c936b618db392d1642346d13eec57373826fc43426f48513f896a23326563bfb

Analysis

max time kernel
244s
max time network
260s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 06:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AudioThing.The.Orb.v1.0.1.Incl.Patched.and.Keygen-R2R.rar
Size

5.7MB
MD5

771efced7f4bc95a85ea48c3ac3a6293
SHA1

81901e62cac03bc678358296a51697d85f05be5b
SHA256

c936b618db392d1642346d13eec57373826fc43426f48513f896a23326563bfb
SHA512

878e38aa553796ef1eed4a869f3f19a4bfcd05ab57bd4834f5d12ab31fb1d7f75b7a34fe72811dec9638ac69a2feb6162e792287881d40067449f7dcdd547b47
SSDEEP

98304:2ts70pAKnj+qM+qpGO1ThvhGHLURt0L5910EI8LKooM4NmEJBs8CpbHo:bG+frGO1ThvsHLURtuWNhM4DI0

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00070000000234bd-545.dat	acprotect

Executes dropped EXE 4 IoCs

pid	Process
1472	Setup The Orb v1.0.1.exe
3004	Setup The Orb v1.0.1.tmp
3356	AudioThing_KeyGen.exe
4884	keygen.exe

Loads dropped DLL 7 IoCs

pid	Process
3004	Setup The Orb v1.0.1.tmp
3004	Setup The Orb v1.0.1.tmp
3004	Setup The Orb v1.0.1.tmp
3004	Setup The Orb v1.0.1.tmp
3004	Setup The Orb v1.0.1.tmp
4884	keygen.exe
4884	keygen.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000234c0-540.dat	upx
behavioral1/memory/4884-541-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/files/0x00070000000234bd-545.dat	upx
behavioral1/memory/4884-548-0x0000000074940000-0x0000000074986000-memory.dmp	upx
behavioral1/memory/4884-553-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/memory/4884-558-0x0000000074940000-0x0000000074986000-memory.dmp	upx
behavioral1/memory/4884-625-0x0000000000400000-0x000000000043C000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Steinberg\VSTPlugins\AudioThing\is-PRK89.tmp	Setup The Orb v1.0.1.tmp
File opened for modification	C:\Program Files\AudioThing\The Orb\unins000.dat	Setup The Orb v1.0.1.tmp
File opened for modification	C:\Program Files\Steinberg\VSTPlugins\AudioThing\TheOrb_x64.dll	Setup The Orb v1.0.1.tmp
File created	C:\Program Files\AudioThing\The Orb\unins000.dat	Setup The Orb v1.0.1.tmp
File created	C:\Program Files\AudioThing\The Orb\is-JBAMJ.tmp	Setup The Orb v1.0.1.tmp
File created	C:\Program Files\AudioThing\The Orb\is-V3SLR.tmp	Setup The Orb v1.0.1.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x000b000000023414-533.dat	nsis_installer_1
behavioral1/files/0x000b000000023414-533.dat	nsis_installer_2

Checks processor information in registry 2 TTPs 16 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies registry class 57 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "6"	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	keygen.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	keygen.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = ffffffff	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	keygen.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3004	Setup The Orb v1.0.1.tmp
3004	Setup The Orb v1.0.1.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3560	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	4432	firefox.exe
Token: SeDebugPrivilege	4432	firefox.exe
Token: SeDebugPrivilege	4432	firefox.exe
Token: SeRestorePrivilege	2540	7zG.exe
Token: 35	2540	7zG.exe
Token: SeSecurityPrivilege	2540	7zG.exe
Token: SeSecurityPrivilege	2540	7zG.exe
Token: 33	4604	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4604	AUDIODG.EXE
Token: SeDebugPrivilege	4248	firefox.exe
Token: SeDebugPrivilege	4248	firefox.exe
Token: SeDebugPrivilege	4248	firefox.exe
Token: SeDebugPrivilege	4248	firefox.exe
Token: SeDebugPrivilege	4248	firefox.exe
Token: SeDebugPrivilege	4248	firefox.exe
Token: SeDebugPrivilege	4248	firefox.exe
Token: SeDebugPrivilege	4248	firefox.exe
Token: SeDebugPrivilege	4248	firefox.exe
Token: SeDebugPrivilege	4248	firefox.exe
Token: SeDebugPrivilege	4248	firefox.exe
Token: SeDebugPrivilege	4248	firefox.exe
Token: SeDebugPrivilege	4248	firefox.exe
Token: SeDebugPrivilege	4248	firefox.exe
Token: SeDebugPrivilege	4248	firefox.exe
Token: SeDebugPrivilege	4248	firefox.exe
Token: SeDebugPrivilege	4248	firefox.exe
Token: SeDebugPrivilege	4248	firefox.exe
Token: SeDebugPrivilege	4248	firefox.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
4432	firefox.exe
4432	firefox.exe
4432	firefox.exe
4432	firefox.exe
2540	7zG.exe
3004	Setup The Orb v1.0.1.tmp
4248	firefox.exe
4248	firefox.exe
4248	firefox.exe
4248	firefox.exe
4248	firefox.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
4432	firefox.exe
4432	firefox.exe
4432	firefox.exe
4248	firefox.exe
4248	firefox.exe
4248	firefox.exe
4248	firefox.exe

Suspicious use of SetWindowsHookEx 36 IoCs

pid	Process
3560	OpenWith.exe
3560	OpenWith.exe
3560	OpenWith.exe
3560	OpenWith.exe
3560	OpenWith.exe
3560	OpenWith.exe
3560	OpenWith.exe
3560	OpenWith.exe
3560	OpenWith.exe
3560	OpenWith.exe
3560	OpenWith.exe
3560	OpenWith.exe
3560	OpenWith.exe
3560	OpenWith.exe
3560	OpenWith.exe
3560	OpenWith.exe
3560	OpenWith.exe
3560	OpenWith.exe
3560	OpenWith.exe
3560	OpenWith.exe
3560	OpenWith.exe
3560	OpenWith.exe
3560	OpenWith.exe
4432	firefox.exe
4432	firefox.exe
4432	firefox.exe
4432	firefox.exe
4432	firefox.exe
4432	firefox.exe
4432	firefox.exe
3004	Setup The Orb v1.0.1.tmp
3356	AudioThing_KeyGen.exe
4884	keygen.exe
4884	keygen.exe
4248	firefox.exe
4248	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 2460	3560	OpenWith.exe	89
PID 3560 wrote to memory of 2460	3560	OpenWith.exe	89
PID 2460 wrote to memory of 4432	2460	firefox.exe	91
PID 2460 wrote to memory of 4432	2460	firefox.exe	91
PID 2460 wrote to memory of 4432	2460	firefox.exe	91
PID 2460 wrote to memory of 4432	2460	firefox.exe	91
PID 2460 wrote to memory of 4432	2460	firefox.exe	91
PID 2460 wrote to memory of 4432	2460	firefox.exe	91
PID 2460 wrote to memory of 4432	2460	firefox.exe	91
PID 2460 wrote to memory of 4432	2460	firefox.exe	91
PID 2460 wrote to memory of 4432	2460	firefox.exe	91
PID 2460 wrote to memory of 4432	2460	firefox.exe	91
PID 2460 wrote to memory of 4432	2460	firefox.exe	91
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 336	4432	firefox.exe	92
PID 4432 wrote to memory of 1144	4432	firefox.exe	93
PID 4432 wrote to memory of 1144	4432	firefox.exe	93
PID 4432 wrote to memory of 1144	4432	firefox.exe	93
PID 4432 wrote to memory of 1144	4432	firefox.exe	93
PID 4432 wrote to memory of 1144	4432	firefox.exe	93
PID 4432 wrote to memory of 1144	4432	firefox.exe	93
PID 4432 wrote to memory of 1144	4432	firefox.exe	93
PID 4432 wrote to memory of 1144	4432	firefox.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\AudioThing.The.Orb.v1.0.1.Incl.Patched.and.Keygen-R2R.rar
1⤵
- Modifies registry class
PID:952

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\AudioThing.The.Orb.v1.0.1.Incl.Patched.and.Keygen-R2R.rar"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\AudioThing.The.Orb.v1.0.1.Incl.Patched.and.Keygen-R2R.rar
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4432
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4432.0.369132201\41113451" -parentBuildID 20230214051806 -prefsHandle 1788 -prefMapHandle 1780 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {59c3e981-fb50-464a-97d6-8708ce7a98b3} 4432 "\\.\pipe\gecko-crash-server-pipe.4432" 1868 2977e8f3258 gpu
      4⤵
      PID:336
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4432.1.1392835692\1028447683" -parentBuildID 20230214051806 -prefsHandle 2448 -prefMapHandle 2436 -prefsLen 22927 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {53a476d2-1e39-461e-b8ec-c32de85767b5} 4432 "\\.\pipe\gecko-crash-server-pipe.4432" 2460 2977538d258 socket
      4⤵
      Checks processor information in registry
      PID:1144
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4432.2.264735773\865121220" -childID 1 -isForBrowser -prefsHandle 3092 -prefMapHandle 2956 -prefsLen 23030 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2fbabeb-aaf5-4361-9881-2ffeb8c240f3} 4432 "\\.\pipe\gecko-crash-server-pipe.4432" 1604 2977e895558 tab
      4⤵
      PID:1948
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4432.3.486253492\1724558446" -childID 2 -isForBrowser -prefsHandle 4032 -prefMapHandle 4028 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5649970-cd20-4cca-b8cf-06f2c77b8400} 4432 "\\.\pipe\gecko-crash-server-pipe.4432" 4040 29706920b58 tab
      4⤵
      PID:3520
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4432.4.733189709\893395330" -childID 3 -isForBrowser -prefsHandle 5032 -prefMapHandle 4984 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {73d3ba5a-fdc9-478d-a9d0-f5be4b103145} 4432 "\\.\pipe\gecko-crash-server-pipe.4432" 5052 29708acc658 tab
      4⤵
      PID:4744
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4432.5.1245666910\278582500" -childID 4 -isForBrowser -prefsHandle 5240 -prefMapHandle 5248 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c11ebe37-d4c3-4609-9c3b-4997634b67c5} 4432 "\\.\pipe\gecko-crash-server-pipe.4432" 5324 29708acd558 tab
      4⤵
      PID:3412
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4432.6.871821645\1060510768" -childID 5 -isForBrowser -prefsHandle 5524 -prefMapHandle 5520 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e4d957ff-cb6a-4602-a307-b57adf1eab69} 4432 "\\.\pipe\gecko-crash-server-pipe.4432" 5128 29705859258 tab
      4⤵
      PID:4016

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4504

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\AudioThing.The.Orb.v1.0.1.Incl.Patched.and.Keygen-R2R\" -spe -an -ai#7zMap11316:168:7zEvent13143
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2540

C:\Users\Admin\Downloads\AudioThing.The.Orb.v1.0.1.Incl.Patched.and.Keygen-R2R\WiN\Setup The Orb v1.0.1.exe
"C:\Users\Admin\Downloads\AudioThing.The.Orb.v1.0.1.Incl.Patched.and.Keygen-R2R\WiN\Setup The Orb v1.0.1.exe"
1⤵
- Executes dropped EXE
PID:1472
- C:\Users\Admin\AppData\Local\Temp\is-7SK64.tmp\Setup The Orb v1.0.1.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-7SK64.tmp\Setup The Orb v1.0.1.tmp" /SL5="$A0142,5030055,121344,C:\Users\Admin\Downloads\AudioThing.The.Orb.v1.0.1.Incl.Patched.and.Keygen-R2R\WiN\Setup The Orb v1.0.1.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:3004

C:\Users\Admin\Downloads\AudioThing.The.Orb.v1.0.1.Incl.Patched.and.Keygen-R2R\R2R\AudioThing_KeyGen.exe
"C:\Users\Admin\Downloads\AudioThing.The.Orb.v1.0.1.Incl.Patched.and.Keygen-R2R\R2R\AudioThing_KeyGen.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3356
- C:\Users\Admin\AppData\Local\Temp\keygen.exe
  C:\Users\Admin\AppData\Local\Temp\keygen.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4884

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x30c 0x41c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4604

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4676
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4248.0.1658987305\1971248690" -parentBuildID 20230214051806 -prefsHandle 1780 -prefMapHandle 1772 -prefsLen 22341 -prefMapSize 235161 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e38270e-21a8-4965-bb33-4ee17cdcdb54} 4248 "\\.\pipe\gecko-crash-server-pipe.4248" 1860 2340f826858 gpu
    3⤵
    PID:720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4248.1.2091481098\999534001" -parentBuildID 20230214051806 -prefsHandle 2316 -prefMapHandle 2296 -prefsLen 22341 -prefMapSize 235161 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5bc2a9e3-2241-49bd-b235-f8c76de83c41} 4248 "\\.\pipe\gecko-crash-server-pipe.4248" 2336 23402c86558 socket
    3⤵
    PID:2792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4248.2.1763422519\2108492083" -childID 1 -isForBrowser -prefsHandle 2968 -prefMapHandle 3060 -prefsLen 22802 -prefMapSize 235161 -jsInitHandle 1148 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bbf915be-a25a-44d8-87d0-4ee2eb6f4820} 4248 "\\.\pipe\gecko-crash-server-pipe.4248" 3116 2341361f758 tab
    3⤵
    PID:5012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4248.3.1933989818\1396652484" -childID 2 -isForBrowser -prefsHandle 3680 -prefMapHandle 3676 -prefsLen 28203 -prefMapSize 235161 -jsInitHandle 1148 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {60680330-669a-467b-8d41-07bb329eacbe} 4248 "\\.\pipe\gecko-crash-server-pipe.4248" 3708 23414b55558 tab
    3⤵
    PID:940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4248.4.2070505990\56300945" -childID 3 -isForBrowser -prefsHandle 4816 -prefMapHandle 4812 -prefsLen 28203 -prefMapSize 235161 -jsInitHandle 1148 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {55f7df6f-8bde-4ddb-9031-bbd1fa16bf46} 4248 "\\.\pipe\gecko-crash-server-pipe.4248" 4736 23415e05058 tab
    3⤵
    PID:2500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4248.5.402075650\91553737" -childID 4 -isForBrowser -prefsHandle 5084 -prefMapHandle 5080 -prefsLen 28203 -prefMapSize 235161 -jsInitHandle 1148 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7cd60758-3b47-4d8a-8ae3-33987f972494} 4248 "\\.\pipe\gecko-crash-server-pipe.4248" 5000 23415e06558 tab
    3⤵
    PID:1668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4248.6.1901058675\11508053" -childID 5 -isForBrowser -prefsHandle 5264 -prefMapHandle 5268 -prefsLen 28203 -prefMapSize 235161 -jsInitHandle 1148 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a61ea3e1-7fcd-446f-a069-bbf4685caf67} 4248 "\\.\pipe\gecko-crash-server-pipe.4248" 5248 23416423d58 tab
    3⤵
    PID:1408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4248.7.546416503\26383479" -childID 6 -isForBrowser -prefsHandle 5416 -prefMapHandle 5776 -prefsLen 28344 -prefMapSize 235161 -jsInitHandle 1148 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2bf65111-558b-43a4-abff-13f82c7204fe} 4248 "\\.\pipe\gecko-crash-server-pipe.4248" 5784 23417ef7b58 tab
    3⤵
    PID:3540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4248.8.1388058177\723558456" -childID 7 -isForBrowser -prefsHandle 5784 -prefMapHandle 5796 -prefsLen 28344 -prefMapSize 235161 -jsInitHandle 1148 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f5af62a-811b-4b95-ae3c-8be2261a53a9} 4248 "\\.\pipe\gecko-crash-server-pipe.4248" 5584 23410c30758 tab
    3⤵
    PID:3560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4248.9.1101484850\1044881031" -childID 8 -isForBrowser -prefsHandle 5796 -prefMapHandle 6076 -prefsLen 28344 -prefMapSize 235161 -jsInitHandle 1148 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a4c7a1d5-4091-4af5-af05-fcdfb3f71ca6} 4248 "\\.\pipe\gecko-crash-server-pipe.4248" 6092 23418266858 tab
    3⤵
    PID:1344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4248.10.1817975350\1868480083" -childID 9 -isForBrowser -prefsHandle 6528 -prefMapHandle 5408 -prefsLen 28353 -prefMapSize 235161 -jsInitHandle 1148 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cdfa1964-400b-4d1a-8698-776b5a7ace9f} 4248 "\\.\pipe\gecko-crash-server-pipe.4248" 4876 23416af0958 tab
    3⤵
    PID:2012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4248.11.955237463\895262370" -childID 10 -isForBrowser -prefsHandle 5452 -prefMapHandle 6296 -prefsLen 28353 -prefMapSize 235161 -jsInitHandle 1148 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {343ade58-51fb-4858-be18-07aca58d4b57} 4248 "\\.\pipe\gecko-crash-server-pipe.4248" 5396 23410c8f958 tab
    3⤵
    PID:3696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4248.12.1698104343\2006537169" -childID 11 -isForBrowser -prefsHandle 9148 -prefMapHandle 9144 -prefsLen 28353 -prefMapSize 235161 -jsInitHandle 1148 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d781c653-1b34-49fc-9052-102d10606f5e} 4248 "\\.\pipe\gecko-crash-server-pipe.4248" 9564 234132bcb58 tab
    3⤵
    PID:2376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4248.13.1240527817\1888277732" -childID 12 -isForBrowser -prefsHandle 9952 -prefMapHandle 9948 -prefsLen 28353 -prefMapSize 235161 -jsInitHandle 1148 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e994e598-054d-4a12-a444-f46e16c3507a} 4248 "\\.\pipe\gecko-crash-server-pipe.4248" 9964 234132bd758 tab
    3⤵
    PID:2492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4248.14.839717201\1152482998" -childID 13 -isForBrowser -prefsHandle 3008 -prefMapHandle 5220 -prefsLen 28353 -prefMapSize 235161 -jsInitHandle 1148 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b9d2dbf-7880-4d40-933d-9636928000f9} 4248 "\\.\pipe\gecko-crash-server-pipe.4248" 6604 23418f60058 tab
    3⤵
    PID:388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4248.15.1310254867\493728536" -parentBuildID 20230214051806 -prefsHandle 9780 -prefMapHandle 9768 -prefsLen 28353 -prefMapSize 235161 -appDir "C:\Program Files\Mozilla Firefox\browser" - {429f4752-55a0-447d-a051-4464ba99a803} 4248 "\\.\pipe\gecko-crash-server-pipe.4248" 6596 23419a44e58 rdd
    3⤵
    PID:1876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4248.16.1709154490\1252017300" -parentBuildID 20230214051806 -sandboxingKind 1 -prefsHandle 9824 -prefMapHandle 9772 -prefsLen 28353 -prefMapSize 235161 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fb973dc0-ce43-47b3-b012-b3816667d0e0} 4248 "\\.\pipe\gecko-crash-server-pipe.4248" 9800 23419a45158 utility
    3⤵
    PID:3840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4248.17.1208804926\423882822" -parentBuildID 20230214051806 -sandboxingKind 0 -prefsHandle 2824 -prefMapHandle 2836 -prefsLen 28489 -prefMapSize 235161 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd0897c2-8af4-42d8-8ff5-8c8d84c3d864} 4248 "\\.\pipe\gecko-crash-server-pipe.4248" 6392 23402c3fd58 utility
    3⤵
    PID:4860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rcjasbej.default-release\activity-stream.discovery_stream.json.tmp

Filesize
25KB

MD5
2ae81935c6f500b5af6973b7a34bca46

SHA1
22c398fbadb6c7f29e6a53980d5e02fe17cc2d95

SHA256
166da80e95553f727c0c7adf5d64ff360a226daf970ee56120cfeec204768f05

SHA512
4bede838286d2c0c1e8c920abfabf90051d5808a6b051168e67cd67f3bcac4d7c2c116aadc3d072b45539ca05268b37de3a11c8a4bc119c565e67da5280cae61

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rcjasbej.default-release\activity-stream.discovery_stream.json.tmp

Filesize
25KB

MD5
02d4160a52244b7a2a1c05e76140750a

SHA1
2ef6bc3a09c916dacad6c86bd4913b39a90f4405

SHA256
210754e73bcc32e181571ad4970a2e192b82e1e77e8bd00adedafbab2c256bf7

SHA512
21a68e66522739dcdd5b83746d7411eb455de7eeecbe89e5f6f4d42837742cf6715bdba456961e2e2fd1be6500dcb164f63b6cef3dbbe47d30971cb5d3d30447

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rcjasbej.default-release\cache2\entries\099EB2BF8827A4F91EAB3E38B14650D0205226F2

Filesize
15KB

MD5
605a8585fee1a517b29d02fb29abe5d8

SHA1
5349b439ed0a73809f4ce02e35ed920947201fba

SHA256
8cb3e5e9c6f8924bdd8a654c4933212a45a5e6a4aea28fa448311103e74d636e

SHA512
b7247bd6f1b2417252dcc1a13b0caafdc3f869003d83e7eb87b2141d53633d82e76144bec596149f6c288c8a3634503cca65af4a944ab6964d4285c27ea7d824

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rcjasbej.default-release\cache2\entries\254256B27E0C48CF9B80B695F0B3B8CA84610495

Filesize
9KB

MD5
c17a4c2634228c03ccb1cccd1c86d072

SHA1
36ab6e0bd2f92e1eee4d0c15c9420556d4ca8e79

SHA256
9a84fa9a288b683048d5b70867025ee6dea245b2c741231ab9780e52484d2c09

SHA512
149c7ec68e7bcc5de46b20f5fed67d45fd067e1ea306df9044df6d1e54a26c0abc3b73dcb1daf3dc69521e79e7f2f5425e37cafd136ed445fd6f0b5e7154bcf7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rcjasbej.default-release\cache2\entries\58AEA1E667361B7685615F133D5E18FE0C15DD16

Filesize
11KB

MD5
cb0edf45f9ae5fcac86cd25c95056523

SHA1
eda43edaebc0335c589f096e0d88fe571d34b36d

SHA256
fd7ca3c7ea8c478b7a37f3053717746e3d583c5ad92d5e4372bcbf639744afdf

SHA512
bb0b984acc283c00d1938c727ecc38b36eeb1e49b14934c979f5b59c1d765332b22a8e64e3de993dbd96f1037c86ff06516243b97fcd7edb86fb40d4a0d9727c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rcjasbej.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A

Filesize
13KB

MD5
7717c384c3aa788cee60e77548dc0158

SHA1
31880157c571301baa38e38364ea823e85c72391

SHA256
74a72a6700c377bd1afb3c45e3d8a5a68b77b46cc12fed5e2f0ada53849e011f

SHA512
c44005d556d34331ad06a5ece86caac4d98e660dbe594cb1476089a9da9d08167f2448dd48eefe929ae265a0b7722daf467f8a5874a193b684ef0360b3871555

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rcjasbej.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A

Filesize
13KB

MD5
dd0e611867715bdeb4b55faa0e0fbd25

SHA1
34aa1e6218c6886910a8f965af4afa7e06a4f13e

SHA256
ca925791119b12a4ec3d1a300c07a413a46f102268c45beabcc04bcefda10497

SHA512
db996ba38035387e25ab383386e58c46efb398caa98e1278bb86653c44a576c98aebe36fdc790687985abaa7ed85c92e1cf2bfeaef467dde34d57a745693d3e0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rcjasbej.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

Filesize
11KB

MD5
3c96491ee4eb0a5e32084c03fb3e83b8

SHA1
66194af4ef4619cfc6fc49ddfbfeb753d66d3266

SHA256
fb9a90ec4567ee8fe1248cb2383cf06ae0bc0542280cd38cc596746167f12fca

SHA512
ca4c2702053ce2d55ae62e2b8a4fe3981ee3af7dbf72b8ec4162de51d9675d2dbc67a627ae2fa944f75cd2b1e093c44db281f7f88f8a4e5e2737f65bd1cfc845

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rcjasbej.default-release\startupCache\scriptCache-child.bin

Filesize
490KB

MD5
1f030b7e64a9890f187a28b19df12c37

SHA1
f7f847f936b799f059d9a9c0e241bb58a914e577

SHA256
28b67443d960d02d35058db05ac5bc8ce805bd82a803331dbc890ac0371d514b

SHA512
d219c356dde0e03f00e5916c024b140eadb65bd00e6f0c3279c8ed368e9bb434e4ac4c6f1f96bbe2b3567630e3042ec3c9186b3062d34ed9c45378e4cf7b893b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rcjasbej.default-release\startupCache\scriptCache.bin

Filesize
8.2MB

MD5
8e3a34c12af240f7e57c86fdda93e151

SHA1
7559f35e4b99651d608445b801615d8c4fe797f7

SHA256
aa6d933e70223d5f626e9b304c65c28ad7f1e12884940b5982844a0db0100c09

SHA512
31a1b44a9e3bc814672407352bd4ce541c47011d0645b96c96399c9f15b44303492044dd888b73ad4cd6f77a355e4833a9f95ec02c17bb1d27ff67417bc42826

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rcjasbej.default-release\startupCache\urlCache.bin

Filesize
2KB

MD5
ac8e6f38c46e4aae2eefbc4fcc177119

SHA1
6cdaf85c78967baa7b917458feed664cc3aad50f

SHA256
c6636a295698085b623c225b7e970ca05b74ea74700c97fafe7d47fc29665cf9

SHA512
ac42736e7430031a14831626b6f377703a86c7302e1948d81bb5a7e2252fcee2266da63a2f81d52a2550698d148990b839aa1970a0081b881f8dd419779643e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\BASSMOD.DLL

Filesize
33KB

MD5
e4ec57e8508c5c4040383ebe6d367928

SHA1
b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06

SHA256
8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f

SHA512
77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822

Download Submit
C:\Users\Admin\AppData\Local\Temp\R2RJUCE.dll

Filesize
113KB

MD5
1f257f8aac62bf70f5f8e5588d2398e6

SHA1
ca5244c15c0fce08abbed22d386baf8ea993db9a

SHA256
51b714d4bf5af88b14507b7affff0e8e7122e5042cfb5ecd5c1cd4b8985fba28

SHA512
23ec17b564a70f2cb43fb0cb83b76ca5839d9b91704bb191fa8681989044551785c3d201666c262d3d4dc1086c91e710d37d37f151cd37ff758f222d70bebea2

Download Submit
C:\Users\Admin\AppData\Local\Temp\bgm.xm

Filesize
144KB

MD5
db295cefbb7bcf8e310528abe753df94

SHA1
6a192f0572b443285dac1f6e9df78246a2d5fcc0

SHA256
d7622fcaf08a06e49ac15b6a95f5ebbdddca0a94814d40aeb54b2ccae46ca87a

SHA512
0d7b4fac58d12a1e6f62997b2d1059bf230001efb916a323845d5b1dc51bdddee454a2ce987f63db9aea2bf15ccaa6c8fbb0cccf8951d8c189cc06a8d445cfa8

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-7SK64.tmp\Setup The Orb v1.0.1.tmp

Filesize
1.1MB

MD5
90fc739c83cd19766acb562c66a7d0e2

SHA1
451f385a53d5fed15e7649e7891e05f231ef549a

SHA256
821bd11693bf4b4b2b9f3c196036e1f4902abd95fb26873ea6c43e123b8c9431

SHA512
4cb11ad48b7585ef1b70fac9e3c25610b2f64a16358cd51e32adcb0b17a6ab1c934aeb10adaa8e9ddf69b2e2f1d18fe2e87b49b39f89b05ea13aa3205e41296c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-I6R9P.tmp\ISSKINU.DLL

Filesize
357KB

MD5
f30afccd6fafc1cad4567ada824c9358

SHA1
60a65b72f208563f90fba0da6af013a36707caa9

SHA256
e28d16fad16bca8198c47d7dd44acfd362dd6ba1654f700add8aaf2c0732622d

SHA512
59b199085ed4b59ef2b385a09d0901ff2efde7b344db1e900684a425fc2df8e2010ca73d2f2bffa547040cb1dd4c8938b175c463ccc5e39a840a19f9aa301a6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-I6R9P.tmp\R2RINNO.dll

Filesize
4KB

MD5
5cb2b49baf6badd8fa272f1f5ca2871e

SHA1
9ccc2ab7e07df419657697a9b3c94e2de6247a1e

SHA256
fffa06d80d520d5b22236a9c957fe652dcf573889b1309f984fccd09f4d69e2a

SHA512
b2fd05b2f370a1867589a675615e544caf227f345aa832144ef3a6baeac44ce886e5032fb7755a0da9f2254702b7dfdf7e0556a3a362031387f232c87f73e233

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-I6R9P.tmp\SKIN.CJSTYLES

Filesize
813KB

MD5
5f87caf3f7cf63dde8e6af53bdf31289

SHA1
a2c3cc3d9d831acd797155b667db59a32000d7a8

SHA256
4731982b02b067d3f5a5a7518279a9265a49fb0f7b3f8dc3d61b82a5359d4940

SHA512
4875298d82037ef1fff1ee3c58a9059d8480274326c862729fcc56664ecb49e2692c3838948c66dc8336e4050469d831cbf1fbd79b66565ab673d2a67765109d

Download Submit
C:\Users\Admin\AppData\Local\Temp\keygen.exe

Filesize
211KB

MD5
fa140228f3ed26d26fbe78e88efd8c14

SHA1
25b8486c396c2788c574b7578d7fd2f2e7bead3f

SHA256
d673ba757e3f01e54128ec60cb7a996be09c672472bc871f8a896e695c8cbe38

SHA512
b8829b1ab7d7dc9589ab846acadd8c0fbcb447cc30f156c138f6d7c06db948d1bcce5122ac33c64f3dc540e97ec1808cd9f6174e5405073f4d4d0959202a1c5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rcjasbej.default-release\AlternateServices.txt

Filesize
619B

MD5
8e09547414bc139753cbeebb03efda52

SHA1
daaf18815908d3d85c1deb2d8e8e5014e8d362da

SHA256
153cad4612bb2e86e6c1a8a05e23d9e2bc7f7daec606ee91ec40e9ac2f55f970

SHA512
4be90ce8850fbc97c334ca4dab975ecf1e11c89dae0d5ce3eece5a8c4b5c413b679bf5b8bef44a41c236ad11975c04059f4de3832bfb77a4028cd000b79a6e5d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rcjasbej.default-release\SiteSecurityServiceState.txt

Filesize
264B

MD5
edfe2038728349dd2b9ce73ac553b9ab

SHA1
62e54c9e194673e1f8d51eb09cb98f52169cbcf1

SHA256
8cda41865384b748e3e0cdf2c23b4dc3eb1c7e2a9210c5f44f1ecbba2e404516

SHA512
6cd0c721a84c9b493b9f6c4a339d949f2217988909e9930815a1310b169150e0abb97632459f24ed9c8e0ded0ac70e686710d48f9306d8e5cb47a5e922f0c00f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rcjasbej.default-release\datareporting\glean\db\data.safe.bin

Filesize
182B

MD5
1c3c58f7838dde7f753614d170f110fc

SHA1
c17e5a486cecaddd6ced7217d298306850a87f48

SHA256
81c14432135b2a50dc505904e87781864ca561efef9e94baeca3704d04e6db3d

SHA512
9f6e9bcb0bba9e2ce3d7dabe03b061e3fda3f6d7b0249ecf4dbc145dc78844386d047ee2ac95656a025ef808cd0fc451204dc98a1981cf2729091761661a3b49

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rcjasbej.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rcjasbej.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rcjasbej.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rcjasbej.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rcjasbej.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rcjasbej.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rcjasbej.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rcjasbej.default-release\places.sqlite

Filesize
5.0MB

MD5
8ef84d3fccb2c547afac6bd3e868342c

SHA1
0f716acf9c2733041f5851b0db382afaf10c098f

SHA256
ffe20d82e77e2d41ff78ce81496fd02ae5b04b6a2508d21791152a2191b34b20

SHA512
0691b4e27ceab20ff2ec3d2d8e56355bb602f903ab7db5161315196a65f6932af357a01158c3a83cb5e30b543ca8da4b4d97ce708ce4798fb60ad90c05df37d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rcjasbej.default-release\prefs-1.js

Filesize
7KB

MD5
0399970564c5b7a81cfbb702e3cba123

SHA1
5b02bab16f6f6aedb79e4b4af0f6caa86edc51c4

SHA256
6fd1c104fc1d00cd2f834e6f99f72b1c2f82b2dc0375836c8e5a8843e859520e

SHA512
f7414bdbe27879c62dc3e447ab6a32259ac8f0a968ef0064d0efec11f59c56891a0f8c32cea11fe388e70283c58aa66cc407fe16d014dec34310860dc06a504e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rcjasbej.default-release\prefs-1.js

Filesize
7KB

MD5
b6ec41e151712bba70d0377298899c66

SHA1
aa02c7ba9cbe65b4b2a9c3e712f886e6dcb51ef8

SHA256
da54ab7d00ae89c3407721bb8c825c07f2d576576509bde9d376f3d69a5e43d9

SHA512
5cae9f8e11646dc197876f11654779c0a356fa969b0c7bfc6ac9b40a8a93dd67d2f702c555131783ea3ce376a766066e2daaf8a4ec885de170073e19684828b8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rcjasbej.default-release\prefs-1.js

Filesize
6KB

MD5
d8f37e97fb6cb438bd86f26e845e36f4

SHA1
adebf72507f2cb46600a45477287f25c93377912

SHA256
3d2ef41f646a30f92a6fae218b5dd4cc2ce993574098f60278e7d31cefd4dde4

SHA512
cb2aaf611d22838ca63f4fbdee348549771aee187495987e8fb481d9666e2f8b2a6a13fe4509bd5117a806b0b9443d1296a7187b7ebf21828f19aadfd2086813

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rcjasbej.default-release\prefs-1.js

Filesize
7KB

MD5
f23beb2f2d5478ff1a9462ce9da5de5a

SHA1
d0a49e6c0e719b3dcb89dcb7efd7debbe134f609

SHA256
e3e706f18ecdfb314c5349a6bb0056e94dcdde886240005b3203acea22eb8010

SHA512
47ddc599b32613d14a03681090cf1466d78ac0d080004c1c7de5f16978433bd5b50a70e8854e9f2ec8ec5d6c550851236dfadaeff072b2310742254441748206

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rcjasbej.default-release\prefs.js

Filesize
7KB

MD5
82a10eb5d0b3fc323e18cef604a99e02

SHA1
da9fc21d0c94bea5f4d1ffbd57fd2cb8dbfa5b38

SHA256
568451f5154ab0a8c338431352e8375c7244b81a31d90f61a7c23f63115c7f61

SHA512
855cfc9901928c6768fa154241435e4fc1bf20f7434ba8dc957e62d97a09ead6ff2c00547906fc4c39f36d9bf7555f7eb0006923c56ec9dd547b13a97886478d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rcjasbej.default-release\prefs.js

Filesize
7KB

MD5
5bb4a738482a18f2cf69a9c65b6c76a3

SHA1
c3a9dc76dcf12e67e430c7357c0a3e3c9aa3af91

SHA256
7a7397e9a83bdb8bbf02f6421a4d1c406966ecd4c9e423ef6154c35dd53076c5

SHA512
9872ecf8b6ca5e73882e33dba1f6908f49398db5e0452f3bb544afe5736d2f6828c1b616652bdcd60ea15b9f31429fbb035f7eb527887fb95e4de8f73fc8554d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rcjasbej.default-release\prefs.js

Filesize
8KB

MD5
b8c614aa4f4b06c4be7d880bc053a482

SHA1
ca33c2992f122f7033c816f440e2b45b1b57b5f9

SHA256
c4fbf3e8763d7d919ad7fafd6116e2467c5dc09117490c44276a6bbd51f1b81c

SHA512
555b97f01bc140531024fa241c3de5bc094bdd3ce9cd0bb2cc1d976757077311fcfdc3019163bfe898ded60e8239c857a3c3a338e8ea8e9e2d8757189c4e503a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rcjasbej.default-release\prefs.js

Filesize
6KB

MD5
d80d2101c7651bf0830b27fda992aa44

SHA1
7f4312fcc76ed871bde8ae0e4ed6155dce00659b

SHA256
aa866e18b914e6d4c3ac1d3898659046db00935e267c1da5c3e6b80bcdd8fdd8

SHA512
95dbd194b56be2f97bbe470365e273c5e79f64776163208bc4be068ac2d83a4b3485fd1f5eb314a2c344e2a4788e8b30d1b6c3152895c7d0df6e39668a8b108d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rcjasbej.default-release\protections.sqlite

Filesize
64KB

MD5
49397db0486dc59d607907a086f40c9b

SHA1
08742ce9db9569062def08e99eea8470702feb7d

SHA256
890033ea279f13478e655150a823a5f84176d2f8f2ec3724dc61dfec775707c4

SHA512
fc8dad1ae2215cd96c41bb3e683670bb9138467677da46c19d1e58972775842a995b70123c22ea1efb659d043f5116d0c9dca422035a6646b35f81033c9f5f53

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rcjasbej.default-release\sessionCheckpoints.json

Filesize
288B

MD5
948a7403e323297c6bb8a5c791b42866

SHA1
88a555717e8a4a33eccfb7d47a2a4aa31038f9c0

SHA256
2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e

SHA512
17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rcjasbej.default-release\sessionCheckpoints.json.tmp

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rcjasbej.default-release\sessionCheckpoints.json.tmp

Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rcjasbej.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
b6c3801acdd95df8710324e2d044a1cc

SHA1
c75c4f34486e53c72d9a1598e3022645ee0d8e31

SHA256
586cbb2be565d1a6092b06882e625207b6ca7db61b928e3639a49446c9fb5d6a

SHA512
39b674f7b35ffede2e7d7eea30c2d0be7a429f8db09b6d404b765e88c2a271690f3ef97c667efd6b85f6b902886a5614486df3ecfedfa9e91024d7427fc52894

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rcjasbej.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
19KB

MD5
d6626dfb87cfcad196cc5372ae679d88

SHA1
fff007c25701b4cb6676a95cb37e563865558593

SHA256
13ad511619294165e91b94ae79dfa91f0db31545cfae4058e7db9e71b06910d7

SHA512
2d334a21c7f4db752fcd2abb2f5531fff75327989f57ca78ebff0a8ce6f7833736c32a1c4ffcebae77930150883890bd086955c2c47dcd1b68028647e69c473c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rcjasbej.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
07a26e0dbeb44900604fe41e55a974a5

SHA1
f99b470adfc7ed1a1e079e41bdc805a924e5cc62

SHA256
491b7d5feb745feb68aa50ba2ca931d3d453cf1c55bcd7b8ab4343b03e9665ca

SHA512
6f68f502d86042250db03ae436dd924c8f6b09a86560bbe23bdd7fbcf514111689f2a90cc98cde43f155619e6ebb454a0aad369e527c908b4f9efd513a8c51ee

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rcjasbej.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
20KB

MD5
c63f5649cab81007cff40dbf23b7d485

SHA1
bb7e22b8a1f7ce2edb6002c35ac1d0e9f13b8b22

SHA256
09565ef125cf3f88c430ad192141cc99c47b9f7929aff4c3c8fa4b6212d2d761

SHA512
3fedb5d850851104b9361728c630dc8c9e3fd477356c44cb7275f04815993b3fb429d739b84b15f2bbef3d538d9d800bd42a771851cea44f5c60fce5e8110bbf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rcjasbej.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
d529b76a42679f2899e7d123a8f8c796

SHA1
e8e40efd860fc835ff14c40010bd9090d9b5f489

SHA256
38fb84af011dad99934b7b6295e3c5193ddcb62534c9f26179bc37df54e82545

SHA512
709f3bc86ceb18b1ed623605581cd83f41966963a8be95d76ec0a4119d04286b27e223d253dbfc101c035afb9dc3d811659bc67d34278a09c6381da8527177ba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rcjasbej.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
19KB

MD5
032ffe696e1889d4d5c74bd6ea0ebabd

SHA1
6bf967d07c9bb26dd1ca26cff61ca48f59596d71

SHA256
e37efafff627172a39079296bea54d336a7bf688a39f0962263b6817b054b3c3

SHA512
0dac3bfae120d2e50bb3062a9a36ab336239ba51c255e0654e270fdb98dc006ae67f930736e8b12f95b190774a0427c916bd64d42f1e7eb5d6a6c58e4e9f97d4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rcjasbej.default-release\sessionstore.jsonlz4

Filesize
594B

MD5
892ccd3120411a6bbad89ceaecbe8061

SHA1
0a2b65b124210d883166803a6e6584609411ed97

SHA256
3733b23f94829616951a115ef70e76e095503d42531a6fb2cafe30fc04c2ce99

SHA512
938e4e3e08367772f3764acf2cfa2cf19f72a62231b7be455cfe165c453ec9171549e05bf3f4117053a51fb640f920ea3a315c8c427799a6683f36e1c077bcaf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rcjasbej.default-release\storage\default\https+++www.dropbox.com\idb\2243825010udneus.sqlite

Filesize
48KB

MD5
e806f284258cdf72285556f32d2714e9

SHA1
318c6f9f6e1ff2aa7c97abfd3ba99bc5a468416a

SHA256
d134a01762978a1bf9f3da60fb46291df073f2edcf61702cd779af77c99f8d86

SHA512
c6b9f0febbdb47995c7e25a2c5021982bbf77ed0b7e7fe234e257d4f99433ee454749ad7ec4d651501f264349e72f433967a22792f56247072629188d9b446b9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rcjasbej.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite

Filesize
48KB

MD5
c8604a2a35e78cc8b6e34afcc48f7103

SHA1
1a25e86a328068fb6cc0b0f0b55d0aea60332b56

SHA256
ff9f7bdb0ad48fa51f4f3b1f58e580b21c403d89d87c4d43d30377fc78ceaf14

SHA512
3986aba8a86d3bdd996d388a68b22182cda39d7ec5cd286df681580e0ef5d1a7339757b4bd7eaee28d3262b9d94bc1f2e7569f2938b8e551047a6682298b3844

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rcjasbej.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
200KB

MD5
7f0a8fe6fc473ba35ccc34f36078d25b

SHA1
9f2802305dae5fa1fd115a0c5546ce3a34cebb7a

SHA256
b8f67d48cd06585944bc3bf9d7f52db3fbe9e94fc27a03321b265831d2e57cd7

SHA512
efcd562251fd2aeca457c3e5c4ec88e88298240291a6c4b06b52f6a3fb58b2c4b5fae022ea74a1779dfd6eb96d671248788ee082102ed75b4c6cbb24e69ec6d4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rcjasbej.default-release\xulstore.json

Filesize
342B

MD5
9ebd4c529b87ff8c6996fd213e7663b9

SHA1
bb6b6ee7ea64f68253350aa40ba3b44f553864a1

SHA256
ed04d7730d027913641817927ad391d099ac59ba526e17f64451d67ef94c3255

SHA512
1d5ee73d765f6fe482f5afc3d64af28e1998f621caa8f13afdb5502add7665f0cbebe793bf0d07341f9789053de4573ce2b9bdc3967f9b60583e4648dd36e60d

Download Submit
C:\Users\Admin\Desktop\TheOrb.atl

Filesize
512B

MD5
7bfa433e284131a61032a50ea3031abf

SHA1
d109f9ce0437165d1920deefced0f5cdf7dd6f2a

SHA256
06b70e0c9a6809a321a26d1003732fae2d97099d57bfd1d1a097f1b30a791ce1

SHA512
8ea23694f026bcf90c52201e098eb1724d05504a0c6d6c871b18980f769621b9d07d882d5be7a7b9dd52172514bb8472ed92345cd1ea29905593b30877c5e88c

Download Submit
C:\Users\Admin\Downloads\AudioThing.The.Orb.v1.0.1.Incl.Patched.and.Keygen-R2R\R2R\AudioThing_KeyGen.exe

Filesize
531KB

MD5
d9903d39c06d661cd660c708c836134c

SHA1
c5172421e42fe66800ff030f7958e2baf7db4a4f

SHA256
bea41ad51699c586e7adac482db82718bca80830d6144206d83fd1a888025303

SHA512
3ce856bd889d2452dd63d74c936fec6da54920b6ef41d235dce5b68d83bb8562961bad905391b3b9759fa1095396f95ce6af0bbf90d37e2bb5b6814f26e78e3c

Download Submit
C:\Users\Admin\Downloads\AudioThing.The.Orb.v1.0.1.Incl.Patched.and.Keygen-R2R\WiN\Setup The Orb v1.0.1.exe

Filesize
5.3MB

MD5
00b696faef2210c4187393bf859cc319

SHA1
4ca6689a4dac6c1d9f248a5646ccf53a9320e93a

SHA256
7bc0cf597e404a6dedbd83e6836009ca068a39d82536da1fd46a6233692732a4

SHA512
746e9aaa74a3f993d9db8220b6b95c1f7925e009e090416e2e08aebd4a53fae81a09a938756ce2b9dca7e71a213306fad153b18c363c4a45a92aeb4b70ba9fde

Download Submit
C:\Users\Admin\Downloads\xJkpibnW.rar.part

Filesize
5.7MB

MD5
771efced7f4bc95a85ea48c3ac3a6293

SHA1
81901e62cac03bc678358296a51697d85f05be5b

SHA256
c936b618db392d1642346d13eec57373826fc43426f48513f896a23326563bfb

SHA512
878e38aa553796ef1eed4a869f3f19a4bfcd05ab57bd4834f5d12ab31fb1d7f75b7a34fe72811dec9638ac69a2feb6162e792287881d40067449f7dcdd547b47

Download Submit
memory/1472-183-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3004-223-0x0000000075DA0000-0x0000000075DC5000-memory.dmp

Filesize
148KB

Download
memory/3004-226-0x00000000769C0000-0x0000000076AA3000-memory.dmp

Filesize
908KB

Download
memory/3004-237-0x00000000752B0000-0x0000000075324000-memory.dmp

Filesize
464KB

Download
memory/3004-268-0x0000000075330000-0x0000000075540000-memory.dmp

Filesize
2.1MB

Download
memory/3004-235-0x0000000075E60000-0x0000000075F0F000-memory.dmp

Filesize
700KB

Download
memory/3004-233-0x00000000769C0000-0x0000000076AA3000-memory.dmp

Filesize
908KB

Download
memory/3004-262-0x0000000075E60000-0x0000000075F0F000-memory.dmp

Filesize
700KB

Download
memory/3004-234-0x0000000075FF0000-0x00000000765A3000-memory.dmp

Filesize
5.7MB

Download
memory/3004-253-0x0000000075FF0000-0x00000000765A3000-memory.dmp

Filesize
5.7MB

Download
memory/3004-252-0x00000000032F0000-0x0000000003351000-memory.dmp

Filesize
388KB

Download
memory/3004-249-0x0000000075DA0000-0x0000000075DC5000-memory.dmp

Filesize
148KB

Download
memory/3004-246-0x0000000075FF0000-0x00000000765A3000-memory.dmp

Filesize
5.7MB

Download
memory/3004-248-0x0000000075330000-0x0000000075540000-memory.dmp

Filesize
2.1MB

Download
memory/3004-232-0x0000000077090000-0x000000007716C000-memory.dmp

Filesize
880KB

Download
memory/3004-239-0x00000000032F0000-0x0000000003351000-memory.dmp

Filesize
388KB

Download
memory/3004-240-0x0000000075FF0000-0x00000000765A3000-memory.dmp

Filesize
5.7MB

Download
memory/3004-198-0x00000000032F0000-0x0000000003351000-memory.dmp

Filesize
388KB

Download
memory/3004-241-0x0000000075E60000-0x0000000075F0F000-memory.dmp

Filesize
700KB

Download
memory/3004-201-0x00000000032F0000-0x0000000003351000-memory.dmp

Filesize
388KB

Download
memory/3004-242-0x0000000075330000-0x0000000075540000-memory.dmp

Filesize
2.1MB

Download
memory/3004-211-0x0000000076910000-0x000000007698A000-memory.dmp

Filesize
488KB

Download
memory/3004-243-0x00000000752B0000-0x0000000075324000-memory.dmp

Filesize
464KB

Download
memory/3004-214-0x00000000032F0000-0x0000000003351000-memory.dmp

Filesize
388KB

Download
memory/3004-220-0x00000000746D0000-0x0000000074700000-memory.dmp

Filesize
192KB

Download
memory/3004-221-0x00000000032F0000-0x0000000003351000-memory.dmp

Filesize
388KB

Download
memory/3004-244-0x0000000074510000-0x0000000074632000-memory.dmp

Filesize
1.1MB

Download
memory/3004-245-0x00000000032F0000-0x0000000003351000-memory.dmp

Filesize
388KB

Download
memory/3004-247-0x0000000075E60000-0x0000000075F0F000-memory.dmp

Filesize
700KB

Download
memory/3004-250-0x00000000752B0000-0x0000000075324000-memory.dmp

Filesize
464KB

Download
memory/3004-251-0x0000000074510000-0x0000000074632000-memory.dmp

Filesize
1.1MB

Download
memory/3004-254-0x0000000075E60000-0x0000000075F0F000-memory.dmp

Filesize
700KB

Download
memory/3004-255-0x0000000075330000-0x0000000075540000-memory.dmp

Filesize
2.1MB

Download
memory/3004-256-0x00000000752B0000-0x0000000075324000-memory.dmp

Filesize
464KB

Download
memory/3004-257-0x0000000074510000-0x0000000074632000-memory.dmp

Filesize
1.1MB

Download
memory/3004-258-0x00000000032F0000-0x0000000003351000-memory.dmp

Filesize
388KB

Download
memory/3004-259-0x0000000077090000-0x000000007716C000-memory.dmp

Filesize
880KB

Download
memory/3004-260-0x00000000769C0000-0x0000000076AA3000-memory.dmp

Filesize
908KB

Download
memory/3004-261-0x0000000075FF0000-0x00000000765A3000-memory.dmp

Filesize
5.7MB

Download
memory/3004-263-0x0000000075330000-0x0000000075540000-memory.dmp

Filesize
2.1MB

Download
memory/3004-264-0x00000000752B0000-0x0000000075324000-memory.dmp

Filesize
464KB

Download
memory/3004-265-0x0000000074510000-0x0000000074632000-memory.dmp

Filesize
1.1MB

Download
memory/3004-266-0x00000000032F0000-0x0000000003351000-memory.dmp

Filesize
388KB

Download
memory/3004-236-0x0000000075330000-0x0000000075540000-memory.dmp

Filesize
2.1MB

Download
memory/3004-230-0x0000000074510000-0x0000000074632000-memory.dmp

Filesize
1.1MB

Download
memory/3004-219-0x0000000075DA0000-0x0000000075DC5000-memory.dmp

Filesize
148KB

Download
memory/3004-231-0x00000000032F0000-0x0000000003351000-memory.dmp

Filesize
388KB

Download
memory/3004-229-0x0000000075330000-0x0000000075540000-memory.dmp

Filesize
2.1MB

Download
memory/3004-227-0x0000000075FF0000-0x00000000765A3000-memory.dmp

Filesize
5.7MB

Download
memory/3004-228-0x0000000075E60000-0x0000000075F0F000-memory.dmp

Filesize
700KB

Download
memory/3004-238-0x0000000074510000-0x0000000074632000-memory.dmp

Filesize
1.1MB

Download
memory/3004-222-0x00000000032F0000-0x0000000003351000-memory.dmp

Filesize
388KB

Download
memory/3004-224-0x00000000032F0000-0x0000000003351000-memory.dmp

Filesize
388KB

Download
memory/3004-225-0x00000000032F0000-0x0000000003351000-memory.dmp

Filesize
388KB

Download
memory/3004-209-0x0000000076910000-0x000000007698A000-memory.dmp

Filesize
488KB

Download
memory/3004-210-0x00000000032F0000-0x0000000003351000-memory.dmp

Filesize
388KB

Download
memory/3004-212-0x00000000032F0000-0x0000000003351000-memory.dmp

Filesize
388KB

Download
memory/3004-213-0x0000000076910000-0x000000007698A000-memory.dmp

Filesize
488KB

Download
memory/3004-215-0x0000000076910000-0x000000007698A000-memory.dmp

Filesize
488KB

Download
memory/3004-216-0x0000000075DA0000-0x0000000075DC5000-memory.dmp

Filesize
148KB

Download
memory/3004-217-0x00000000032F0000-0x0000000003351000-memory.dmp

Filesize
388KB

Download
memory/3004-218-0x0000000076910000-0x000000007698A000-memory.dmp

Filesize
488KB

Download
memory/4884-625-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4884-558-0x0000000074940000-0x0000000074986000-memory.dmp

Filesize
280KB

Download
memory/4884-557-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4884-553-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4884-548-0x0000000074940000-0x0000000074986000-memory.dmp

Filesize
280KB

Download
memory/4884-546-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4884-541-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download