Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-09-2024 01:26

General

  • Target

    6eb59c4f674dca8834a2e617632dce7fd0be64ab01297e016b424d04b0b0054a.exe

  • Size

    1.8MB

  • MD5

    3bcdaf8aa8a6f0ca2f613c8c14bc5a6e

  • SHA1

    14e7cff2628e339009821bdb95673a40299149d0

  • SHA256

    6eb59c4f674dca8834a2e617632dce7fd0be64ab01297e016b424d04b0b0054a

  • SHA512

    d4f38ebb5e8684ab8d267cbef2c2a227238636409cc41b03fa767e3ba83f324db47e93543dfdde302fa72847b728f4ba93aae10d58670efe0ada9ed051941579

  • SSDEEP

    49152:GQlomvjK2/8k6ZJ8EBHJGCHONwoFCRUUoYk32nOg:15vjak6z84uszoYkGl

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

C2

http://185.215.113.103

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 16 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 46 IoCs
  • Suspicious use of SendNotifyMessage 44 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\6eb59c4f674dca8834a2e617632dce7fd0be64ab01297e016b424d04b0b0054a.exe
    "C:\Users\Admin\AppData\Local\Temp\6eb59c4f674dca8834a2e617632dce7fd0be64ab01297e016b424d04b0b0054a.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:904
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5080
      • C:\Users\Admin\AppData\Roaming\1000026000\a5751c2930.exe
        "C:\Users\Admin\AppData\Roaming\1000026000\a5751c2930.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:4632
      • C:\Users\Admin\AppData\Local\Temp\1000030001\4c2f9460dc.exe
        "C:\Users\Admin\AppData\Local\Temp\1000030001\4c2f9460dc.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4504
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1220
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start msedge https://www.youtube.com/account
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          PID:4892
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com/account
            5⤵
            • Enumerates system info in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:924
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b78c46f8,0x7ff9b78c4708,0x7ff9b78c4718
              6⤵
                PID:4484
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,8216428242050054159,5393037701557747116,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
                6⤵
                  PID:332
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,8216428242050054159,5393037701557747116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
                  6⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5188
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,8216428242050054159,5393037701557747116,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
                  6⤵
                    PID:5252
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8216428242050054159,5393037701557747116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:1
                    6⤵
                      PID:5260
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8216428242050054159,5393037701557747116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1
                      6⤵
                        PID:5368
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8216428242050054159,5393037701557747116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2692 /prefetch:1
                        6⤵
                          PID:1500
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8216428242050054159,5393037701557747116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
                          6⤵
                            PID:5624
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,8216428242050054159,5393037701557747116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4252 /prefetch:8
                            6⤵
                              PID:6524
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,8216428242050054159,5393037701557747116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4252 /prefetch:8
                              6⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:6740
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8216428242050054159,5393037701557747116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
                              6⤵
                                PID:6772
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8216428242050054159,5393037701557747116,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
                                6⤵
                                  PID:6788
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8216428242050054159,5393037701557747116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1
                                  6⤵
                                    PID:7092
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8216428242050054159,5393037701557747116,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
                                    6⤵
                                      PID:7100
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,8216428242050054159,5393037701557747116,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6000 /prefetch:2
                                      6⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:4948
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\system32\cmd.exe" /c start msedge https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                  4⤵
                                  • Checks computer location settings
                                  • System Location Discovery: System Language Discovery
                                  PID:4460
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings
                                    5⤵
                                      PID:1304
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9b78c46f8,0x7ff9b78c4708,0x7ff9b78c4718
                                        6⤵
                                          PID:4988
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,17782991917194711110,8706140894671002483,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
                                          6⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:4576
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                      4⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:3300
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                        5⤵
                                        • Checks processor information in registry
                                        • Modifies registry class
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        • Suspicious use of SetWindowsHookEx
                                        • Suspicious use of WriteProcessMemory
                                        PID:2284
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2016 -parentBuildID 20240401114208 -prefsHandle 1932 -prefMapHandle 1924 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7955a19-5f8b-4cf0-8f77-5a72486393c9} 2284 "\\.\pipe\gecko-crash-server-pipe.2284" gpu
                                          6⤵
                                            PID:4520
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2456 -parentBuildID 20240401114208 -prefsHandle 2432 -prefMapHandle 2420 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b178f209-fe1f-455f-9ece-a578440aa13c} 2284 "\\.\pipe\gecko-crash-server-pipe.2284" socket
                                            6⤵
                                              PID:1580
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3120 -childID 1 -isForBrowser -prefsHandle 3168 -prefMapHandle 3200 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c96cd218-31a6-4649-8b1d-398391169b11} 2284 "\\.\pipe\gecko-crash-server-pipe.2284" tab
                                              6⤵
                                                PID:4492
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3572 -childID 2 -isForBrowser -prefsHandle 3556 -prefMapHandle 3560 -prefsLen 22693 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3e8b1946-58ef-4700-96fe-d98564d5fddd} 2284 "\\.\pipe\gecko-crash-server-pipe.2284" tab
                                                6⤵
                                                  PID:2664
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4204 -childID 3 -isForBrowser -prefsHandle 4216 -prefMapHandle 4212 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7735c82a-c08a-4731-a299-c31adc2fc272} 2284 "\\.\pipe\gecko-crash-server-pipe.2284" tab
                                                  6⤵
                                                    PID:4860
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4956 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4948 -prefMapHandle 4944 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea7ecdbe-d311-4fed-b111-8a028621e9dc} 2284 "\\.\pipe\gecko-crash-server-pipe.2284" utility
                                                    6⤵
                                                    • Checks processor information in registry
                                                    PID:5564
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5688 -childID 4 -isForBrowser -prefsHandle 5652 -prefMapHandle 5428 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f30a55af-c823-4e62-bd91-262cd8667057} 2284 "\\.\pipe\gecko-crash-server-pipe.2284" tab
                                                    6⤵
                                                      PID:5820
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5856 -childID 5 -isForBrowser -prefsHandle 5860 -prefMapHandle 5864 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5cc8d04-dd3d-462b-b925-d1f3c6b4e400} 2284 "\\.\pipe\gecko-crash-server-pipe.2284" tab
                                                      6⤵
                                                        PID:5872
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6060 -childID 6 -isForBrowser -prefsHandle 6068 -prefMapHandle 6072 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {79b609e4-572d-4f10-9ee0-5181f6b956ba} 2284 "\\.\pipe\gecko-crash-server-pipe.2284" tab
                                                        6⤵
                                                          PID:6152
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                      4⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2952
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                        5⤵
                                                        • Checks processor information in registry
                                                        PID:464
                                              • C:\Windows\System32\CompPkgSrv.exe
                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                1⤵
                                                  PID:2732
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:5348
                                                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                    C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                    1⤵
                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                    • Checks BIOS information in registry
                                                    • Executes dropped EXE
                                                    • Identifies Wine through registry keys
                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:4256
                                                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                    C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                    1⤵
                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                    • Checks BIOS information in registry
                                                    • Executes dropped EXE
                                                    • Identifies Wine through registry keys
                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:2580

                                                  Network

                                                  MITRE ATT&CK Enterprise v15

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • C:\ProgramData\mozglue.dll

                                                    Filesize

                                                    593KB

                                                    MD5

                                                    c8fd9be83bc728cc04beffafc2907fe9

                                                    SHA1

                                                    95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                    SHA256

                                                    ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                    SHA512

                                                    fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                  • C:\ProgramData\nss3.dll

                                                    Filesize

                                                    2.0MB

                                                    MD5

                                                    1cc453cdf74f31e4d913ff9c10acdde2

                                                    SHA1

                                                    6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                    SHA256

                                                    ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                    SHA512

                                                    dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                    Filesize

                                                    152B

                                                    MD5

                                                    2dc1a9f2f3f8c3cfe51bb29b078166c5

                                                    SHA1

                                                    eaf3c3dad3c8dc6f18dc3e055b415da78b704402

                                                    SHA256

                                                    dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

                                                    SHA512

                                                    682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                    Filesize

                                                    152B

                                                    MD5

                                                    e4f80e7950cbd3bb11257d2000cb885e

                                                    SHA1

                                                    10ac643904d539042d8f7aa4a312b13ec2106035

                                                    SHA256

                                                    1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

                                                    SHA512

                                                    2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                    Filesize

                                                    528B

                                                    MD5

                                                    427e6d136716caa0baa6e7868d134a98

                                                    SHA1

                                                    2b283967b1327b20c473d61b771f64fff5390f10

                                                    SHA256

                                                    1d5ea8103ed9d7721cf69f2f1e6dc74552297f772a0ae448131b636b8eccf472

                                                    SHA512

                                                    8ee566050a5a95402229471ade238c01b744fed896b3e24f0183d495edd90d695c883d5e13829f0a7245b9636dd7bc94bfd825e385c7a27393518706cf8e5185

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                    Filesize

                                                    1KB

                                                    MD5

                                                    4ad1a0e8a0eb792aaf7172461746cd8a

                                                    SHA1

                                                    8fa23b182713b57b706d9a0e39ee68eda80bbd29

                                                    SHA256

                                                    ff0a9101a922742c00fc0acfd02d02c90431d4896b465651369085d70777f375

                                                    SHA512

                                                    c027b783ab04c639867f29956e544cd1fcafcba58f504bd8d3107117e97a2b9fc76fc27b08696d3ef01197a3aacba954ecbfa7a5c07cdf583d9243c637f39eaf

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                    Filesize

                                                    1KB

                                                    MD5

                                                    e890ef6676045524117280c29f54d6e4

                                                    SHA1

                                                    8868f4734ed809770c46e3b532d5642761d8f11c

                                                    SHA256

                                                    e1d62df66867cf446bc0f179ec51ba1dd6ff94e6556e6bf802e89017299d2b4a

                                                    SHA512

                                                    8515fe5f7a75a0d6fee1c3c9714e65a7dadf4927e114f6c7f25508fbe9da865067ec34186be29d9f82b441dd05006e2a213827e1e86ba3224061b7613fe9abe3

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    5KB

                                                    MD5

                                                    bd8615bd047186d20d26bfbcdd5455bf

                                                    SHA1

                                                    c843e849085e6bf1f3362282cfaf77b9f111e165

                                                    SHA256

                                                    d3fa3aabac4e1d8c94e0ee8f1a3e1aa4dca461a2af8d09f6e374bb72912d83ac

                                                    SHA512

                                                    ba15847e9d818628edc8116af4fb05bedfd98853cd697efc6ff97717222e1da4b2a17fae35b543c01f8db17a12163415814f4499c3cd290b0f4028f32912330c

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    7KB

                                                    MD5

                                                    9fa4e3b015d73365fce8a3baecb60a96

                                                    SHA1

                                                    90860c3f758fa98f83119ad63561963d731ae075

                                                    SHA256

                                                    f8562735eca366889e3b9fae8ab1e179c9b9e0f1ddae43c4cd47818cf9874ca2

                                                    SHA512

                                                    92af323dcf698275e2ea9be5c807d9b30e922b9170ff21d655b40905178b0f8e47b141754c3b9345b23042771d17b2a934b3bcbd0259beabb12fa998d2a8009d

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                    Filesize

                                                    539B

                                                    MD5

                                                    8f3d9cbfc939692afb17ad778bbcc893

                                                    SHA1

                                                    86f2c8e0dabf0e44ec51e5635785845f7ab8e6fe

                                                    SHA256

                                                    d106cd507ef74e5c145e134a25bb3c58fc5248948fe8e2dedace160d6b103267

                                                    SHA512

                                                    e2deb56d210d50358e4c9f1e677d425c8e9c9c44f7d7bd855a4817e148ab7ddcf135b24dc657227ed3d4e69d4601585e76566383ca595cab6f6432b9fdfd02d6

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                    Filesize

                                                    539B

                                                    MD5

                                                    89a7f9bcf439b7c9639bc0061e03afc9

                                                    SHA1

                                                    366c91a70d80ea675110fec7a270068ae5d025f7

                                                    SHA256

                                                    c738b66362aed218632e688cf4e7d4b62e7bc4c4cb1890bb5b46295c10172c28

                                                    SHA512

                                                    8425b1ae0e07accccdfe2e8deb774bae557b5bc56d95ac771c85892dd037e85376bf747deb9ad97a681b27c85a6267cabcf171bdda532cc4e934359d05e464dd

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58c791.TMP

                                                    Filesize

                                                    539B

                                                    MD5

                                                    268fe28e263085527bf106f4e03a742a

                                                    SHA1

                                                    fba3c5de76dceb1c25f536ee801e966217173698

                                                    SHA256

                                                    b1c129dd149da2a8e097bd5603cac1aef840c33be22ca91a92ee5880f4073eae

                                                    SHA512

                                                    b242f529b520985dcac6fdea4c4e8e15a0775abdcf5109e284c066d0238407d5b768f89e6c9379a54b3e3a921142d5dd70c433a3253f93173320bfa2beb8faa2

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                    Filesize

                                                    16B

                                                    MD5

                                                    6752a1d65b201c13b62ea44016eb221f

                                                    SHA1

                                                    58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                    SHA256

                                                    0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                    SHA512

                                                    9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                    Filesize

                                                    8KB

                                                    MD5

                                                    28a5568c44818fdf595bc1e647de3ba9

                                                    SHA1

                                                    14e52138ad7868b34cb2e3403902c39a0bebbc84

                                                    SHA256

                                                    5b68f59a3394280dc68d3c17bfd58fa751bf7891b624e7a68a43f1d3239085cc

                                                    SHA512

                                                    dc89208272275da3ac8fae48ac61ba5c643cc17410256d5084bbd18859da875382754e4739dc1511c7aa50ac670e1a0af9ec6c05c08c53d06ee605564635e7a5

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                    Filesize

                                                    10KB

                                                    MD5

                                                    362feae5490058feae5c3a415d42ee50

                                                    SHA1

                                                    1c4da7f0a615cad4aeaca5305889c6dac405e9e7

                                                    SHA256

                                                    78748034ec03d029f37ba9f913baa3e426842b54bbb58d87a876a1792555f6ca

                                                    SHA512

                                                    89b51f5989fdb25dfc475e7beb264293d7c60d98417010cc13aa531492f8c2f849c6d524a88aa9dc9a8cfb2ce7bd4b6a6b869e58d026d8bacc7e1c88ec82ad22

                                                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F

                                                    Filesize

                                                    13KB

                                                    MD5

                                                    685733a7bd2ea60d41daaa535f4e715f

                                                    SHA1

                                                    6b8c2a43518fb6d3ebffd1704adf2af4db3aae12

                                                    SHA256

                                                    282e894391444495ed985c114af515439c1eeb7314abf383673fbfd54cddd619

                                                    SHA512

                                                    d67b682812e197e195655f6a5828099436249e161e086b8beac99f79ce0dbbd8eeacbde63d0c3dbc68469f4bd523f51a9b3ce57b1dcaded7516cf7302c7a7e2c

                                                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                                                    Filesize

                                                    1.8MB

                                                    MD5

                                                    3bcdaf8aa8a6f0ca2f613c8c14bc5a6e

                                                    SHA1

                                                    14e7cff2628e339009821bdb95673a40299149d0

                                                    SHA256

                                                    6eb59c4f674dca8834a2e617632dce7fd0be64ab01297e016b424d04b0b0054a

                                                    SHA512

                                                    d4f38ebb5e8684ab8d267cbef2c2a227238636409cc41b03fa767e3ba83f324db47e93543dfdde302fa72847b728f4ba93aae10d58670efe0ada9ed051941579

                                                  • C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1

                                                    Filesize

                                                    2KB

                                                    MD5

                                                    e05e8f072b373beafe27cc11d85f947c

                                                    SHA1

                                                    1d6daeb98893e8122b8b69287ebd9d43f3c6138e

                                                    SHA256

                                                    717c09427fa5754ba92f92961545534048d0a76528c2e95c4d5ec6cef47c612f

                                                    SHA512

                                                    b3e34162e5ee43bb01f289eebc45fd3ea3e07f30be40dcf6635606540f912fe5c84d301e9f78e97dfe3ffe53e72547e50f3bcd7d4ebe5ab8da451a1989c469a0

                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i1padox2.0fc.ps1

                                                    Filesize

                                                    60B

                                                    MD5

                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                    SHA1

                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                    SHA256

                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                    SHA512

                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                    Filesize

                                                    479KB

                                                    MD5

                                                    09372174e83dbbf696ee732fd2e875bb

                                                    SHA1

                                                    ba360186ba650a769f9303f48b7200fb5eaccee1

                                                    SHA256

                                                    c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                    SHA512

                                                    b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                    Filesize

                                                    13.8MB

                                                    MD5

                                                    0a8747a2ac9ac08ae9508f36c6d75692

                                                    SHA1

                                                    b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                    SHA256

                                                    32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                    SHA512

                                                    59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                  • C:\Users\Admin\AppData\Roaming\1000026000\a5751c2930.exe

                                                    Filesize

                                                    1.7MB

                                                    MD5

                                                    ce4bfa9c358165bde9bb408a2cb57b89

                                                    SHA1

                                                    e7d7c6e20a558cdbb8ca0a8614bf48a1bdb60396

                                                    SHA256

                                                    8b715b6ede4282228d035a69684c3e67328cef609504a7353c5151aa8ffafef9

                                                    SHA512

                                                    3ace12ec036ff30834223176f3b8f917e62e853afb7cf7735d426be5cb2d02cfc39b0ce2879a162dcfb7f32003f7f954a81ad527e247a2b424dcc1a11af5f6f3

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\AlternateServices.bin

                                                    Filesize

                                                    25KB

                                                    MD5

                                                    f363f0e64e4916448267c110eb09d3d3

                                                    SHA1

                                                    04ef5124fede1394905b80363c7aaab4c10522ee

                                                    SHA256

                                                    cd9d73a926a67fa89acc413b8d8477c3c6bfd77a3629845247ff3623d7f7a0c2

                                                    SHA512

                                                    74f294ca62fc7b0dd2a22ef926a0b37770d2fa8ebd5b2ec5ba3624738c8ba25aa7d1c59e8e22983653a40917f9fe3de8acda1fdf38f429afd920abd85f57da4a

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\AlternateServices.bin

                                                    Filesize

                                                    8KB

                                                    MD5

                                                    6cca828b8fa731da7731f983e9c9652c

                                                    SHA1

                                                    83da3ffc800bdbcb52479316178999c7cee6a340

                                                    SHA256

                                                    36632989737dc020fba30fe3c79cdd4f8b577a2cffd62d8b242d17017b9cc1d6

                                                    SHA512

                                                    5a6f6d0e118418e6d2edd47a8a1ac7a952e888bbfb250cc7416decb0512592b6095d794e922fdc7eeb59c36f9d1ad1bab8ddab077bd835a3073ffa668478220c

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\AlternateServices.bin

                                                    Filesize

                                                    8KB

                                                    MD5

                                                    84481e8ad9a8a51404edf3337d8734f9

                                                    SHA1

                                                    c11e8d0ab0088ac5ed2fb032adb996515a4865dc

                                                    SHA256

                                                    f14e31364b6a27fe18da608f865da4a8c20ae8229376104c0e87d9a8b51b7f88

                                                    SHA512

                                                    68256cd2672800c296fae2f12f742c4690bcf8a0865bb4b126917ec2c3305dbe0bf2e3531773848daac7981c9c5129caf46db1e2c7bb8989e7499fa03ab125f8

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\AlternateServices.bin

                                                    Filesize

                                                    10KB

                                                    MD5

                                                    04517bf5eb491afca256d6be3598c7af

                                                    SHA1

                                                    51c65a20bb429769e4eefe59b073a039e81d8730

                                                    SHA256

                                                    72fb84b541b8ceab3bed25d65421981b6f4a7cd208dc47d42e79296d4c680421

                                                    SHA512

                                                    c20a532b1c140b9c2fbd1bd1cd3de08e13899f7bb49925a253ca0db59f24e862c1452a6209d7565412af18c9db746389a9c7bd4e33b52a7059ce0f4d0e45d5a7

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\AlternateServices.bin

                                                    Filesize

                                                    12KB

                                                    MD5

                                                    c249259719a6ea9bdcfa1b76e799d1df

                                                    SHA1

                                                    b0c34ed453d3af98c342e5509b7bfb5c5bef7519

                                                    SHA256

                                                    bfc7ca5d16a4a7c558afe492a0d5c673fd40c32d9855af10059043e276f57e91

                                                    SHA512

                                                    82aa70d16427976b42af5c3701d3302ec270fad4b5fa00151dc6675de331a3dcc77275e8d6a9350d5db0288224a035cdd3f791a130a7b0811cc3d6a73ea25bae

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\cookies.sqlite-wal

                                                    Filesize

                                                    384KB

                                                    MD5

                                                    a33c39f34f0384bb33ec6de1c6f7c127

                                                    SHA1

                                                    cbf4f0ef3ace010dcb34b83942234b38fa41eaa1

                                                    SHA256

                                                    78902dd8bf9cbf0a4717879a09ab7c19a46c7de87b8be1fbfa273eb96b5725c7

                                                    SHA512

                                                    9ca348ad33ba6aba8deb8b077dc178049410eb37c8858a9fd782efd4322b8019a3f0618bca52d444f72af566101892a239027aa781347750d31d594be1d8e9b8

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\db\data.safe.tmp

                                                    Filesize

                                                    25KB

                                                    MD5

                                                    867302073462877be6e6c861894b4ca1

                                                    SHA1

                                                    6aef51dbad5891c6971de96fd2d74116a3cc6ebd

                                                    SHA256

                                                    8a9937e27016e20c8d884acc610186287624de2bcc490d2c1cd23cb346805eba

                                                    SHA512

                                                    3cc239e6ab2d94ba6624b00fe0349fb0c54d7363f2d8f4868cc9dfacd708611268df9b32b0fdbb0fa44ffce78914bc0a6a1a699aa92fa2eec4515e0f1a50c611

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\db\data.safe.tmp

                                                    Filesize

                                                    25KB

                                                    MD5

                                                    fc07e7c3dcc348e6333a07204e8bfe3f

                                                    SHA1

                                                    6e207972158bc8c88984b2c6762dd84c8f45a5dd

                                                    SHA256

                                                    5d27a4881102b8e1707a47819441b6c0381b942013dfdbb3cf7c9d963e6d6c56

                                                    SHA512

                                                    22c8eabb8d0f0c39db414a411ae188ea39d8f4a169faa3ca34ed16fb8ac42ab839eae3db18dc91069c80610b647f9cdcb5772c12e1133dd82d2a1d76329bd1c0

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\db\data.safe.tmp

                                                    Filesize

                                                    25KB

                                                    MD5

                                                    fc2bf3edd7f91f5fb1f9e5a52283f71f

                                                    SHA1

                                                    9a43fa994d01fce9cf393dee7e00c3e66c0f2d04

                                                    SHA256

                                                    450310ec9922f2e1038f1626ef65904944dc5b0a40d7c56c462f10c19eb7768c

                                                    SHA512

                                                    0967356ebe8fa37287dfdcd94d53689c23ac0093215efe8651d329f99e209a9d45d6f576ffad266262ba6ab0899a23b9b60b33fcbad62ae7da30459bc9bb5f53

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\db\data.safe.tmp

                                                    Filesize

                                                    23KB

                                                    MD5

                                                    0e0fb76cc9782b3fb260177712fc9a3f

                                                    SHA1

                                                    e2b005bd7ee12d03381877645b178bab37330fff

                                                    SHA256

                                                    ec6e6fd39e9e2503c2d8e84bea7df84ca079312596b9d4875c8cc7a011bca0c5

                                                    SHA512

                                                    42e53de2120ccb6a97e01c5f094d4f353c6e6307b2b7ed36a9c96dcff207b4bdc17e7ac4d45c762fdc39abc0506e6330f51992a41813bd26b418957bfa9796e7

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\db\data.safe.tmp

                                                    Filesize

                                                    22KB

                                                    MD5

                                                    cbcd698d9b0f3eceb62e72cbe164e619

                                                    SHA1

                                                    82db01993f6ee0dedf2a84c685fd6a728ff49d69

                                                    SHA256

                                                    7acfad56a15bfb018897a2bcb7e092a6b6a8d6450554f276239ed9e2e2e4fd9d

                                                    SHA512

                                                    b2cc208cc6e5568a988331a4e5ebda4751b69223ce19c620397a7fa04435abe9c4a7d8703e633df454cac26057f313e68936944d3b77d480442389b952fab90c

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\db\data.safe.tmp

                                                    Filesize

                                                    22KB

                                                    MD5

                                                    82e27fa66a66a58a6c6d7069d62774ab

                                                    SHA1

                                                    f48acd1de626975bff1ffec9b31543e162cc0fd2

                                                    SHA256

                                                    0b159ab855bccc3ae50242c88e63c1337dad50c746647314d9adf5b76e3e822e

                                                    SHA512

                                                    5789fe854357606f77329862a00f72ca0dc7c37b874ce4ed71aa65944ec6096fd983f89f51788f002a87833a32233420221519930ff4865bb0298f78e3ab85c1

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\pending_pings\33c55f45-1b14-4e23-b396-d8ed978bec7c

                                                    Filesize

                                                    659B

                                                    MD5

                                                    2e6e28e3c46b133e2bb539f308de61b4

                                                    SHA1

                                                    18813f5559995e04a2b5fd1f92104d5874cb72df

                                                    SHA256

                                                    0d4c0b30dd01033957dfd834f96536eb0fe43724b6ca54c4db0f41bf5f913c5e

                                                    SHA512

                                                    cd31fad61282daa78ee8a31ad6e399bfbe4701af0ea34e5f20b94935a0f7de298412aa4aea72f7d1cf5c31be44d83b481ae9224a56c7443fd4d617e8b7cd1b3a

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\pending_pings\89a4cf8a-c957-4f68-8ee2-ce9d98c8d008

                                                    Filesize

                                                    982B

                                                    MD5

                                                    1476141249de872a48652235e506bb85

                                                    SHA1

                                                    2cc969916a4a9a67ae1226a815ce6aa31807dfa2

                                                    SHA256

                                                    eed1767dd9012d9795817a227f5db8d053da15c2d516e1fd0cc82755cde49897

                                                    SHA512

                                                    590109e8f73f80cc6fdf426a70978348d96c1e0e30f2ffb004abccbca082f7c4cdc8c24f59f5197312763ac0c92aaeab3c71aed78fb5ee69fb9db0385dfb42c1

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                                                    Filesize

                                                    1.1MB

                                                    MD5

                                                    842039753bf41fa5e11b3a1383061a87

                                                    SHA1

                                                    3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                    SHA256

                                                    d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                    SHA512

                                                    d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                                                    Filesize

                                                    116B

                                                    MD5

                                                    2a461e9eb87fd1955cea740a3444ee7a

                                                    SHA1

                                                    b10755914c713f5a4677494dbe8a686ed458c3c5

                                                    SHA256

                                                    4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                    SHA512

                                                    34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                                                    Filesize

                                                    372B

                                                    MD5

                                                    bf957ad58b55f64219ab3f793e374316

                                                    SHA1

                                                    a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                    SHA256

                                                    bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                    SHA512

                                                    79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                                                    Filesize

                                                    17.8MB

                                                    MD5

                                                    daf7ef3acccab478aaa7d6dc1c60f865

                                                    SHA1

                                                    f8246162b97ce4a945feced27b6ea114366ff2ad

                                                    SHA256

                                                    bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                    SHA512

                                                    5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\places.sqlite

                                                    Filesize

                                                    5.0MB

                                                    MD5

                                                    cda44dd6db7a03963f473fb083298d5c

                                                    SHA1

                                                    0ea5ebeb8fe50757c01230564f81c54ca4e9d3a9

                                                    SHA256

                                                    7bf14c8c32ffde277670af381522ca217fe189ce84fc54f9ad862cea8274118a

                                                    SHA512

                                                    b3c14ba0d9613d273d327f3739208d55cce10be0e6b885c32db4b54f74e2673f9c5300a196e3db7ced0a028957d69eefa72924254df01441e9542fb42291fb58

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\places.sqlite-wal

                                                    Filesize

                                                    2.2MB

                                                    MD5

                                                    cefa5a93a087155d4c5375af64c764bf

                                                    SHA1

                                                    6132a42cac1083343c64388b4d9b88ce708d99e7

                                                    SHA256

                                                    0d847b52ceda932c816e76c75afb69c05c732fe7012511549ea6d3f2508a575b

                                                    SHA512

                                                    91df295f2ef585b295d5457e45d7e92f402865eecb960219aa22e7049a5d438a08edb34be8312ea6b4fd373892c740386705af64cf4ddc4af82b02dd892bc6b2

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\prefs-1.js

                                                    Filesize

                                                    12KB

                                                    MD5

                                                    b16689eb426491acd98c0a578593f3de

                                                    SHA1

                                                    9a1a0abad8773ca362c50a45a45a93b909edfce7

                                                    SHA256

                                                    01d3c597b1ecb2825a32121cb2a97cff869e6aa5fa2300e5aa1e0208ed8ce00b

                                                    SHA512

                                                    3fa88efdd11327ec3fd5c6014b614c78154cb6bbcc230be6ea75d8e68cc19dec87778d5297fbb7dbf0a9a99a1bd10471514389e4b4395c8de70a755e1d40c4c1

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\prefs-1.js

                                                    Filesize

                                                    16KB

                                                    MD5

                                                    6dd916dbcde7dc9f4d869a172a37e1dc

                                                    SHA1

                                                    a0c5384f48341b1040bcbd3a9a32f957123421cb

                                                    SHA256

                                                    1b8bd020ec661583b40fb882d54a5405d732dffe61e06e58f24cecefb689c798

                                                    SHA512

                                                    3c329d43c34077d8f686d5d11cf5a3fb30dc7f6f63e4905186371cfa942489ef0bffbd9a52a5696b94d59040aba55a9f6deef372d7852ffd553c7a836d77400f

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\prefs.js

                                                    Filesize

                                                    11KB

                                                    MD5

                                                    642b928d2d7a8622ff4c23294f5f3431

                                                    SHA1

                                                    9bd34953566221a3a5bfc43107934964f0010a58

                                                    SHA256

                                                    ad03a1324ed81c4f44723127cf869a1b2143198f125c32d3d15dc7d2d4971ea9

                                                    SHA512

                                                    b4a101a81147c27fa9c5ba27508e8cb57f0c895af869fe04c44a8007637d2a661e34b284f00903fb35e55ad3272c59f3eb752cc495821f205b07e293af96a4bb

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\prefs.js

                                                    Filesize

                                                    11KB

                                                    MD5

                                                    7208f74d75109af5a875d216b7e9c985

                                                    SHA1

                                                    7a7932951fd257599274d5150bc5a5e0e21ed189

                                                    SHA256

                                                    9a6efeb13201c25ea5dee3d205731d87f218cf3b764ad3f25f03113277df01d7

                                                    SHA512

                                                    2f300ea9e8c5cc611a89322916d68ae2bb75083741abfdbc4647dc81a9caa8300e4af4056e87e27ba8b1443fe2cbcfc5b0c1f7ef09a0adeb45fa018d9076e96d

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\sessionstore-backups\recovery.baklz4

                                                    Filesize

                                                    1KB

                                                    MD5

                                                    823a3986e8663ddffed1354322edec29

                                                    SHA1

                                                    4de4c151eb066237724755e97768cf9663bcd1f0

                                                    SHA256

                                                    5b60cde4468b0be16f49a5749d45ada3be6cc1f1fcdc5d62025e1f1988a67214

                                                    SHA512

                                                    98bed3cfbd7ffbed3980f0b73ab87a86728ed94f3d6c0d5f5d2cdc0bff6aa3ee5e80b6ba3cddf9c221fa2f51aaacdaedb7f007e54f7ae4bd6881c216c4948668

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\sessionstore-backups\recovery.baklz4

                                                    Filesize

                                                    5KB

                                                    MD5

                                                    431f1c24a779ecf3e26b4c67055e3eb7

                                                    SHA1

                                                    d1567d487df9c21134bcdfb951d083b05d074626

                                                    SHA256

                                                    43abd99625652b73675a299c1cfb3742350c39debee698d43c9faf224aae89b1

                                                    SHA512

                                                    915d4120adcf3b9503a6764d8b424e70efde93746bc9baa6b1b46aad74c6073975b491ab3250ba1f70392f2384c11a642e217b3f7cdb941d777834db272062c7

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                                    Filesize

                                                    376KB

                                                    MD5

                                                    97e39a3bde05fdd6bd0194817342e49e

                                                    SHA1

                                                    75f63d9005f5ca6dd2ccbaed4003284b073b9497

                                                    SHA256

                                                    e8a7fb3c47a05f71f63d027f626df3bb597c7dc1bf96ec246ee5847b82b1f1d4

                                                    SHA512

                                                    4e634a745322274a29ed14f7176de1aef6d913b37c9f1ebf71e673c219b9572717d196a3c75bd485d458d8005c4e8d74eb61afe4d4efeed4947fc7073d546055

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                                    Filesize

                                                    1.4MB

                                                    MD5

                                                    960ed4d1ef786918d94476376aa03117

                                                    SHA1

                                                    32d5e0079aa8ff4c208b77a765afad66f864c4ac

                                                    SHA256

                                                    3bbb82b09211d284b3ad6bd270d7d40b16d203cc3ebd062f2b8b2b5bd7605723

                                                    SHA512

                                                    15e169b6fd86a174d1291308b72341e4c916e2d6cf1f1dd256bec959a8c8ebfca3b9a4e2962d56cbd2b80282ff86c1dfa3e2b33f549065039f3e5e71ef26c19c

                                                  • \??\pipe\LOCAL\crashpad_924_CJMSSXMATKBVBSNQ

                                                    MD5

                                                    d41d8cd98f00b204e9800998ecf8427e

                                                    SHA1

                                                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                    SHA256

                                                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                    SHA512

                                                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                  • memory/904-18-0x0000000000DE0000-0x0000000001292000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/904-4-0x0000000000DE0000-0x0000000001292000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/904-0-0x0000000000DE0000-0x0000000001292000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/904-3-0x0000000000DE0000-0x0000000001292000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/904-2-0x0000000000DE1000-0x0000000000E0F000-memory.dmp

                                                    Filesize

                                                    184KB

                                                  • memory/904-1-0x0000000077CE4000-0x0000000077CE6000-memory.dmp

                                                    Filesize

                                                    8KB

                                                  • memory/1220-80-0x0000000006480000-0x000000000649E000-memory.dmp

                                                    Filesize

                                                    120KB

                                                  • memory/1220-64-0x0000000002B60000-0x0000000002B96000-memory.dmp

                                                    Filesize

                                                    216KB

                                                  • memory/1220-65-0x0000000005680000-0x0000000005CA8000-memory.dmp

                                                    Filesize

                                                    6.2MB

                                                  • memory/1220-67-0x0000000005590000-0x00000000055B2000-memory.dmp

                                                    Filesize

                                                    136KB

                                                  • memory/1220-68-0x0000000005CB0000-0x0000000005D16000-memory.dmp

                                                    Filesize

                                                    408KB

                                                  • memory/1220-69-0x0000000005DD0000-0x0000000005E36000-memory.dmp

                                                    Filesize

                                                    408KB

                                                  • memory/1220-79-0x0000000005E40000-0x0000000006194000-memory.dmp

                                                    Filesize

                                                    3.3MB

                                                  • memory/1220-81-0x00000000064A0000-0x00000000064EC000-memory.dmp

                                                    Filesize

                                                    304KB

                                                  • memory/1220-100-0x0000000007790000-0x0000000007826000-memory.dmp

                                                    Filesize

                                                    600KB

                                                  • memory/1220-101-0x0000000006A30000-0x0000000006A4A000-memory.dmp

                                                    Filesize

                                                    104KB

                                                  • memory/1220-103-0x0000000007DE0000-0x0000000008384000-memory.dmp

                                                    Filesize

                                                    5.6MB

                                                  • memory/1220-102-0x0000000006A80000-0x0000000006AA2000-memory.dmp

                                                    Filesize

                                                    136KB

                                                  • memory/2580-3056-0x0000000000420000-0x00000000008D2000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/2580-3055-0x0000000000420000-0x00000000008D2000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/4256-2486-0x0000000000420000-0x00000000008D2000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/4256-2444-0x0000000000420000-0x00000000008D2000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/4504-56-0x00000000006F0000-0x0000000000D6F000-memory.dmp

                                                    Filesize

                                                    6.5MB

                                                  • memory/4504-671-0x00000000006F0000-0x0000000000D6F000-memory.dmp

                                                    Filesize

                                                    6.5MB

                                                  • memory/4504-657-0x00000000006F0000-0x0000000000D6F000-memory.dmp

                                                    Filesize

                                                    6.5MB

                                                  • memory/4504-658-0x00000000006F0000-0x0000000000D6F000-memory.dmp

                                                    Filesize

                                                    6.5MB

                                                  • memory/4632-474-0x0000000000F10000-0x000000000158F000-memory.dmp

                                                    Filesize

                                                    6.5MB

                                                  • memory/4632-47-0x0000000000F10000-0x000000000158F000-memory.dmp

                                                    Filesize

                                                    6.5MB

                                                  • memory/4632-666-0x0000000000F10000-0x000000000158F000-memory.dmp

                                                    Filesize

                                                    6.5MB

                                                  • memory/4632-37-0x0000000000F10000-0x000000000158F000-memory.dmp

                                                    Filesize

                                                    6.5MB

                                                  • memory/4632-550-0x0000000000F10000-0x000000000158F000-memory.dmp

                                                    Filesize

                                                    6.5MB

                                                  • memory/4632-623-0x0000000000F10000-0x000000000158F000-memory.dmp

                                                    Filesize

                                                    6.5MB

                                                  • memory/4632-84-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                    Filesize

                                                    972KB

                                                  • memory/4632-46-0x0000000000F11000-0x0000000000F25000-memory.dmp

                                                    Filesize

                                                    80KB

                                                  • memory/5080-21-0x0000000000420000-0x00000000008D2000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/5080-83-0x0000000000420000-0x00000000008D2000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/5080-20-0x0000000000420000-0x00000000008D2000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/5080-106-0x0000000000420000-0x00000000008D2000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/5080-2677-0x0000000000420000-0x00000000008D2000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/5080-3005-0x0000000000420000-0x00000000008D2000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/5080-3017-0x0000000000420000-0x00000000008D2000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/5080-700-0x0000000000420000-0x00000000008D2000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/5080-3052-0x0000000000420000-0x00000000008D2000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/5080-3042-0x0000000000420000-0x00000000008D2000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/5080-17-0x0000000000420000-0x00000000008D2000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/5080-1605-0x0000000000420000-0x00000000008D2000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/5080-66-0x0000000000420000-0x00000000008D2000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/5080-3053-0x0000000000420000-0x00000000008D2000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/5080-723-0x0000000000420000-0x00000000008D2000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/5080-473-0x0000000000420000-0x00000000008D2000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/5080-3057-0x0000000000420000-0x00000000008D2000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/5080-3058-0x0000000000420000-0x00000000008D2000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/5080-3067-0x0000000000420000-0x00000000008D2000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/5080-3074-0x0000000000420000-0x00000000008D2000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/5080-19-0x0000000000421000-0x000000000044F000-memory.dmp

                                                    Filesize

                                                    184KB

                                                  • memory/5080-55-0x0000000000420000-0x00000000008D2000-memory.dmp

                                                    Filesize

                                                    4.7MB