303651cc401eaffb18f7e192408aeadd53fb0

Download Submit
C:\Users\Admin\AppData\Local\osu!\Logs\update.log
Filesize
370B

MD5
816a53efc790f1803c18cdf171eec4d8

SHA1
0dd75eb0f6bb91b543450a48a17c21c6ad34edfe

SHA256
7b92cec4d22289b8ee37064eecdfafcd7345d84e3b2a01dd56b6bd7ad77fde9a

SHA512
2a3e2a4b9a5fe6f65ab931eb6cbc89a4ea71ee5e9c00a1467f2ce655956e6dc3d16df33322a56adf1c84652be954bdee03e46dbd1bee9f277db00a3038e668d8

Download Submit
C:\Users\Admin\AppData\Local\osu!\Logs\update.log
Filesize
2KB

MD5
93ef91a6a7e07e30a8c67e6f862cec5d

SHA1
3146ad1d454ce555f20166d39b42ca55b93c89a1

SHA256
b9fddf013fde76d42b1f1d3ec227dbbbc06dea8062d3fc981f9eb8c6006709a0

SHA512
8d954350e9448dad73a4bccf944e8cbbaff4bb9d09f1ffadc26ae66be5878ec1e62614a1334b1f8a830ca1948e2354b1a432699fe0a612d11e3afd024a1932fc

Download Submit
C:\Users\Admin\AppData\Local\osu!\Logs\update.log
Filesize
3KB

MD5
81b458ea24811c0d73eb0f555302bba2

SHA1
d1d4e2710eb0c29dc4bc872e44604d35bdc5b467

SHA256
adbc14dcde22f4ff93b22c3e6459602aa642e320680516ea326a0e339e8baa8f

SHA512
7d675c2deb49eefa10e77e4c3f28206a9c17d11f4425c83f7cfd15e7fb980b9d1698086045e8bde97cf6a151e56b7fd455976f3d10782ad6d4e92b4793184778

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\prbn7a8y.default-release\prefs-1.js
Filesize
6KB

MD5
761b0772f28dcd32844012233ed7cefd

SHA1
0397ac87fe7d4aeb91cfc2b8f54b2cc558e50f55

SHA256
1d0583bc49223e15769f853ab1108bdbed3cc30439191087858c340c7efb5dfc

SHA512
97d854fe3f9ef3c843a440b86634f75031d30e40da999a6ddb882051495e7a510b234382b42c997e042e2b8c7d50c74a7cc2b246872b898f7e80f18d5bb3d6ac

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\prbn7a8y.default-release\prefs-1.js
Filesize
7KB

MD5
bca1e66afda3a1fb8bb05aebd7d279f9

SHA1
ff7cebf3e61f670bf130a5919dd2a549c07fb89a

SHA256
214fc8424b2dd828540ff72044e6cd3418e167c721ed37c5fa7ffe7f8b36f3c5

SHA512
53e1a173fe5b88ac4b194376940850cbc4bef3ecfec352cdba304078bdd3a781d765ea5a9259cc2f595f008a36367710a2e78238ec85bce1beba21b8d4188bc0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\prbn7a8y.default-release\prefs-1.js
Filesize
7KB

MD5
1d20e3e0018b9c5e28541bd72c542ef4

SHA1
2bd4f5731db044006f7b5f9a0161523e903952c2

SHA256
2c16b9404bbf3e55950dfb6460f3aa8dc56df5710db61d7e58793e3a291b3690

SHA512
8e550528246608e8869b0514cee7ff0b7f7e6ddb0c791c9e634db09476bb01f5142afd25d591a7c9c4b7ada4b3339631313aaec31d405b08e538dfb061ea103a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\prbn7a8y.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
4KB

MD5
cf295ecd8e2055ebcc0c6057ee135ce8

SHA1
0d214ba0e8cae853fdabd75ea25256ad1df4b402

SHA256
80f3c4a3ed93bb69516f02b661507c7c53f89a9fbbbb3e20a4fd6be6b7d083f2

SHA512
c24c7f301a776e4aa2df3801be5579ecf62d1d38734faea6fb260357f12cbd1e841c4cd3dc933643b6fa9efe7bdd6366124652bfd75c17d595d07f8eb297b4ec

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\prbn7a8y.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
7KB

MD5
793fb9913b3142d8e23235ced593907a

SHA1
23e0042ef1bcec7c3d215cd133faa97ec6c24b6d

SHA256
e4683249c6bebbde50f82e7a081584bf3a60cb3d3bf0eebddc91b3b728938109

SHA512
2d500b0c1f791b7546cabe19537bf55c43b42e2d210069c803b1c6e0c711da7ff7792d6518e9c1e72d7c7f120a8f128305e9cd89c0931a98eb2445fcf5260787

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\prbn7a8y.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
3KB

MD5
266deba2874834fa246b1fc74b8b7131

SHA1
a8cb93847443dfd891f0a4a31a2fe19fd6d115f3

SHA256
a0bff770f432c0cfa794e365e21db0e90280f78e8ad56b066eb8ff602c03ceb2

SHA512
9959fe920f45652f0b2ebaf2f1f5f147eaa7f61262dc13cc7f5977f71706062f97a44d9f22b01380608a049100536967d68fcf10f87444936fe3047d41ad1eba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\prbn7a8y.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
7KB

MD5
dbcd63e8bc46e008a92869f2560086a0

SHA1
4fc6006e27823e873ec42e1581829fa9d521790b

SHA256
f067533d1d16c2648fb0bb21fa53435f3e69688939762ff0c208b957ee9cb6d6

SHA512
ca9550951c0cc7f2390e7dbe1f3652a9bde67f0ced6cf8436e908df1aebebe3d530c3e9158e2ef2ee9850acddcf6fdb8147309eba5e7e9ae3fe78d808ddd896e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\prbn7a8y.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
3KB

MD5
00be482c15c7afcb4f9c8b89a3020aed

SHA1
3fc753d54675cc85ade0bf562de8216a9d042f85

SHA256
d09e3ea2134d31753b568ba78f02a29e23c2ae12a92122bbbb4f0008b9143d8e

SHA512
526ce93255249371a5c01f131b96aee4e5644f2e5f70888d9419ffe49aeb875035027e0275f87eaadb97a6eb0c7b31a238b4adbbfb3bdbbf4a0f3063f694aa6b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\prbn7a8y.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
7KB

MD5
a8fd4a4e0d248d5dce35a4b1327b9ebd

SHA1
9e056e5d8f81347f1e642137858eda5328ce0b63

SHA256
c17aebedfa6c9d2e2b7bf559d2b4a8162f6cf7350955095529917df59b3e5011

SHA512
4975f3dda43f813956a2efaa507fd40f7e3a5b36bebf908257c0b2ba48fc6ed028bc401f18a849b68b9685118e81a1ca02d4d6fd69afaf9d0b2f55b14e148579

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\prbn7a8y.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
7KB

MD5
b27578fdc2205e216510d33d7d1b89ad

SHA1
6c958cfac8b2e11bab95a21f74576d009cf087e3

SHA256
9baddd18765261d94ffbff7c5dc3e84ca1a822580608e6e615e0347da7b4dd26

SHA512
9d4a4c859d0affbef379b4b9f63b540bca71380043f8fc6be7228fc5587e771ef266a485a6054ddd1dff8bc4ebcf61f287986ca9cd362c6850466b95ad340b25

Download Submit
C:\Users\Admin\Downloads\osu!install.MRf_wOcz.exe.part
Filesize
63KB

MD5
7db21c5233bce99f9bb4e70c6f05bd7a

SHA1
70d2785895441280a7f4193bbf112eef274bad25

SHA256
c94f98d5ccd21dc8d864e1b89a7d4763a1e9bc930e73ceadae61e42a08b6e6d9

SHA512
7021f05607ee80719228f0acf547a842978496ff0ae568f2f3297e82412a2517fd1845bde12ecf475c3639895e5e9fa0e5cd5786b4868d1ebdcc314cb3f8b7b4

Download Submit
C:\Users\Admin\Downloads\osu!install.exe
Filesize
4.3MB

MD5
4cb6bf06b9475ca78e7920bb08f72279

SHA1
fec977049df3a47082f8c88c825d433f3b769c95

SHA256
c1f75dcd74cc6dbee961905532fa4132cfa3c4316d57c9c582a512c8e908ffd6

SHA512
f1a736b16e3bf6381811758605e01ad17e0ff3d4f6c7caf4925b2d6caee8634226551f5330dfe9dc73b71092b1a88b27ff9fe084da7b092797f4532090e2c06a

Download Submit
C:\Users\Admin\Downloads\osu!install.exe:Zone.Identifier
Filesize
104B

MD5
fcd2f00a73b3871def085b9b92f5f6e9

SHA1
1c246b61f507c306d9cac22ae2d76171183bd37a

SHA256
8122bfd79ff36783cf35903c2662af26f004473d706c33a86e54b3dfed1585f2

SHA512
d2e1ac9898f3f97539eb73210aebf6f101e64c031b0ca9f919c7d50765148b053e009492171e3f6101a300ff7f776b85d633cb836fc8ce20f3bac740264b65c2

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini
Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
memory/1944-1429-0x0000000006B80000-0x0000000006BBC000-memory.dmp

Filesize
240KB

Download
memory/1944-1422-0x0000000000F70000-0x00000000013BC000-memory.dmp

Filesize
4.3MB

Download
memory/3288-1652-0x0000000004E00000-0x0000000004EBC000-memory.dmp

Filesize
752KB

Download
memory/3288-1650-0x0000000002500000-0x0000000002550000-memory.dmp

Filesize
320KB

Download
memory/3288-1651-0x0000000004C30000-0x0000000004CEC000-memory.dmp

Filesize
752KB

Download
memory/3288-1649-0x0000000000200000-0x0000000000278000-memory.dmp

Filesize
480KB

Download
memory/3388-89-0x000000001EB30000-0x000000001EBCC000-memory.dmp

Filesize
624KB

Download
memory/3388-1560-0x000000001D280000-0x000000001D3F6000-memory.dmp

Filesize
1.5MB

Download
memory/3388-245-0x000000001EA50000-0x000000001EBC6000-memory.dmp

Filesize
1.5MB

Download
memory/3388-262-0x00000000198B0000-0x00000000198BE000-memory.dmp

Filesize
56KB

Download
memory/3388-252-0x00000000003F0000-0x0000000002254000-memory.dmp

Filesize
30.4MB

Download
memory/3388-195-0x000000001E330000-0x000000001E34E000-memory.dmp

Filesize
120KB

Download
memory/3388-278-0x00000000003F0000-0x0000000002254000-memory.dmp

Filesize
30.4MB

Download
memory/3388-132-0x000000001E280000-0x000000001E28A000-memory.dmp

Filesize
40KB

Download
memory/3388-95-0x00000000003F0000-0x0000000002254000-memory.dmp

Filesize
30.4MB

Download
memory/3388-112-0x00000000198B0000-0x00000000198BE000-memory.dmp

Filesize
56KB

Download
memory/3388-116-0x0000000019960000-0x0000000019A0B000-memory.dmp

Filesize
684KB

Download
memory/3388-126-0x00000000195E0000-0x0000000019606000-memory.dmp

Filesize
152KB

Download
memory/3388-127-0x0000000019AE0000-0x0000000019B8B000-memory.dmp

Filesize
684KB

Download
memory/3388-124-0x0000000019AE0000-0x0000000019B8B000-memory.dmp

Filesize
684KB

Download
memory/3388-93-0x00000000198B0000-0x00000000198BE000-memory.dmp

Filesize
56KB

Download
memory/3388-88-0x000000001EA60000-0x000000001EA92000-memory.dmp

Filesize
200KB

Download
memory/3388-0-0x00000000003F0000-0x0000000002254000-memory.dmp

Filesize
30.4MB

Download
memory/3388-87-0x000000001EBF0000-0x000000001ED66000-memory.dmp

Filesize
1.5MB

Download
memory/3388-85-0x0000000012230000-0x00000000122B0000-memory.dmp

Filesize
512KB

Download
memory/3388-80-0x000000001EA50000-0x000000001EBC6000-memory.dmp

Filesize
1.5MB

Download
memory/3388-81-0x000000001EA50000-0x000000001EBC6000-memory.dmp

Filesize
1.5MB

Download
memory/3388-76-0x000000001E490000-0x000000001E49A000-memory.dmp

Filesize
40KB

Download
memory/3388-75-0x0000000012170000-0x000000001219A000-memory.dmp

Filesize
168KB

Download
memory/3388-69-0x000000001E3E0000-0x000000001E49C000-memory.dmp

Filesize
752KB

Download
memory/3388-70-0x000000001E3E0000-0x000000001E49C000-memory.dmp

Filesize
752KB

Download
memory/3388-65-0x00000000FF9D0000-0x00000000FFDA1000-memory.dmp

Filesize
3.8MB

Download
memory/3388-60-0x000000001E330000-0x000000001E34E000-memory.dmp

Filesize
120KB

Download
memory/3388-56-0x000000001E2B0000-0x000000001E2BA000-memory.dmp

Filesize
40KB

Download
memory/3388-49-0x00000000195C0000-0x00000000195C8000-memory.dmp

Filesize
32KB

Download
memory/3388-48-0x000000001D760000-0x000000001E216000-memory.dmp

Filesize
10.7MB

Download
memory/3388-43-0x00000000195E0000-0x0000000019606000-memory.dmp

Filesize
152KB

Download
memory/3388-39-0x0000000012350000-0x00000000126A7000-memory.dmp

Filesize
3.3MB

Download
memory/3388-38-0x0000000012350000-0x00000000123D0000-memory.dmp

Filesize
512KB

Download
memory/3388-37-0x00000000003F0000-0x0000000002254000-memory.dmp

Filesize
30.4MB

Download
memory/3388-36-0x0000000012250000-0x0000000012270000-memory.dmp

Filesize
128KB

Download
memory/3388-35-0x0000000012270000-0x0000000012292000-memory.dmp

Filesize
136KB

Download
memory/3388-1480-0x0000000016CA0000-0x0000000016CBC000-memory.dmp

Filesize
112KB

Download
memory/3388-1490-0x0000000016D80000-0x0000000016EBE000-memory.dmp

Filesize
1.2MB

Download
memory/3388-1489-0x0000000018990000-0x0000000018ACE000-memory.dmp

Filesize
1.2MB

Download
memory/3388-26-0x0000000012230000-0x00000000122B0000-memory.dmp

Filesize
512KB

Download
memory/3388-1479-0x0000000016CE0000-0x0000000016CFC000-memory.dmp

Filesize
112KB

Download
memory/3388-1491-0x0000000018C90000-0x0000000018D9A000-memory.dmp

Filesize
1.0MB

Download
memory/3388-19-0x0000000012170000-0x000000001219A000-memory.dmp

Filesize
168KB

Download
memory/3388-1791-0x000000001D2E0000-0x000000001D360000-memory.dmp

Filesize
512KB

Download
memory/3388-25-0x00000000122D0000-0x0000000012350000-memory.dmp

Filesize
512KB

Download
memory/3388-1561-0x000000001D280000-0x000000001D3F6000-memory.dmp

Filesize
1.5MB

Download
memory/3388-11-0x0000000012170000-0x000000001219A000-memory.dmp

Filesize
168KB

Download
memory/3388-1564-0x000000001D280000-0x000000001D29C000-memory.dmp

Filesize
112KB

Download
memory/3388-7-0x0000000010730000-0x0000000010796000-memory.dmp

Filesize
408KB

Download
memory/3388-1563-0x000000001D280000-0x000000001D2A6000-memory.dmp

Filesize
152KB

Download
memory/3388-1562-0x000000001D270000-0x000000001D3E6000-memory.dmp

Filesize
1.5MB

Download
memory/3388-213-0x00000000003F0000-0x0000000002254000-memory.dmp

Filesize
30.4MB

Download
memory/3388-1559-0x000000001D280000-0x000000001D2A6000-memory.dmp

Filesize
152KB

Download
memory/3388-1558-0x000000001D270000-0x000000001D2F0000-memory.dmp

Filesize
512KB

Download
memory/3388-1557-0x000000001D280000-0x000000001D2AA000-memory.dmp

Filesize
168KB

Download
memory/3388-6-0x0000000015930000-0x00000000159C2000-memory.dmp

Filesize
584KB

Download
memory/3388-5-0x0000000015EE0000-0x0000000016486000-memory.dmp

Filesize
5.6MB

Download
memory/3388-4-0x0000000012A70000-0x0000000013442000-memory.dmp

Filesize
9.8MB

Download
memory/3388-3-0x00000000003F0000-0x0000000002254000-memory.dmp

Filesize
30.4MB

Download
memory/3388-2-0x00000000003F0000-0x0000000002254000-memory.dmp

Filesize
30.4MB

Download
memory/3388-1-0x00000000FF9D0000-0x00000000FFDA1000-memory.dmp

Filesize
3.8MB

Download
memory/3388-1792-0x000000001D250000-0x000000001D276000-memory.dmp

Filesize
152KB

Download
memory/3388-1669-0x000000001D250000-0x000000001D27A000-memory.dmp

Filesize
168KB

Download
memory/3388-1670-0x000000001D2E0000-0x000000001D360000-memory.dmp

Filesize
512KB

Download
memory/3388-1704-0x000000001D280000-0x000000001D2AA000-memory.dmp

Filesize
168KB

Download
memory/3388-1767-0x000000001D2E0000-0x000000001D41E000-memory.dmp

Filesize
1.2MB

Download
memory/3388-1778-0x000000001D250000-0x000000001D276000-memory.dmp

Filesize
152KB

Download
memory/3388-1777-0x000000001D2E0000-0x000000001D360000-memory.dmp

Filesize
512KB

Download
memory/3388-1776-0x000000001D2E0000-0x000000001D41E000-memory.dmp

Filesize
1.2MB

Download
memory/3388-1774-0x000000001D2E0000-0x000000001D41E000-memory.dmp

Filesize
1.2MB

Download
memory/3388-1773-0x000000001D2E0000-0x000000001D360000-memory.dmp

Filesize
512KB

Download
memory/3388-1771-0x000000001D250000-0x000000001D27A000-memory.dmp

Filesize
168KB

Download
memory/3388-1765-0x000000001D2E0000-0x000000001D30A000-memory.dmp

Filesize
168KB

Download
memory/3388-1761-0x000000001D2E0000-0x000000001D41E000-memory.dmp

Filesize
1.2MB

Download
memory/3388-1759-0x000000001D250000-0x000000001D26C000-memory.dmp

Filesize
112KB

Download
memory/3388-1758-0x000000001D250000-0x000000001D26C000-memory.dmp

Filesize
112KB

Download
memory/3388-1757-0x0000000019790000-0x000000001979E000-memory.dmp

Filesize
56KB

Download
memory/3388-1756-0x0000000019790000-0x000000001979E000-memory.dmp

Filesize
56KB

Download
memory/3388-1740-0x000000001D2E0000-0x000000001D456000-memory.dmp

Filesize
1.5MB

Download
memory/3388-1737-0x000000001D2E0000-0x000000001D456000-memory.dmp

Filesize
1.5MB

Download
memory/3388-1793-0x000000001D250000-0x000000001D26E000-memory.dmp

Filesize
120KB

Download
memory/3388-1732-0x000000001D280000-0x000000001D29C000-memory.dmp

Filesize
112KB

Download
memory/3388-1727-0x000000001D280000-0x000000001D2A6000-memory.dmp

Filesize
152KB

Download
memory/3388-1726-0x000000001D2E0000-0x000000001D39C000-memory.dmp

Filesize
752KB

Download
memory/3388-1725-0x000000001D270000-0x000000001D3E6000-memory.dmp

Filesize
1.5MB

Download
memory/3388-1717-0x000000001D280000-0x000000001D3F6000-memory.dmp

Filesize
1.5MB

Download
memory/3388-1715-0x000000001D280000-0x000000001D3F6000-memory.dmp

Filesize
1.5MB

Download
memory/3388-1710-0x000000001D280000-0x000000001D2A6000-memory.dmp

Filesize
152KB

Download
memory/3388-1709-0x000000001D270000-0x000000001D2F0000-memory.dmp

Filesize
512KB

Download
memory/3388-1708-0x000000001D250000-0x000000001D26E000-memory.dmp

Filesize
120KB

Download
memory/3388-1702-0x0000000019790000-0x000000001979A000-memory.dmp

Filesize
40KB

Download
memory/3388-1697-0x0000000019790000-0x000000001979A000-memory.dmp

Filesize
40KB

Download
memory/3388-1696-0x000000001D250000-0x000000001D26E000-memory.dmp

Filesize
120KB

Download
memory/3388-1695-0x0000000016D80000-0x0000000016EBE000-memory.dmp

Filesize
1.2MB

Download
memory/3388-1685-0x000000001D250000-0x000000001D276000-memory.dmp

Filesize
152KB

Download
memory/3388-1684-0x0000000016CA0000-0x0000000016CBC000-memory.dmp

Filesize
112KB

Download
memory/3388-1683-0x000000001D250000-0x000000001D276000-memory.dmp

Filesize
152KB

Download
memory/3388-1788-0x000000001D2E0000-0x000000001D30A000-memory.dmp

Filesize
168KB

Download
memory/4384-1738-0x000000006CB70000-0x000000006CB90000-memory.dmp

Filesize
128KB

Download
memory/4384-1656-0x000000006CB70000-0x000000006CB90000-memory.dmp

Filesize
128KB

Download
memory/4384-1500-0x0000000009130000-0x000000000965C000-memory.dmp

Filesize
5.2MB

Download