Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-09-2024 19:11

General

  • Target

    1c3a4f586345aa8bb07fdf7def83b40026080b1af777cdf82f00909282ea87b8.exe

  • Size

    1.8MB

  • MD5

    bef90e67c56413d8e7a94cbd45f9b9a1

  • SHA1

    dfc9e49ea097f1955e5830055a7c685d76c6d0d1

  • SHA256

    1c3a4f586345aa8bb07fdf7def83b40026080b1af777cdf82f00909282ea87b8

  • SHA512

    ae647a17eafe300f4a465eeda4de2e3b936f39cbbf44a01b1036e5c18c3b40a2cc89e55a4ee0fbc880bafacca1f8781d10b317f187303076038a237aa85bc07d

  • SSDEEP

    49152:35PdZAEA9WhDIYXzwQhkeJQxyPE1aCJbz:35FZAP6pzwQ/QtoCJ3

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

C2

http://185.215.113.103

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 16 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 37 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 44 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\1c3a4f586345aa8bb07fdf7def83b40026080b1af777cdf82f00909282ea87b8.exe
    "C:\Users\Admin\AppData\Local\Temp\1c3a4f586345aa8bb07fdf7def83b40026080b1af777cdf82f00909282ea87b8.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3720
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1704
      • C:\Users\Admin\AppData\Roaming\1000026000\a31c17c697.exe
        "C:\Users\Admin\AppData\Roaming\1000026000\a31c17c697.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:2948
      • C:\Users\Admin\AppData\Local\Temp\1000030001\c500a4b227.exe
        "C:\Users\Admin\AppData\Local\Temp\1000030001\c500a4b227.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1696
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4320
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start msedge https://www.youtube.com/account
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          PID:4008
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com/account
            5⤵
              PID:516
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff98a7946f8,0x7ff98a794708,0x7ff98a794718
                6⤵
                  PID:3472
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,1410402225721130382,15031895346781164487,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1964 /prefetch:2
                  6⤵
                    PID:2212
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1944,1410402225721130382,15031895346781164487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
                    6⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5424
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c start msedge https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                4⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                PID:1980
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings
                  5⤵
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:4680
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff98a7946f8,0x7ff98a794708,0x7ff98a794718
                    6⤵
                      PID:4516
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,5633160481942205194,15955519191488062916,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
                      6⤵
                        PID:380
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,5633160481942205194,15955519191488062916,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
                        6⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:756
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,5633160481942205194,15955519191488062916,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
                        6⤵
                          PID:5840
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5633160481942205194,15955519191488062916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
                          6⤵
                            PID:5496
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5633160481942205194,15955519191488062916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
                            6⤵
                              PID:5304
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5633160481942205194,15955519191488062916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
                              6⤵
                                PID:6428
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5633160481942205194,15955519191488062916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
                                6⤵
                                  PID:6644
                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,5633160481942205194,15955519191488062916,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
                                  6⤵
                                    PID:6972
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,5633160481942205194,15955519191488062916,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
                                    6⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:6056
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5633160481942205194,15955519191488062916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
                                    6⤵
                                      PID:6276
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5633160481942205194,15955519191488062916,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
                                      6⤵
                                        PID:4344
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5633160481942205194,15955519191488062916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
                                        6⤵
                                          PID:684
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5633160481942205194,15955519191488062916,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
                                          6⤵
                                            PID:3264
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,5633160481942205194,15955519191488062916,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3084 /prefetch:2
                                            6⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:4332
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                        4⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:4888
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                          5⤵
                                          • Checks processor information in registry
                                          • Modifies registry class
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          • Suspicious use of SetWindowsHookEx
                                          • Suspicious use of WriteProcessMemory
                                          PID:1212
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1888 -prefMapHandle 1880 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e836d0e3-f2c4-423b-b9eb-892613e97861} 1212 "\\.\pipe\gecko-crash-server-pipe.1212" gpu
                                            6⤵
                                              PID:4436
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2472 -parentBuildID 20240401114208 -prefsHandle 2448 -prefMapHandle 2444 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c1599c7f-2ae0-437f-87bd-c890ce2225f1} 1212 "\\.\pipe\gecko-crash-server-pipe.1212" socket
                                              6⤵
                                                PID:3548
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3324 -childID 1 -isForBrowser -prefsHandle 3284 -prefMapHandle 2948 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f452c32e-03ba-4c6b-83ca-bac9657241bf} 1212 "\\.\pipe\gecko-crash-server-pipe.1212" tab
                                                6⤵
                                                  PID:3544
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3696 -childID 2 -isForBrowser -prefsHandle 3684 -prefMapHandle 3688 -prefsLen 22693 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b8401eb-9688-4df1-a071-3784c97858af} 1212 "\\.\pipe\gecko-crash-server-pipe.1212" tab
                                                  6⤵
                                                    PID:3388
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3724 -childID 3 -isForBrowser -prefsHandle 3896 -prefMapHandle 3900 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {67554da7-bed7-4c08-bd94-aeeae933f0ec} 1212 "\\.\pipe\gecko-crash-server-pipe.1212" tab
                                                    6⤵
                                                      PID:3368
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4512 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4424 -prefMapHandle 4448 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c8f422e1-2a08-4ab0-b18d-0d6f09c2d0df} 1212 "\\.\pipe\gecko-crash-server-pipe.1212" utility
                                                      6⤵
                                                      • Checks processor information in registry
                                                      PID:5896
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5876 -childID 4 -isForBrowser -prefsHandle 5828 -prefMapHandle 5868 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a149d891-5d82-4a02-9083-6885e545cf00} 1212 "\\.\pipe\gecko-crash-server-pipe.1212" tab
                                                      6⤵
                                                        PID:7044
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5960 -childID 5 -isForBrowser -prefsHandle 6036 -prefMapHandle 6032 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb0ed836-9c1b-4a8e-9b6f-e1deaaeeb52c} 1212 "\\.\pipe\gecko-crash-server-pipe.1212" tab
                                                        6⤵
                                                          PID:7056
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5924 -childID 6 -isForBrowser -prefsHandle 5824 -prefMapHandle 5876 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {291b8081-6d9a-4768-afcc-be0f29ec3b33} 1212 "\\.\pipe\gecko-crash-server-pipe.1212" tab
                                                          6⤵
                                                            PID:7068
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                        4⤵
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1084
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                          5⤵
                                                          • Checks processor information in registry
                                                          PID:3332
                                                • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                  C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                  1⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4348
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:6268
                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                    1⤵
                                                      PID:6596
                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      1⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:5036
                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      1⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:4288

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\ProgramData\mozglue.dll

                                                      Filesize

                                                      593KB

                                                      MD5

                                                      c8fd9be83bc728cc04beffafc2907fe9

                                                      SHA1

                                                      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                      SHA256

                                                      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                      SHA512

                                                      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                    • C:\ProgramData\nss3.dll

                                                      Filesize

                                                      2.0MB

                                                      MD5

                                                      1cc453cdf74f31e4d913ff9c10acdde2

                                                      SHA1

                                                      6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                      SHA256

                                                      ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                      SHA512

                                                      dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      719923124ee00fb57378e0ebcbe894f7

                                                      SHA1

                                                      cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

                                                      SHA256

                                                      aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

                                                      SHA512

                                                      a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      d7114a6cd851f9bf56cf771c37d664a2

                                                      SHA1

                                                      769c5d04fd83e583f15ab1ef659de8f883ecab8a

                                                      SHA256

                                                      d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

                                                      SHA512

                                                      33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                      Filesize

                                                      504B

                                                      MD5

                                                      e965559288274ce88e282044390fb9ec

                                                      SHA1

                                                      393076e4ce422e39d96b42c0edb7443a40b74f0a

                                                      SHA256

                                                      a45c7178a26f78c32bde19a58c7fa01398ed8332ef2c72b9ae106b3489d0e78a

                                                      SHA512

                                                      0b77a01bf63c528433a7607a0da9bbd1f4f62193722713f2e5f07e0ddbf0588ed19b9e3a4372256f1fbeabba0d73e03ff59cde8ef37491b3bf0a735443d5c7dc

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

                                                      Filesize

                                                      20KB

                                                      MD5

                                                      d34b6fa0f4baa7a0eb06abe653dec6b0

                                                      SHA1

                                                      d0c31fafdb41336192fc9da3c43fb65123828fc9

                                                      SHA256

                                                      cf15aa5576c19eb58f3229fa637a17b2adb2f399693c9a3203aa3279defeb031

                                                      SHA512

                                                      e44e5b775b73fa618346e603e0cb0f974a3b0789eff79e88249b9cae3eaed2650c3013265d45ce46e38b43a74ca8c492a8151dccfbeeb20d0dea9ad3e57bb598

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

                                                      Filesize

                                                      124KB

                                                      MD5

                                                      0d2c87b7d2f56b8a5a89ac16107a5d6b

                                                      SHA1

                                                      c136a15c4d93343adab98870b7b0918385d3ce96

                                                      SHA256

                                                      402301a1c1d3f468c46ba86b8f2b3538c001540d20f4426de0101e2f7ea5e76b

                                                      SHA512

                                                      fce25453e8c4cc39838a1bb4541a5c207945d714aff847af93da2579cfcfe12341a9a71482a49fa793f58abb280a281620604c504e29005cd2a95276f573fcd7

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                      Filesize

                                                      2KB

                                                      MD5

                                                      2bdb3d92a9ab9f4e6d2ed9ba742c8a9c

                                                      SHA1

                                                      b8bae80b4850f06d234854be8aa4dc95d2767f84

                                                      SHA256

                                                      917826987a1779b1df25fc38fa45ef0211b77f08df6834fc3d00473bbbeb8dbd

                                                      SHA512

                                                      e8b0b6622113649f3ae1001439c7b833b3626fbf75bbdc1e6f1b887356c173ef9c1a2fc0752f77c5000181c89f01ee0a0adbac833efe44a1bef053d06253a5fe

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      6ae552e31a71daeacbd84fabc21d7747

                                                      SHA1

                                                      60ea5af3a42a06b34ac2f8f1993eedfacb8b30f2

                                                      SHA256

                                                      746e44476c54c124d42c22b34748e2863845ee0bc78dbeecaf4e8150b36e9a8a

                                                      SHA512

                                                      b46b8b5394a4e1c26869ce42ab45bd06949b2fd94bfb22bd8be38fe9c594cf253e479ec231030e17d65edb94d8078ad4ab9c96d1b1f9a1687de3e18a9bb8e814

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      58339d901fd6618ae5770118dfeb0cb0

                                                      SHA1

                                                      24dd3663e5b56ea43529f1a853b4176ff5f1f31e

                                                      SHA256

                                                      b21654defc71a69c392dd65bd0eb5d9846333f960e6c64666936cbde78ba44c2

                                                      SHA512

                                                      cd2490e4f5b3d5fead0b0cbb4a1916a2ee77d8e88d4be470fec96d2053170cf3a58772a99a1c3b002e3b606199e4c9b21420ff301c95ed1fdda59a1c379123dc

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      7KB

                                                      MD5

                                                      127961862c030c8bfd8e67f42eb43341

                                                      SHA1

                                                      35aba31abe3f121752c5cc9e84a28416d9b5e90d

                                                      SHA256

                                                      5e12689bf017f234a332af8b38ca32a22d64cb9c343c8fa43b466f58e839e567

                                                      SHA512

                                                      aa00e8ace73c92553f49fafbb4e3bede0c3516107696e3e4a1f81fbd81c36136dff2e162575f2b19e410c3bb620e6f7fffbd567393d24b31ab9c7b59ed698f88

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                      Filesize

                                                      539B

                                                      MD5

                                                      99a5da1431b24870fee0bcd1d612e1ef

                                                      SHA1

                                                      0b551b627973f8720dd83142789a9d35a867ae4e

                                                      SHA256

                                                      fe490dd0ed0b9aedab4feb7282ff60ae57ced83c5beab401b9dcd8612d17f09b

                                                      SHA512

                                                      e104ebba103f9995a3b35dcd1e87eafc5b58e60919ccd6f8da432724051dd571a4c8ff35f7503ed7446d0b8715f7383ad6906c4f3a9eb5001a5390a34d717232

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                      Filesize

                                                      539B

                                                      MD5

                                                      915d9741a06302e0a7185bee2e5ae37f

                                                      SHA1

                                                      7be3ba1b576d8f940871cf6cf4a7639458b91953

                                                      SHA256

                                                      6bdb3837e0c52457899658eda90306f60c00d71b61777a9dc97ef59159518e9d

                                                      SHA512

                                                      0e78622a6685eb82f91b2c9f09494881c68a9a0a7c064be6ae3911a7b08e9221663bd0f6f898137bdd953830e93b7e08d48150dc307923cf6f5e97cb4d57af68

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58de74.TMP

                                                      Filesize

                                                      539B

                                                      MD5

                                                      a3d2ea09d492616834581e51be97172c

                                                      SHA1

                                                      8c2fb9c2db5872890c70ca6ac6915c63629cb8d0

                                                      SHA256

                                                      be1905292cc5a5b5a50858694f9150d6471ca28d0d1970afe26b8d11fb78abcb

                                                      SHA512

                                                      82a64d619a985ef27d97791b5e1cd8348eb3a916b06cc3ab588a69de6f31fbfc4a224fc4a941545335d52c9ee32df5f0efb4b399e19a1ae2994aca70902fd82c

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                      Filesize

                                                      16B

                                                      MD5

                                                      6752a1d65b201c13b62ea44016eb221f

                                                      SHA1

                                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                      SHA256

                                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                      SHA512

                                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      10KB

                                                      MD5

                                                      8d14dc1fd52b013a509ee0f2c29cc9aa

                                                      SHA1

                                                      83354cdfe18ae852b0db0bd5ae46489e74d82335

                                                      SHA256

                                                      a5eae114ec551a7cdb5a1123ba905f91e67c81dd1feda37ec9bca95a04cbe002

                                                      SHA512

                                                      847fc3b649e26cea0c267fc26cc582db2e55486e1fb7976e0f3f57d5f5d689cddc1e9453c1507a8d6b1412c17552b7ea9fbd3e16e6f3c084f4962f4655f7d2ec

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      11KB

                                                      MD5

                                                      818e3287963267cd83ff97244e16dc30

                                                      SHA1

                                                      11b02204d2fb4654dbcf6a1528efdb72f247a5a5

                                                      SHA256

                                                      ef407a5e631944c69d582f8f678796836c3b7340d900423d2000a4277e14f309

                                                      SHA512

                                                      123277f1709607234fdc88a68fbb656780ba1533300e69e1081e5b742400038d22016f5d43f47e686c04f6efc4dd0832584130069b93da39e161dd37703c5c2b

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      8KB

                                                      MD5

                                                      ddf4d6f7520504a0fa57cfec070ca54d

                                                      SHA1

                                                      a65a07f07ac2c3b5581ecfc9fe51374a51e2d63f

                                                      SHA256

                                                      f4819fa43faad0c739fa2d1ed9e7793f9be2b89abb7b7717f39b9c58c87eab63

                                                      SHA512

                                                      e5a30bef9d6d7ac52e7dd454e973b3dc805af72d1e6f53b4a896fa7453f09b53942801db70c6cbd9b248b94c55b489f5697f057963b81fb350a3c1f12db39682

                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\activity-stream.discovery_stream.json.tmp

                                                      Filesize

                                                      23KB

                                                      MD5

                                                      178ef4e9d160f91e5e55211852cbc79e

                                                      SHA1

                                                      61f97a67f01f2a602bed8e186cca9d9b37af3a5b

                                                      SHA256

                                                      a42759d0403f639f123ad18e69f5093bbc5acc9432d174eea8d8fb1485b7e9aa

                                                      SHA512

                                                      b02b11aa333c384ac81c8c7d1454acb6d5e2084f6ffe7c8bec3671e54a9a0df2390d7f426d41b0a8a80d64b5e386ac41867c8b59a61ce8191c0df0e766901e0b

                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F

                                                      Filesize

                                                      13KB

                                                      MD5

                                                      ccc4fcd7023070709080b165460fcd78

                                                      SHA1

                                                      84814c5306751264a7816f22f75a647da141b3a3

                                                      SHA256

                                                      30b35ae841b91c0e2864387fe04d19803d81ac2fb537958b47fb03b6b9753c09

                                                      SHA512

                                                      86620876b85f1946e68b6d5d9ab7f5d4c1514bc907ef0bf9fe7368a7a81252e980de2482fa014eae643bffc0babc9717741aa075c739689959e9a9dab32ec50b

                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                                                      Filesize

                                                      1.8MB

                                                      MD5

                                                      bef90e67c56413d8e7a94cbd45f9b9a1

                                                      SHA1

                                                      dfc9e49ea097f1955e5830055a7c685d76c6d0d1

                                                      SHA256

                                                      1c3a4f586345aa8bb07fdf7def83b40026080b1af777cdf82f00909282ea87b8

                                                      SHA512

                                                      ae647a17eafe300f4a465eeda4de2e3b936f39cbbf44a01b1036e5c18c3b40a2cc89e55a4ee0fbc880bafacca1f8781d10b317f187303076038a237aa85bc07d

                                                    • C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1

                                                      Filesize

                                                      2KB

                                                      MD5

                                                      e05e8f072b373beafe27cc11d85f947c

                                                      SHA1

                                                      1d6daeb98893e8122b8b69287ebd9d43f3c6138e

                                                      SHA256

                                                      717c09427fa5754ba92f92961545534048d0a76528c2e95c4d5ec6cef47c612f

                                                      SHA512

                                                      b3e34162e5ee43bb01f289eebc45fd3ea3e07f30be40dcf6635606540f912fe5c84d301e9f78e97dfe3ffe53e72547e50f3bcd7d4ebe5ab8da451a1989c469a0

                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rmc0otdi.aax.ps1

                                                      Filesize

                                                      60B

                                                      MD5

                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                      SHA1

                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                      SHA256

                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                      SHA512

                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                      Filesize

                                                      479KB

                                                      MD5

                                                      09372174e83dbbf696ee732fd2e875bb

                                                      SHA1

                                                      ba360186ba650a769f9303f48b7200fb5eaccee1

                                                      SHA256

                                                      c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                      SHA512

                                                      b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                      Filesize

                                                      13.8MB

                                                      MD5

                                                      0a8747a2ac9ac08ae9508f36c6d75692

                                                      SHA1

                                                      b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                      SHA256

                                                      32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                      SHA512

                                                      59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                    • C:\Users\Admin\AppData\Roaming\1000026000\a31c17c697.exe

                                                      Filesize

                                                      1.7MB

                                                      MD5

                                                      b568ff86da616dd1a46d9fbfa9415f72

                                                      SHA1

                                                      1f0a299ee6349d54d18b5147ff957544501b66fd

                                                      SHA256

                                                      8e6e5197c7542613f4fcf6dedfdd6a774f1464876cdd2defcfc05d092d169180

                                                      SHA512

                                                      b1e3c0703d317973c6bfda8bcab2c5bc97de12062d0ac908bb9b3e651892244630df1f07076b43d3a4b0da8a0ff7ec10bbaafb1931377542c9c812494b067b29

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\AlternateServices.bin

                                                      Filesize

                                                      25KB

                                                      MD5

                                                      f79cf73b133329dde6e50e9bdc194dbd

                                                      SHA1

                                                      0ffacec0d4fd311db2e2d232e4949935d0b9b59e

                                                      SHA256

                                                      55f550374d99128b9912fed08575f69d3812e99681eeeaa45a47a1ca810f0bb9

                                                      SHA512

                                                      2dde4e3f1426815c83e9dc0038b1d5f13f8f19507ad75f4b0a08cba7e7d856dbfceb7f47338438344dff23adfb81d31b3b793929d01f0587065c5a1d39af4047

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\AlternateServices.bin

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      fcaa9ac096dde475480205a47a6a4b6e

                                                      SHA1

                                                      4ee741c7c7d0dfcc6453110b848dd9af2a8feca8

                                                      SHA256

                                                      471cf0eb2832170263e4c44435a21327a4f75546be2964c8b77472007d75cd23

                                                      SHA512

                                                      bf155009e3e480c08a6d4b0337cfe4221345f5c23925bf9a516e87a3dbdc9177cce4e9448259483441fb6e8ecf37c6bc8ed982dee4c3daa527cb6de1896fb083

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\AlternateServices.bin

                                                      Filesize

                                                      12KB

                                                      MD5

                                                      e248211c34250d795d98cd4da6e258dc

                                                      SHA1

                                                      610a704cd51a8e8df4775136896942e957d40f5d

                                                      SHA256

                                                      850290f475197ce4dd21c3c0c348e39395978c215f9b5aa0adc766334369d746

                                                      SHA512

                                                      31bec45ab29423c73c04e46130926359ee86aa85d58c2186dd05163e79470cfa8198e84e6b96168ad61e5094c929869c77f3a621609d0eaeac0109418ff2fa9a

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\AlternateServices.bin

                                                      Filesize

                                                      15KB

                                                      MD5

                                                      820c44a3d1ad15b2bb4821ed68140a7a

                                                      SHA1

                                                      2e3af4cd8d3a910f75d3c268b5890fc186308ad3

                                                      SHA256

                                                      a1e3e660c49600e6f8f5b9a42cda2893ff7d2a571b8f8fa4e3b2034b24a24719

                                                      SHA512

                                                      41305a20a9a9cd89b7446b170bba235c59a67cbc751a30bf23c9a9c55ca941393cedd3f24b7a0174e2afc9f908cd4566c06620182434d067cfcff2e624919d23

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\AlternateServices.bin

                                                      Filesize

                                                      18KB

                                                      MD5

                                                      77d6748eaf98b947dbbc7e21844bbbcb

                                                      SHA1

                                                      8c448354ecc6d8ab43ba3599592f442d31ae6762

                                                      SHA256

                                                      fe48aea0dee9097570a1fc9746495c64215e1e2a62fc69beeaf3bbd054602b56

                                                      SHA512

                                                      385894f838003839d00a6f5dbfafb9fb703270208ebb59c13bc780b8f23769f0bcdf55db29230b1fe16fa28c818d1b2cd6351d1e9e8bfc3954be55ee1b1cdacb

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\AlternateServices.bin

                                                      Filesize

                                                      23KB

                                                      MD5

                                                      37970d953badbc0d020a2c81eb0e49c5

                                                      SHA1

                                                      d2a95dd779232f75402f0a20fc1e464701600295

                                                      SHA256

                                                      6611d056f24ab513dab2a376fe1016853a38faeeaaa13b18417f1954eb3e0952

                                                      SHA512

                                                      d6323206de101268f9515c811f319b1297a8104bbaad97e6314d8f1467e8a682bc62d301333887ce6bd9cf3c36bdde0bd90271f0a0e9b079f9a61707f34ef20f

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\cookies.sqlite

                                                      Filesize

                                                      512KB

                                                      MD5

                                                      0d28b555561dc81c1cf2acade0957478

                                                      SHA1

                                                      a40dde4262e4801d0ff688bc34628879f5973ca2

                                                      SHA256

                                                      4bce46718ea568e10008e767938f0880f9fc56830dc45b1d6f9a82dcc3599a7f

                                                      SHA512

                                                      f644065c5d1d51a4327c8fd323f5b11f9220306843b3c173886d7b202d9dddbdc89f4ad7c8498c640f7b4f2cfc798cd6e5e29cbb8537ea6d76bff6a2c45bfc5c

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\cookies.sqlite-wal

                                                      Filesize

                                                      512KB

                                                      MD5

                                                      f988b54380574a139266305e376e9225

                                                      SHA1

                                                      881865a8901096653d4df3f7f012b95a8b66e530

                                                      SHA256

                                                      649367d42b4de608994ace324eefa9d21c6c0ee9861f602dddf73c831047bd55

                                                      SHA512

                                                      b62f04a532d9e6740f75b88a004afaf7eb445dec3b3498b04c10dfe6ffeceb601f6e09fd1fba9a550febcbf5a9a40e82cc3e97c5bd9318391e4ecf36311bb4a8

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      8f6bad0c244f40f892684f89457fd656

                                                      SHA1

                                                      43c79ff0dd89f37841665f42b29d22aedf1212db

                                                      SHA256

                                                      7b34a2a05c6c144d9dec6fa21ee9c0a7df93ed7fed27440f423716865a7672ed

                                                      SHA512

                                                      e15a0f5578f72e9d8235184f12f23697a842c8d0bee23b291448f7f1da3dcd575839d0b86fe7b29690a29131f8f25407ae2516bea476fffd57e3677b08546e38

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      15KB

                                                      MD5

                                                      b12c79c8791caca354e3dc7c4a04e8e9

                                                      SHA1

                                                      767521e426c5dafc3b26b4181b6777c649e37bbe

                                                      SHA256

                                                      588c6dcc200f4dbc84d38c5947ce9c25ba349e31d88df7c784a3535ec97de2dc

                                                      SHA512

                                                      e54b7d6a368ffbbd04341233e4091319dc3d9d025db5677279fe7413c1980fd37172d004ada5d3c0722dd88aadc895025c7fc5d66d3c1322d794c9c776b45557

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      15KB

                                                      MD5

                                                      d192eb2cf9fd0b434c921b905c9d855c

                                                      SHA1

                                                      33a6fcd55ffd4e2668968e342cedb79d77acc8bf

                                                      SHA256

                                                      db77d005be2fff231d0035ea513fb772b0d59cc9570bd5946e9cc8fa49a99f43

                                                      SHA512

                                                      e4c88528160f22621db8c842fb02854ca20eb5b46cf1cee3a118c1495c599a740de28045d5e79adf616693c197942b64e8866b2e29319bdcebecddcd679784e6

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\pending_pings\8a4d3074-19b0-419f-be48-9a10bf6e8563

                                                      Filesize

                                                      671B

                                                      MD5

                                                      ea34e31f98918413f81dee14d3ba7167

                                                      SHA1

                                                      26ef439ea3ebd2c983f0a1cb3031b94f5621ea6c

                                                      SHA256

                                                      76059bc348e3c44dbc450fbb1cfd49474ea94d993c9d36ba019c4dc42e8a4f0f

                                                      SHA512

                                                      8fe50205b191f580c67917e81a1bc6511e04e73f0c5839119f296ff95bfe79b95e818e9b1299c2a132d7f6eb3e87d8ba9b39432f8f34242827ad459571de4a37

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\pending_pings\9a5cb33b-51eb-4b27-8367-8d5b78b79472

                                                      Filesize

                                                      982B

                                                      MD5

                                                      d2187312a58c092552bd5d37f535a8ab

                                                      SHA1

                                                      3304c80d06a821043b24a100da5f9093f62fa5d7

                                                      SHA256

                                                      942cbaaaa64551dd925b4b4314cbd0f29bc91b68bdda90128fbe5ed4721a71cd

                                                      SHA512

                                                      57210414e7dcd8d0aefd6cca27e8fec3a599ef3a585ac44ac75c75d3c0856c63312d0950ca2d78bcfd4351f3984703ac37ff421dcbe8f2eeeb10159ef086c0fc

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\pending_pings\af4cde93-dfce-45b1-ace6-ea3d69d39096

                                                      Filesize

                                                      25KB

                                                      MD5

                                                      ba04b61213f7f6163cc015a1a0b04f87

                                                      SHA1

                                                      7b6e0f01fded78f90af2d5183c962fea74e9a4b4

                                                      SHA256

                                                      ae4404afa0b77ff2aab90a1c60ba52ffd777a44858bcf8bbe0927c2b8368f5be

                                                      SHA512

                                                      a5115cc3073d62ada6928b8ee2b75aae710d776bfa18f013386dca29846feee4e8b070ab054d7ec464730846f9d8a17f6037dae1c0e7f274511dff7c1f6c55df

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                                                      Filesize

                                                      1.1MB

                                                      MD5

                                                      842039753bf41fa5e11b3a1383061a87

                                                      SHA1

                                                      3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                      SHA256

                                                      d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                      SHA512

                                                      d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                                                      Filesize

                                                      116B

                                                      MD5

                                                      2a461e9eb87fd1955cea740a3444ee7a

                                                      SHA1

                                                      b10755914c713f5a4677494dbe8a686ed458c3c5

                                                      SHA256

                                                      4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                      SHA512

                                                      34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                                                      Filesize

                                                      372B

                                                      MD5

                                                      bf957ad58b55f64219ab3f793e374316

                                                      SHA1

                                                      a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                      SHA256

                                                      bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                      SHA512

                                                      79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                                                      Filesize

                                                      17.8MB

                                                      MD5

                                                      daf7ef3acccab478aaa7d6dc1c60f865

                                                      SHA1

                                                      f8246162b97ce4a945feced27b6ea114366ff2ad

                                                      SHA256

                                                      bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                      SHA512

                                                      5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\places.sqlite

                                                      Filesize

                                                      5.0MB

                                                      MD5

                                                      660f1fe7a1472656dec54b5c3e8e311c

                                                      SHA1

                                                      dbacc84f33f3988e05363625c4087a609eddd7e9

                                                      SHA256

                                                      72571fe5a0bc18a6dc68d686e087da89b25246b0c48b652fdce00b77004f8aef

                                                      SHA512

                                                      368bc4c9de4f19b2c677603fb5a13e4ea31f0b49ac1c11f2150874aecb8ecc8ecf6e5c73c66ae983dc85ae2044c6e2e84347bd22515f0e69a88c7c34fa3e7bca

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\places.sqlite-wal

                                                      Filesize

                                                      2.2MB

                                                      MD5

                                                      bd77240e16b68ef87f3c0e962cb08c1b

                                                      SHA1

                                                      9a56ba1822ac4505596d1a3b5cbb4958fc65b8be

                                                      SHA256

                                                      44cf4cd7125946ad8ac01dcf95da0dd4355b2b04f9541f91ad24a75a7b377d48

                                                      SHA512

                                                      06a253f707229572a74d2d461970d781b61af7e059a12741819810acc04e5bad3aa6b90f0e04548fa772b5fcdb94fffd516f4c07bf606bd8f0d40f02483f80dd

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs-1.js

                                                      Filesize

                                                      11KB

                                                      MD5

                                                      75bb2134a60e5329683412668ae0c325

                                                      SHA1

                                                      349df318ab0668c954b4e8c95e4d186d5defa35a

                                                      SHA256

                                                      3a45e29b3112bdf4eadfc0f442122ad0a0645fd976a70f21f72b321cbd3824cd

                                                      SHA512

                                                      730a5dfb8b5eb825f3d4b703dfabf99dc0d7e5953d43320aac5551f6ba4ec00400c9bbb72131d4c8092151cef63bc9cfa43c8973d577886da647f10b061f4c58

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs-1.js

                                                      Filesize

                                                      13KB

                                                      MD5

                                                      0086a3051d8c644ecdb417dc494d053c

                                                      SHA1

                                                      4e2574ebdde052930b17868dc8ad64e42e7eb067

                                                      SHA256

                                                      2dc9b0e006383a028c614a7b2f20295fbbf5614313a7e3173f70478f6f1a1ab1

                                                      SHA512

                                                      955bd34da3722d10f54e0417414d37042276d4f66ef9e5e274a980e2266041da2da44b69823809c162053ff9d8c630a8674f349b685a5c46e150aa07dbbf4a06

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs.js

                                                      Filesize

                                                      11KB

                                                      MD5

                                                      a7ebec34c18bd2506062d4444d62544d

                                                      SHA1

                                                      08437a9470e7d35d27ba2bf78677cf3bd4ebc83a

                                                      SHA256

                                                      060138c812efb8c53e4d4fae96da95da9204d133746f830bd9128d2855b5bfe7

                                                      SHA512

                                                      dcc8e00485ee91712fcfdb5f282369fe11ff35be370d28eea0c3e9a56cef7c6bd63b687826112a0b45319ef5d15769079115f8aa1af817f9960fb14093554f25

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs.js

                                                      Filesize

                                                      11KB

                                                      MD5

                                                      b084b59bdbcba30005dc4d03e5e8f9e5

                                                      SHA1

                                                      40b4d37750869375e44b6e28940bc665de287467

                                                      SHA256

                                                      e095ed7f141acc901ccab843614a52b89a17d4c9bf64e9a9643537890f34a7f5

                                                      SHA512

                                                      8ec575d0658b1939cbcb1b639251e03fd5e7d662a4e444ed20e42709f894412fa9e314cad2f530579ff53342e12d5dcc08019c782c12c56b88277194c6ff56eb

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs.js

                                                      Filesize

                                                      16KB

                                                      MD5

                                                      f82418bf82c971c6f9a7c15558d3bc48

                                                      SHA1

                                                      b4241d63faa75f714f9e98fb8a138ce2238255fa

                                                      SHA256

                                                      34f55bbaa0811468f2cc0da55bfba717513e34f092840999cc0d193a4881ab3c

                                                      SHA512

                                                      782e83cafad82755fe55f06c212a0f29a1979e81f4733fb8349195344c3d308b199ffa0e8945812d20a80ad516af541162aa143de449ec845f6b3ac355b1fe1f

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\sessionstore-backups\recovery.baklz4

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      cc622472973af2e63369c747eadd455d

                                                      SHA1

                                                      66399edcf501f47251d7ba8dfe224e9976144cfe

                                                      SHA256

                                                      ca9bed0fb1ebdfed1aac534c76be98b8d2c941ce90f53d473d8f7a65a130a75c

                                                      SHA512

                                                      5a6fe82e5d2a5b1c87f537d09a177d098c86bd101b8d7f91874233fb3838c2ae8f344716055e5a58978b21a7c9fbed2fd113e6664d3cda64a585aa3592ef3d9c

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\sessionstore-backups\recovery.baklz4

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      423e9aee383a5a3d0888b51bcdfe9965

                                                      SHA1

                                                      b2c9fb0d2d068b260cb5507af4519e9b367f1794

                                                      SHA256

                                                      f8418a77b3c0ae0a6a410ca4f1c1bf21766baf6d5104cc0b2419b0ef634393c7

                                                      SHA512

                                                      4bafce8775bc00070c85c7225bca6eadd6c6291cedb3297cc47e62a214b8c608dcdac9e579e3e5431afd92494f5e6091ff588c30bb6a0c936168611cd3f71adc

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                                      Filesize

                                                      384KB

                                                      MD5

                                                      c01ee5c26ba076e00337183c5a0c4a35

                                                      SHA1

                                                      3363b25c1ecd2da2ad9374e241d6c9ed9034999a

                                                      SHA256

                                                      eb8fe3f2cacc2d39d67ce6eecbdd540bce243fa17a5f991c5e7204dae01ce90c

                                                      SHA512

                                                      5789c128b7f1d1668ea30d53008e81284ca4395da436a2f3d1ba9fa95870afb788e449e3e75c70eba9deb642a31ffce125057373758310f000eb0bf8c71d4194

                                                    • \??\pipe\LOCAL\crashpad_4680_NGPVVZBZFDUQUYGG

                                                      MD5

                                                      d41d8cd98f00b204e9800998ecf8427e

                                                      SHA1

                                                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                      SHA256

                                                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                      SHA512

                                                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                    • memory/1696-607-0x0000000000010000-0x00000000006A3000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/1696-671-0x0000000000010000-0x00000000006A3000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/1696-2372-0x0000000000010000-0x00000000006A3000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/1696-2692-0x0000000000010000-0x00000000006A3000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/1696-844-0x0000000000010000-0x00000000006A3000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/1696-3002-0x0000000000010000-0x00000000006A3000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/1696-1070-0x0000000000010000-0x00000000006A3000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/1696-908-0x0000000000010000-0x00000000006A3000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/1696-3007-0x0000000000010000-0x00000000006A3000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/1696-3049-0x0000000000010000-0x00000000006A3000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/1696-57-0x0000000000010000-0x00000000006A3000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/1696-764-0x0000000000010000-0x00000000006A3000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/1696-1687-0x0000000000010000-0x00000000006A3000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/1696-3097-0x0000000000010000-0x00000000006A3000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/1696-3099-0x0000000000010000-0x00000000006A3000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/1704-3003-0x0000000000370000-0x0000000000815000-memory.dmp

                                                      Filesize

                                                      4.6MB

                                                    • memory/1704-1243-0x0000000000370000-0x0000000000815000-memory.dmp

                                                      Filesize

                                                      4.6MB

                                                    • memory/1704-3100-0x0000000000370000-0x0000000000815000-memory.dmp

                                                      Filesize

                                                      4.6MB

                                                    • memory/1704-315-0x0000000000370000-0x0000000000815000-memory.dmp

                                                      Filesize

                                                      4.6MB

                                                    • memory/1704-18-0x0000000000370000-0x0000000000815000-memory.dmp

                                                      Filesize

                                                      4.6MB

                                                    • memory/1704-3058-0x0000000000370000-0x0000000000815000-memory.dmp

                                                      Filesize

                                                      4.6MB

                                                    • memory/1704-56-0x0000000000370000-0x0000000000815000-memory.dmp

                                                      Filesize

                                                      4.6MB

                                                    • memory/1704-678-0x0000000000370000-0x0000000000815000-memory.dmp

                                                      Filesize

                                                      4.6MB

                                                    • memory/1704-19-0x0000000000371000-0x000000000039F000-memory.dmp

                                                      Filesize

                                                      184KB

                                                    • memory/1704-815-0x0000000000370000-0x0000000000815000-memory.dmp

                                                      Filesize

                                                      4.6MB

                                                    • memory/1704-20-0x0000000000370000-0x0000000000815000-memory.dmp

                                                      Filesize

                                                      4.6MB

                                                    • memory/1704-21-0x0000000000370000-0x0000000000815000-memory.dmp

                                                      Filesize

                                                      4.6MB

                                                    • memory/1704-3024-0x0000000000370000-0x0000000000815000-memory.dmp

                                                      Filesize

                                                      4.6MB

                                                    • memory/1704-845-0x0000000000370000-0x0000000000815000-memory.dmp

                                                      Filesize

                                                      4.6MB

                                                    • memory/1704-642-0x0000000000370000-0x0000000000815000-memory.dmp

                                                      Filesize

                                                      4.6MB

                                                    • memory/1704-83-0x0000000000370000-0x0000000000815000-memory.dmp

                                                      Filesize

                                                      4.6MB

                                                    • memory/1704-2832-0x0000000000370000-0x0000000000815000-memory.dmp

                                                      Filesize

                                                      4.6MB

                                                    • memory/1704-981-0x0000000000370000-0x0000000000815000-memory.dmp

                                                      Filesize

                                                      4.6MB

                                                    • memory/1704-2634-0x0000000000370000-0x0000000000815000-memory.dmp

                                                      Filesize

                                                      4.6MB

                                                    • memory/1704-38-0x0000000000370000-0x0000000000815000-memory.dmp

                                                      Filesize

                                                      4.6MB

                                                    • memory/1704-1909-0x0000000000370000-0x0000000000815000-memory.dmp

                                                      Filesize

                                                      4.6MB

                                                    • memory/2948-37-0x0000000000190000-0x0000000000823000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/2948-3008-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                      Filesize

                                                      972KB

                                                    • memory/2948-1605-0x0000000000190000-0x0000000000823000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/2948-556-0x0000000000190000-0x0000000000823000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/2948-48-0x0000000000190000-0x0000000000823000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/2948-3098-0x0000000000190000-0x0000000000823000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/2948-47-0x0000000000190000-0x0000000000823000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/2948-2306-0x0000000000190000-0x0000000000823000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/2948-763-0x0000000000190000-0x0000000000823000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/2948-3096-0x0000000000190000-0x0000000000823000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/2948-555-0x0000000000190000-0x0000000000823000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/2948-1047-0x0000000000190000-0x0000000000823000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/2948-2691-0x0000000000190000-0x0000000000823000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/2948-3045-0x0000000000190000-0x0000000000823000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/2948-670-0x0000000000190000-0x0000000000823000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/2948-3001-0x0000000000190000-0x0000000000823000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/2948-466-0x0000000000190000-0x0000000000823000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/2948-883-0x0000000000190000-0x0000000000823000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/2948-3006-0x0000000000190000-0x0000000000823000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/2948-840-0x0000000000190000-0x0000000000823000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/3720-5-0x0000000000E20000-0x00000000012C5000-memory.dmp

                                                      Filesize

                                                      4.6MB

                                                    • memory/3720-1-0x0000000077A94000-0x0000000077A96000-memory.dmp

                                                      Filesize

                                                      8KB

                                                    • memory/3720-2-0x0000000000E21000-0x0000000000E4F000-memory.dmp

                                                      Filesize

                                                      184KB

                                                    • memory/3720-3-0x0000000000E20000-0x00000000012C5000-memory.dmp

                                                      Filesize

                                                      4.6MB

                                                    • memory/3720-17-0x0000000000E20000-0x00000000012C5000-memory.dmp

                                                      Filesize

                                                      4.6MB

                                                    • memory/3720-0-0x0000000000E20000-0x00000000012C5000-memory.dmp

                                                      Filesize

                                                      4.6MB

                                                    • memory/4288-3057-0x0000000000370000-0x0000000000815000-memory.dmp

                                                      Filesize

                                                      4.6MB

                                                    • memory/4320-65-0x0000000000C20000-0x0000000000C56000-memory.dmp

                                                      Filesize

                                                      216KB

                                                    • memory/4320-80-0x0000000005E30000-0x0000000005E4E000-memory.dmp

                                                      Filesize

                                                      120KB

                                                    • memory/4320-81-0x0000000005E50000-0x0000000005E9C000-memory.dmp

                                                      Filesize

                                                      304KB

                                                    • memory/4320-67-0x0000000004E80000-0x0000000004EA2000-memory.dmp

                                                      Filesize

                                                      136KB

                                                    • memory/4320-84-0x0000000007130000-0x00000000071C6000-memory.dmp

                                                      Filesize

                                                      600KB

                                                    • memory/4320-75-0x0000000005850000-0x0000000005BA4000-memory.dmp

                                                      Filesize

                                                      3.3MB

                                                    • memory/4320-86-0x00000000063F0000-0x0000000006412000-memory.dmp

                                                      Filesize

                                                      136KB

                                                    • memory/4320-87-0x0000000007780000-0x0000000007D24000-memory.dmp

                                                      Filesize

                                                      5.6MB

                                                    • memory/4320-68-0x0000000005730000-0x0000000005796000-memory.dmp

                                                      Filesize

                                                      408KB

                                                    • memory/4320-69-0x00000000057A0000-0x0000000005806000-memory.dmp

                                                      Filesize

                                                      408KB

                                                    • memory/4320-85-0x0000000006360000-0x000000000637A000-memory.dmp

                                                      Filesize

                                                      104KB

                                                    • memory/4320-66-0x0000000005090000-0x00000000056B8000-memory.dmp

                                                      Filesize

                                                      6.2MB

                                                    • memory/4348-309-0x0000000000370000-0x0000000000815000-memory.dmp

                                                      Filesize

                                                      4.6MB

                                                    • memory/4348-99-0x0000000000370000-0x0000000000815000-memory.dmp

                                                      Filesize

                                                      4.6MB

                                                    • memory/5036-1185-0x0000000000370000-0x0000000000815000-memory.dmp

                                                      Filesize

                                                      4.6MB

                                                    • memory/5036-1202-0x0000000000370000-0x0000000000815000-memory.dmp

                                                      Filesize

                                                      4.6MB