Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-09-2024 11:12

General

  • Target

    abe7e20ac9c138c3226eac7681fdf927f61e9267c8f3edd3bb181fe8a587e9e4.exe

  • Size

    1.8MB

  • MD5

    339004dd3f0e7689908bfe8f0f275de7

  • SHA1

    3e095a60342506e00a7bd7ab9001b4997105c7bb

  • SHA256

    abe7e20ac9c138c3226eac7681fdf927f61e9267c8f3edd3bb181fe8a587e9e4

  • SHA512

    f71822833f56fa77a9ac61a7e4803f58f5ea32f5f43264b260b171f8d1e541f8604989d1074a899d6b7923c9a6d667ce41528f17ffacd946ed85cc40b306157c

  • SSDEEP

    49152:DIjYAssbpJb5Sx9DwZ+OMKsOdeYWn63ZkQAkcoxNi:sjYAsopF56xwZ+O5Ne163Z5H

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

C2

http://185.215.113.103

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 16 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 44 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\abe7e20ac9c138c3226eac7681fdf927f61e9267c8f3edd3bb181fe8a587e9e4.exe
    "C:\Users\Admin\AppData\Local\Temp\abe7e20ac9c138c3226eac7681fdf927f61e9267c8f3edd3bb181fe8a587e9e4.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4356
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4444
      • C:\Users\Admin\AppData\Roaming\1000026000\2f82298c90.exe
        "C:\Users\Admin\AppData\Roaming\1000026000\2f82298c90.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:3652
      • C:\Users\Admin\AppData\Local\Temp\1000030001\c5815087ba.exe
        "C:\Users\Admin\AppData\Local\Temp\1000030001\c5815087ba.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4068
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2640
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start msedge https://www.youtube.com/account
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          PID:4052
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com/account
            5⤵
              PID:3252
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb1b5346f8,0x7ffb1b534708,0x7ffb1b534718
                6⤵
                  PID:4188
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,72401746978421112,15445046266234373474,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
                  6⤵
                    PID:1252
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,72401746978421112,15445046266234373474,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
                    6⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5332
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c start msedge https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                4⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                PID:2360
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings
                  5⤵
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:4552
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xd0,0x124,0x7ffb1b5346f8,0x7ffb1b534708,0x7ffb1b534718
                    6⤵
                      PID:1964
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,14850291081931037230,12825174762660473616,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
                      6⤵
                        PID:5912
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,14850291081931037230,12825174762660473616,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
                        6⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5924
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,14850291081931037230,12825174762660473616,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
                        6⤵
                          PID:5964
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,14850291081931037230,12825174762660473616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
                          6⤵
                            PID:5180
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,14850291081931037230,12825174762660473616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
                            6⤵
                              PID:3332
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,14850291081931037230,12825174762660473616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:1
                              6⤵
                                PID:6204
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,14850291081931037230,12825174762660473616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4348 /prefetch:1
                                6⤵
                                  PID:7016
                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,14850291081931037230,12825174762660473616,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 /prefetch:8
                                  6⤵
                                    PID:5768
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,14850291081931037230,12825174762660473616,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 /prefetch:8
                                    6⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:7156
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,14850291081931037230,12825174762660473616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
                                    6⤵
                                      PID:6312
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,14850291081931037230,12825174762660473616,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
                                      6⤵
                                        PID:6316
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,14850291081931037230,12825174762660473616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
                                        6⤵
                                          PID:6464
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,14850291081931037230,12825174762660473616,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
                                          6⤵
                                            PID:6628
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,14850291081931037230,12825174762660473616,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2504 /prefetch:2
                                            6⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:6176
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                        4⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:4396
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                          5⤵
                                          • Checks processor information in registry
                                          • Modifies registry class
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          • Suspicious use of SetWindowsHookEx
                                          • Suspicious use of WriteProcessMemory
                                          PID:4100
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1956 -parentBuildID 20240401114208 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a6ffc687-3d39-4af5-8708-e775187ce050} 4100 "\\.\pipe\gecko-crash-server-pipe.4100" gpu
                                            6⤵
                                              PID:4484
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2460 -parentBuildID 20240401114208 -prefsHandle 2428 -prefMapHandle 2424 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {169cf00b-7a3e-4a03-b574-7e7fc0feb3fb} 4100 "\\.\pipe\gecko-crash-server-pipe.4100" socket
                                              6⤵
                                                PID:872
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2988 -childID 1 -isForBrowser -prefsHandle 3412 -prefMapHandle 3060 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1016 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2c21ae0-a61a-44b4-97e9-6ceb1b571288} 4100 "\\.\pipe\gecko-crash-server-pipe.4100" tab
                                                6⤵
                                                  PID:3220
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3624 -childID 2 -isForBrowser -prefsHandle 3612 -prefMapHandle 3616 -prefsLen 22693 -prefMapSize 244658 -jsInitHandle 1016 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f7a468f5-ffc9-49d6-841c-7a0c94f8c6e5} 4100 "\\.\pipe\gecko-crash-server-pipe.4100" tab
                                                  6⤵
                                                    PID:1616
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3840 -childID 3 -isForBrowser -prefsHandle 4016 -prefMapHandle 4008 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1016 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d57322f2-961e-4251-b39f-467edc5dcddf} 4100 "\\.\pipe\gecko-crash-server-pipe.4100" tab
                                                    6⤵
                                                      PID:2360
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4888 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4892 -prefMapHandle 4880 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dbcd0302-17c2-4828-8169-db2226845a45} 4100 "\\.\pipe\gecko-crash-server-pipe.4100" utility
                                                      6⤵
                                                      • Checks processor information in registry
                                                      PID:5316
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5740 -childID 4 -isForBrowser -prefsHandle 5804 -prefMapHandle 5800 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1016 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9923fa73-0f27-4f14-bc3d-02191db62368} 4100 "\\.\pipe\gecko-crash-server-pipe.4100" tab
                                                      6⤵
                                                        PID:6644
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5928 -childID 5 -isForBrowser -prefsHandle 5936 -prefMapHandle 5704 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1016 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b57b0998-b687-432a-bc12-f3a9c75c5647} 4100 "\\.\pipe\gecko-crash-server-pipe.4100" tab
                                                        6⤵
                                                          PID:6656
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6104 -childID 6 -isForBrowser -prefsHandle 6112 -prefMapHandle 6116 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1016 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d258f5c3-23c4-49f8-a6ce-6996ef63c89c} 4100 "\\.\pipe\gecko-crash-server-pipe.4100" tab
                                                          6⤵
                                                            PID:6668
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                        4⤵
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2516
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                          5⤵
                                                          • Checks processor information in registry
                                                          PID:4060
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:5656
                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                    1⤵
                                                      PID:6404
                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      1⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:3596
                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                      1⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:6200

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\ProgramData\mozglue.dll

                                                      Filesize

                                                      593KB

                                                      MD5

                                                      c8fd9be83bc728cc04beffafc2907fe9

                                                      SHA1

                                                      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                      SHA256

                                                      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                      SHA512

                                                      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                    • C:\ProgramData\nss3.dll

                                                      Filesize

                                                      2.0MB

                                                      MD5

                                                      1cc453cdf74f31e4d913ff9c10acdde2

                                                      SHA1

                                                      6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                      SHA256

                                                      ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                      SHA512

                                                      dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      2dc1a9f2f3f8c3cfe51bb29b078166c5

                                                      SHA1

                                                      eaf3c3dad3c8dc6f18dc3e055b415da78b704402

                                                      SHA256

                                                      dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

                                                      SHA512

                                                      682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      e4f80e7950cbd3bb11257d2000cb885e

                                                      SHA1

                                                      10ac643904d539042d8f7aa4a312b13ec2106035

                                                      SHA256

                                                      1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

                                                      SHA512

                                                      2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                      Filesize

                                                      528B

                                                      MD5

                                                      9ae5fb810565076801fd189dac5804e7

                                                      SHA1

                                                      c90180182b66a463184afe6f766d69ed564ec73b

                                                      SHA256

                                                      eab701c086b3e4ad2c34731244e324c5ff19c62ff2b3a052edfa212a73b0d41c

                                                      SHA512

                                                      2618be5c8a4c6c1d11b516c9258a15c2d18ce45ccef51b53fbcece8e44f93edd40951d85276c21786faec59ea80dcd10d47cbfe4f144c793dd482ed8d81ab0be

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      15b69537e992ffdd355e9f7e0c5b8ffd

                                                      SHA1

                                                      bc00db725df7a80deb51933a0b9840b6496b111f

                                                      SHA256

                                                      6cdb4a26ee23b2679bcbd98d97402d65bb61304cea4d832527879c30081924e3

                                                      SHA512

                                                      2b5e9aad54e1ea371e2dcbc26f31c093441478d96800ea2d69ef59e68734e0a3e33a8b0dd8fe5014d3a8d613dfb2b059843a1109589f8a92e93fb88c1f83def8

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      fe48811318a60e9097e0891ca8dfd2e1

                                                      SHA1

                                                      45d44775485b0c9dde6199b05a27b7802de32b23

                                                      SHA256

                                                      0152b1d37e22e21635896c92f36c3b7d98ccfe73090decbab0475d45fcf57d4f

                                                      SHA512

                                                      7e2867074f0961fefcaadaf04b5b39cbe4078dae358b819e0092ca7261102612b332a13f0d4fc3e5b652c01d942c4b766bcad3e48205da8d03ede3e0eaeed408

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                      Filesize

                                                      111B

                                                      MD5

                                                      285252a2f6327d41eab203dc2f402c67

                                                      SHA1

                                                      acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                      SHA256

                                                      5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                      SHA512

                                                      11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      e6c6ec7bbed5b4b21d78934aa09fe792

                                                      SHA1

                                                      1470baeff48638ffcc7a6fd965c2ebddfb9abe50

                                                      SHA256

                                                      0bd0a4ed3c18678ae307ec1f0acacf910e8b5550f6973d23c21ff8bb01d75d67

                                                      SHA512

                                                      a02f5e8d7d2885a5a9d0c9fb94b28ddb914e3c7cf597eb03bb0bf2b7de59ed9d42908f69adb70b7ab98d83af27ff3e6c7e2a4ec39133b54a98eb5672c63952fa

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      7KB

                                                      MD5

                                                      c2a7fef2784c29efd1bfb17536c724c5

                                                      SHA1

                                                      672409e5fe79e29191d02219a3726fac30e9c487

                                                      SHA256

                                                      da1a08e098e5adade2a2264496cc8daafd2ec895b65376c58cfb62cedfb2183a

                                                      SHA512

                                                      5172bfa7c843ff247c0acfac938cf6ad21fde4c7d94f668240a8d4afe4fb22e8237fe38124c3cb2417fc5cf15a404ea0aa3a71a9f0661febaca159de057983bb

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                      Filesize

                                                      539B

                                                      MD5

                                                      c44655fc188d1969ebff61e535721bfb

                                                      SHA1

                                                      74eb12925264d32e01b1d687cddd61656c99874d

                                                      SHA256

                                                      c9ffc28410b168db1edaab036e9c470942887c3c543a8c95fc5747115869818c

                                                      SHA512

                                                      ec06013445775f0cf2f6072b0e28e59765eaa52c60f0758b535c4c08bb0e3663ec7a3e9bea3334626173d22416136ab6b7b143f15acc43d44d7ab01beb2f8ac5

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59e7f5.TMP

                                                      Filesize

                                                      539B

                                                      MD5

                                                      bddda6a5b2e93302a1322215a3de9cea

                                                      SHA1

                                                      b9fe421236e8eea1298ffeddc51b29169b98302b

                                                      SHA256

                                                      69eb0a5b4e4fc3013b9e3831f57ee854ea7a0f36d1a8d90988e10b14d2a1a0dc

                                                      SHA512

                                                      9ff8c4f415184e1588bdd19d6169a7fc5b677e594180dcae01024d6d24786dc3a6aa449a39565555d47af9d765cb23975914626b213485ba6b297c176c07cd76

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                      Filesize

                                                      16B

                                                      MD5

                                                      6752a1d65b201c13b62ea44016eb221f

                                                      SHA1

                                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                      SHA256

                                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                      SHA512

                                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      8KB

                                                      MD5

                                                      fd42c9c6132544f42cb275b7f0239cea

                                                      SHA1

                                                      d506aca29bb209f9590d9804fb98264846ef6927

                                                      SHA256

                                                      6c6b7b8ada54afe8fc15f19462e9275baaf6692942e795e0a16657aff2668de1

                                                      SHA512

                                                      ad4a384eb21036ce850f7d11bba6b9f4f4111e59cf8e4ca42f74808f8fcf6dcbf19ceaddcc2004420a18f47461500aa414a274f51154206fa2cffa2f933b94b7

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      10KB

                                                      MD5

                                                      97aba7696d6a046e007113520370ca19

                                                      SHA1

                                                      2a9e2cf9f6ad18f92f44a52a169d597d15a1c7e3

                                                      SHA256

                                                      318b0f04633d6b3f087619a490bf3843d851877e508b260648d8530b5ac3e3ce

                                                      SHA512

                                                      c1aed0165a4d509c6b9646c5015be65475f5337c4db200d24274ff64d7834bcc011cf95be7e4dc35d159e415664ab8962ed76be8c5c1a18d3597040a49db63cf

                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F

                                                      Filesize

                                                      13KB

                                                      MD5

                                                      f59ed6c03d82ef4a6a9e4a5858023356

                                                      SHA1

                                                      e507568282ff1018719c8e234682ed8e7d622e2c

                                                      SHA256

                                                      8bf994ed3a8853b09241a135c747b91a03ee17e849386aa6e99529a47f834c57

                                                      SHA512

                                                      d61aa6968634d19cbd90c34ab67ec8f88c4e148ea5f6b16c66f94fb8a79e093c1352226c9d194f18befb193e9435646465782cb9ba3ed93c604fa2fc42030fb3

                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                                                      Filesize

                                                      1.8MB

                                                      MD5

                                                      339004dd3f0e7689908bfe8f0f275de7

                                                      SHA1

                                                      3e095a60342506e00a7bd7ab9001b4997105c7bb

                                                      SHA256

                                                      abe7e20ac9c138c3226eac7681fdf927f61e9267c8f3edd3bb181fe8a587e9e4

                                                      SHA512

                                                      f71822833f56fa77a9ac61a7e4803f58f5ea32f5f43264b260b171f8d1e541f8604989d1074a899d6b7923c9a6d667ce41528f17ffacd946ed85cc40b306157c

                                                    • C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1

                                                      Filesize

                                                      2KB

                                                      MD5

                                                      e05e8f072b373beafe27cc11d85f947c

                                                      SHA1

                                                      1d6daeb98893e8122b8b69287ebd9d43f3c6138e

                                                      SHA256

                                                      717c09427fa5754ba92f92961545534048d0a76528c2e95c4d5ec6cef47c612f

                                                      SHA512

                                                      b3e34162e5ee43bb01f289eebc45fd3ea3e07f30be40dcf6635606540f912fe5c84d301e9f78e97dfe3ffe53e72547e50f3bcd7d4ebe5ab8da451a1989c469a0

                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2z30fqkb.2gx.ps1

                                                      Filesize

                                                      60B

                                                      MD5

                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                      SHA1

                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                      SHA256

                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                      SHA512

                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                      Filesize

                                                      479KB

                                                      MD5

                                                      09372174e83dbbf696ee732fd2e875bb

                                                      SHA1

                                                      ba360186ba650a769f9303f48b7200fb5eaccee1

                                                      SHA256

                                                      c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                      SHA512

                                                      b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                      Filesize

                                                      13.8MB

                                                      MD5

                                                      0a8747a2ac9ac08ae9508f36c6d75692

                                                      SHA1

                                                      b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                      SHA256

                                                      32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                      SHA512

                                                      59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                    • C:\Users\Admin\AppData\Roaming\1000026000\2f82298c90.exe

                                                      Filesize

                                                      1.7MB

                                                      MD5

                                                      250051046eae3713ed1af118169d9227

                                                      SHA1

                                                      66ecbbeffdbb6bae912fc9f21b52faeac7b73d49

                                                      SHA256

                                                      c1d2816e557482077a88b8e23581cd82a92dfca70fd1e7ceaec4ba3adbd7d136

                                                      SHA512

                                                      a9a49aaf7e56466ec9cbdf86564ba5ad875d8233f12b26c718dc163dfb7d9e139891e5a422eca933e41c3bc19d5dc62d47606e23019fb0cce8f281a981a82d1e

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\AlternateServices.bin

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      b5b38f7e1caf375d2437795097b7aa99

                                                      SHA1

                                                      7188f76a4bcd25772f3412a8911779980724bd3a

                                                      SHA256

                                                      92756df281539671fcc60dbefed89e98324cf53b4bf04222676b7b40bf1e4392

                                                      SHA512

                                                      687097653f6287ba01d1c29b1308ad44556bc652b95b1c86ada142c0290fa37489e39ea1480c3ba2558d1a785746cd193cf6083b5956758ff6135d94de6d9cf5

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\AlternateServices.bin

                                                      Filesize

                                                      25KB

                                                      MD5

                                                      039dbbcbcbb398212c4d95245a8d4b4d

                                                      SHA1

                                                      efacf1ea072e5735c0c6251ce5d6166ec42b52be

                                                      SHA256

                                                      ed86f3e01171641d3120828dd7d72e4340a5761021c5784590f78f1f17fe1b66

                                                      SHA512

                                                      54be552920f90380b8e705e9b55507dc88815a19a058f134b493e4627dfdd90d9bf447e270e42c17dd71ecccf766983b67a8284aa54eab3df8a45f5070b12e11

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\AlternateServices.bin

                                                      Filesize

                                                      8KB

                                                      MD5

                                                      1153dc4f8e25574a0d788972a56c7485

                                                      SHA1

                                                      0e8b3866627b543af89f46c0fa8e51617702802d

                                                      SHA256

                                                      47b9c827da519b02dbd42d0e67ee8c098c972f5c564419fe232b03ac542cb268

                                                      SHA512

                                                      364458ef64deb2db98a8e924ebf8e8d46d7abeef5dfc0e1c79593d989f054c244a8ad9bb51b4689c4b4c1a06faafcff24cf3837518b07c672996e1372b842947

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\AlternateServices.bin

                                                      Filesize

                                                      12KB

                                                      MD5

                                                      26f4ebbbec6d65b12e0d126580a89fda

                                                      SHA1

                                                      4d7a3b361240174c326ba6e9aebacecc2f330f90

                                                      SHA256

                                                      b23c040e7ef5d2a510d274b1057661fd1119103daef802db1f2b90562bf3e8e1

                                                      SHA512

                                                      546bc5564279f7b179433a3b1d739bb575a657df173c916839947087594514dec8f3d76ee2978bf9b32a3c1cde54297c03c52e383b05f40adbc281853701cfc6

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\AlternateServices.bin

                                                      Filesize

                                                      17KB

                                                      MD5

                                                      e09f9ab171dc7f851c0389fb0cbd34ab

                                                      SHA1

                                                      eb950bf5d50501a9f9ae62048d5e99bca889bf48

                                                      SHA256

                                                      b20775e7fa279c171557fbbb03363e0eb8c9965feb7183afe093388629c1c595

                                                      SHA512

                                                      55a65a53a37b06d4001ff15f08840d5de50e72a0710638c5399e1d961ec5e0275da04999e520a8f5670e9843047afed23d71daaf27025d72be0541f45e310478

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\AlternateServices.bin

                                                      Filesize

                                                      21KB

                                                      MD5

                                                      9bcd42f570d7ccf63251c01a34586e5e

                                                      SHA1

                                                      bade4352229b0f70020a9bc4fc971f4982a63c2a

                                                      SHA256

                                                      a8114e702f955c0993bd5e3c2d56f34304f33abf8103894d0621c5823fbd79d2

                                                      SHA512

                                                      0fb0cd2503fb375a40ea4e836892c647f162c49c7e165b6c7ed5a03e8991e8182954d09a1be45517ab384bbaf5e803318c72d1dff9593d596321afc5c4e4c6ba

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\AlternateServices.bin

                                                      Filesize

                                                      23KB

                                                      MD5

                                                      c4d922301db4d829db2697e515460c15

                                                      SHA1

                                                      dd6de2e4c0556f2d6820d326728c430fab04b5dc

                                                      SHA256

                                                      c640b669577953205bbfe14be9a5ce74056edc05512d2c54194810083ff150c7

                                                      SHA512

                                                      3f3bb0bd04cf79995908b4f7daa7b03daf171d3cab5f1ede70469d9866eb326c22bf4e4ea2536f291c0f4debaac2e70a8ab75e2b6e3768b5c59e2e2b20e28489

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\cookies.sqlite-wal

                                                      Filesize

                                                      448KB

                                                      MD5

                                                      6b1723009ab16e1c078d462c3e3cb26b

                                                      SHA1

                                                      824bc50bc199043a4f38995f223c0f91556e00b3

                                                      SHA256

                                                      53e39caf6718b9274ca909bfa1fcefb306f4ab3d633b6ca789d482e0fe4fed1b

                                                      SHA512

                                                      17f8c5d2533a92a7c8af2f8067cddd5e0409d01522c988987a6f5510e5aeb4ebd3c21e7c18c6b1c055508525d49fdff3272b4dd44cea7d36851fdedb42180c8a

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      16KB

                                                      MD5

                                                      df7cfaeca1c96ea0ca63bbf2b3a42ca1

                                                      SHA1

                                                      ef947d88bdce996927a551611f5b59977d05907b

                                                      SHA256

                                                      ce9f47302570b484d9649d909454f038a93dca56b9767e7b5914272a28ce8702

                                                      SHA512

                                                      c73be37f42e5e5764670580af8756bdff8d2f2dfc5269c5417294c6f2764753baffe1c79aa2c4b357ea88faaf079fcd0335914bcc687995a834f744793d2cc91

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      16KB

                                                      MD5

                                                      5b113fbc6f8af2806ae8b457a14809a4

                                                      SHA1

                                                      6d43ba8fda5c1d1c04d62bffd49a4b5ee6f7b3eb

                                                      SHA256

                                                      ae0c3e3bd36d044f1e438bb99a60c1f05ccabc1fd5957b955443ac0927f2d2ed

                                                      SHA512

                                                      48331c824b18e4613c087d7a604a4d33011d93a1e53ed16b92136907a6f563ab72b41e2609f0f7f72c5041e931ea9a10adadb1efa2329a381840cc0ab7bbf439

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      e2c89c254781ffdcf83642da3a8962dc

                                                      SHA1

                                                      598db1888c2401d0cb0827c12328edd8f1e8bf87

                                                      SHA256

                                                      38b6c899eb02afa05103acefd2264aefff566f885f31f4719eb6596b53a7063e

                                                      SHA512

                                                      a8bba6c075b7b5f034b1d7269d52c95d82251c77049c660de4d41d31d450589c62ec561aa067e9b663eb4a8487475592431d603c1f29ffabc4fbf8ed82c3b9ce

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      bd845dc753e5cd40dceeaa03e3368ae8

                                                      SHA1

                                                      a4f18117dd968fd523c40402efcc67eb6972182f

                                                      SHA256

                                                      211d910b7ca2ff92147397b1f0294c8e5bf689b814be06a2b54ed401631dbc67

                                                      SHA512

                                                      4e7767c53bc3b1515efa1cf1807e24a921c214a20a0a4fc5f6d80cdb13a423d111570de46ee1f750052874096005f8115c972c1a925c8619c8265916c337638f

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\pending_pings\00048981-8b46-42fe-8ee8-62066ae9c4fd

                                                      Filesize

                                                      24KB

                                                      MD5

                                                      841fff2680dfd9145cc1584b1a42d995

                                                      SHA1

                                                      d32cbd8dcfaf6988061b1054149b167b9246a1a4

                                                      SHA256

                                                      d31497652f95122eb07dc07cc3bfdce8b37e651f14620868c21a4231226351af

                                                      SHA512

                                                      c359414edf57844fa245a53090e6619749ea965a30fec052a85c7fb1caed4b6f2cfe1ed3ec3b4f39417934e20b588064a2f6e70c6322542b78b679210166be24

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\pending_pings\50aacc54-322f-44aa-9d0f-887da58863b1

                                                      Filesize

                                                      671B

                                                      MD5

                                                      c4a0eecd84537bb04fb7e190ee08f2a3

                                                      SHA1

                                                      a1cc96ceaf3030eb42e96c3bbe5580c6e5f13807

                                                      SHA256

                                                      50c8301a17ebb77c8491e0d3e1a573be9d3929df2728642600dcb52236e03918

                                                      SHA512

                                                      b9dff8723145025a00f3934a34d5a855d99d45a127c5536f0ea9c10904232a0528ded4ce9de6681cbeebe63f2ebeef37d659c2860a43500ff69d4af6f4c40b7b

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\pending_pings\9715bd80-9eb0-4a61-b986-6a0d2371faa4

                                                      Filesize

                                                      982B

                                                      MD5

                                                      f724d768fc2e4cfb8419d77825b5e519

                                                      SHA1

                                                      8a5ef89db924fcfbde0441e10ff519276a703c2b

                                                      SHA256

                                                      c877faaaba9f2413b1ff624a540f548f3278620372bfe9602cc60668bb1b4264

                                                      SHA512

                                                      da81fa7cd975fecd0596c1dd2bed867b96d287ac0c69669bccd22f8bddab554ddbe367b717924009108f222e9819579cf4274c8627d290e9585b46cd93bbc05b

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                                                      Filesize

                                                      1.1MB

                                                      MD5

                                                      842039753bf41fa5e11b3a1383061a87

                                                      SHA1

                                                      3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                      SHA256

                                                      d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                      SHA512

                                                      d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                                                      Filesize

                                                      116B

                                                      MD5

                                                      2a461e9eb87fd1955cea740a3444ee7a

                                                      SHA1

                                                      b10755914c713f5a4677494dbe8a686ed458c3c5

                                                      SHA256

                                                      4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                      SHA512

                                                      34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                                                      Filesize

                                                      372B

                                                      MD5

                                                      bf957ad58b55f64219ab3f793e374316

                                                      SHA1

                                                      a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                      SHA256

                                                      bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                      SHA512

                                                      79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                                                      Filesize

                                                      17.8MB

                                                      MD5

                                                      daf7ef3acccab478aaa7d6dc1c60f865

                                                      SHA1

                                                      f8246162b97ce4a945feced27b6ea114366ff2ad

                                                      SHA256

                                                      bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                      SHA512

                                                      5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\places.sqlite

                                                      Filesize

                                                      5.0MB

                                                      MD5

                                                      4681909ea2b4a77e53fd185e4a838e88

                                                      SHA1

                                                      db809dd699853b6e1ae70eb5111e844fe77d5e3e

                                                      SHA256

                                                      ed4e88b630da59bfe6f0989e5a2c5320a5da2147226f2ef1a49605ce6e858f4d

                                                      SHA512

                                                      c8e1fc5bbcb98fdaf37ab16dd771e8b955303dbb58be342823e54e0944f0c0a459fc7bdaa61abd50d1f3962ad68a427ce02873a634b3c9d6755a08eb7a23305e

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\places.sqlite-wal

                                                      Filesize

                                                      2.2MB

                                                      MD5

                                                      31c480d2f970d812dee332e478c2e7f8

                                                      SHA1

                                                      c636b61f3bd14227191956f513141d731c404933

                                                      SHA256

                                                      dba0ecaac2a7acf4d340f342b9dcfd4ffbe8a5964a1cf35ee293b971e8939bac

                                                      SHA512

                                                      76c193ffbf696c9ad3c80ae69686aec48e163192d5299345a0a6709ac1c3a70ac4a590268ad4ccca7905338ece3800b16a0d698bac394919b4df975652e3dbcc

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\prefs-1.js

                                                      Filesize

                                                      11KB

                                                      MD5

                                                      8ac51d0d3ceaae70b571437d26bca243

                                                      SHA1

                                                      def7d6f5995fc8c2151241f6a6f0b722a4e0e055

                                                      SHA256

                                                      39f0451cf5aa5d802eb3eae9fbbf7d93058bb25a0595c78d38b562f8ce34883a

                                                      SHA512

                                                      16a0146df023d3a0684c77834cf9810323a95c0be1876262813592dfaa67fb63bad117792047bb55dd5141fe0a507df0eca353555041a8829ea005ca96e42641

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\prefs-1.js

                                                      Filesize

                                                      12KB

                                                      MD5

                                                      219931d4629e3e6da8da1c894c79bd53

                                                      SHA1

                                                      18928077580fe9852b781a4507d6ad91980e2cce

                                                      SHA256

                                                      af7fde9f09ca26d9db23cdd81ee9c0827fa04c595be11bb8564e0f1f409e4e70

                                                      SHA512

                                                      753b13609833fce6a039ef5ac0e0f031821201b3928551d554c7f80afe7e23e450501c66b4547e9a874cd68060a7a9020a3052373b5a134d31054f8e0a6b1691

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\prefs-1.js

                                                      Filesize

                                                      15KB

                                                      MD5

                                                      7e6a17c556e176c81bbc8c932c152d9c

                                                      SHA1

                                                      80e6cc1cefa4c1798102b2d62a333f1a85fd1d71

                                                      SHA256

                                                      012dbc791837b041e8f4ef91c0692fe880860c1a243fa8ff4b2c979932e2ba57

                                                      SHA512

                                                      5887affa06093b3c5e8765bf7f17b5f7bf3e0bffa508f90b187b43869165fee0929b9ae0a000b5bfef7314749307dcec404abdd72112ef45e4308078ca5de93b

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\prefs.js

                                                      Filesize

                                                      11KB

                                                      MD5

                                                      6126ccd9a6ae4dbcbf226e01ac0fb3c2

                                                      SHA1

                                                      6dd7250edf8a6910d024e582e09f088674e94413

                                                      SHA256

                                                      ff203c4ebbdb6c2c3f006133980ce41339ec632da7087e29fe55673dd177a3f7

                                                      SHA512

                                                      9d64ca1a8ef6fb15409b96564364c591e18615ecd4642f80562ee8b637ab732571430ccd139bef9b7314edc255b6ab05090895896c1a39f119770d89e9d023a6

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\sessionstore-backups\recovery.baklz4

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      852ee3b90cb4f6534cf1ec3ebbddb6ac

                                                      SHA1

                                                      b793d90dec154765a2d122db50b3f2ec4cc7e61b

                                                      SHA256

                                                      827a993a6f135f89a2ec0b17fbc569d3c9028c18c6e960d66dda076042b9e3e2

                                                      SHA512

                                                      8fff3a2c12a7e04df1166e68483de45342df345b78c95b58a8016760281ba4da3a5369f794bc377ee8fd15c5d64e1657fb1a6c18a5a3ea3a943100d336a30e61

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\sessionstore-backups\recovery.baklz4

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      86b2964830f23c3e12c75eb12b082a86

                                                      SHA1

                                                      2d667a328f8018d559eb2fb8c0fea9247590d6df

                                                      SHA256

                                                      5d7844ca034e23dc3b0d5511a2c6d3231da1fce9a80c6b0cbc0c02e7cf69c4bb

                                                      SHA512

                                                      477ef136ef1bec77fa048f092925145a6fed9854d3f7b59fa6c135bea91399568ec95a69ca36dd3645dbfd5dca3724cd4ec9cfb94c5cce37d5669afeda1e0119

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                                      Filesize

                                                      2.2MB

                                                      MD5

                                                      76fbb4da7662c58855c4fc6f0f71335c

                                                      SHA1

                                                      07227c781a542e790d635510c4a93550b46ec904

                                                      SHA256

                                                      75a53cace836881b35c3a04d3b572e20e4cae994e6e6d01305094f378d6107e1

                                                      SHA512

                                                      71954271696b2097f6f3b707973351912ae6ba955b844b8c8faac35421b88b355ca1f48315993ea411e3d18d005274e70ea928b3bf54f898d408afdf15797630

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                                      Filesize

                                                      376KB

                                                      MD5

                                                      97e39a3bde05fdd6bd0194817342e49e

                                                      SHA1

                                                      75f63d9005f5ca6dd2ccbaed4003284b073b9497

                                                      SHA256

                                                      e8a7fb3c47a05f71f63d027f626df3bb597c7dc1bf96ec246ee5847b82b1f1d4

                                                      SHA512

                                                      4e634a745322274a29ed14f7176de1aef6d913b37c9f1ebf71e673c219b9572717d196a3c75bd485d458d8005c4e8d74eb61afe4d4efeed4947fc7073d546055

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                                      Filesize

                                                      1.4MB

                                                      MD5

                                                      960ed4d1ef786918d94476376aa03117

                                                      SHA1

                                                      32d5e0079aa8ff4c208b77a765afad66f864c4ac

                                                      SHA256

                                                      3bbb82b09211d284b3ad6bd270d7d40b16d203cc3ebd062f2b8b2b5bd7605723

                                                      SHA512

                                                      15e169b6fd86a174d1291308b72341e4c916e2d6cf1f1dd256bec959a8c8ebfca3b9a4e2962d56cbd2b80282ff86c1dfa3e2b33f549065039f3e5e71ef26c19c

                                                    • \??\pipe\LOCAL\crashpad_4552_ZEQKCSAFLGAZTIAA

                                                      MD5

                                                      d41d8cd98f00b204e9800998ecf8427e

                                                      SHA1

                                                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                      SHA256

                                                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                      SHA512

                                                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                    • memory/2640-80-0x0000000006510000-0x000000000652A000-memory.dmp

                                                      Filesize

                                                      104KB

                                                    • memory/2640-64-0x0000000005910000-0x0000000005976000-memory.dmp

                                                      Filesize

                                                      408KB

                                                    • memory/2640-61-0x0000000002700000-0x0000000002736000-memory.dmp

                                                      Filesize

                                                      216KB

                                                    • memory/2640-62-0x0000000005230000-0x0000000005858000-memory.dmp

                                                      Filesize

                                                      6.2MB

                                                    • memory/2640-63-0x0000000005140000-0x0000000005162000-memory.dmp

                                                      Filesize

                                                      136KB

                                                    • memory/2640-77-0x0000000006010000-0x000000000605C000-memory.dmp

                                                      Filesize

                                                      304KB

                                                    • memory/2640-76-0x0000000005FD0000-0x0000000005FEE000-memory.dmp

                                                      Filesize

                                                      120KB

                                                    • memory/2640-79-0x0000000007380000-0x0000000007416000-memory.dmp

                                                      Filesize

                                                      600KB

                                                    • memory/2640-65-0x0000000005980000-0x00000000059E6000-memory.dmp

                                                      Filesize

                                                      408KB

                                                    • memory/2640-82-0x00000000079D0000-0x0000000007F74000-memory.dmp

                                                      Filesize

                                                      5.6MB

                                                    • memory/2640-75-0x00000000059F0000-0x0000000005D44000-memory.dmp

                                                      Filesize

                                                      3.3MB

                                                    • memory/2640-81-0x00000000065A0000-0x00000000065C2000-memory.dmp

                                                      Filesize

                                                      136KB

                                                    • memory/3596-855-0x0000000000CE0000-0x000000000119F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/3596-877-0x0000000000CE0000-0x000000000119F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/3652-84-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                      Filesize

                                                      972KB

                                                    • memory/3652-631-0x0000000000DC0000-0x000000000143F000-memory.dmp

                                                      Filesize

                                                      6.5MB

                                                    • memory/3652-36-0x0000000000DC0000-0x000000000143F000-memory.dmp

                                                      Filesize

                                                      6.5MB

                                                    • memory/3652-629-0x0000000000DC0000-0x000000000143F000-memory.dmp

                                                      Filesize

                                                      6.5MB

                                                    • memory/3652-712-0x0000000000DC0000-0x000000000143F000-memory.dmp

                                                      Filesize

                                                      6.5MB

                                                    • memory/4068-739-0x0000000000730000-0x0000000000DAF000-memory.dmp

                                                      Filesize

                                                      6.5MB

                                                    • memory/4068-630-0x0000000000730000-0x0000000000DAF000-memory.dmp

                                                      Filesize

                                                      6.5MB

                                                    • memory/4068-53-0x0000000000730000-0x0000000000DAF000-memory.dmp

                                                      Filesize

                                                      6.5MB

                                                    • memory/4356-17-0x0000000000B50000-0x000000000100F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4356-2-0x0000000000B51000-0x0000000000B7F000-memory.dmp

                                                      Filesize

                                                      184KB

                                                    • memory/4356-3-0x0000000000B50000-0x000000000100F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4356-1-0x0000000077654000-0x0000000077656000-memory.dmp

                                                      Filesize

                                                      8KB

                                                    • memory/4356-0-0x0000000000B50000-0x000000000100F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4356-4-0x0000000000B50000-0x000000000100F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4444-754-0x0000000000CE0000-0x000000000119F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4444-2968-0x0000000000CE0000-0x000000000119F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4444-1123-0x0000000000CE0000-0x000000000119F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4444-18-0x0000000000CE0000-0x000000000119F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4444-1517-0x0000000000CE0000-0x000000000119F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4444-2058-0x0000000000CE0000-0x000000000119F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4444-2601-0x0000000000CE0000-0x000000000119F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4444-20-0x0000000000CE0000-0x000000000119F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4444-21-0x0000000000CE0000-0x000000000119F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4444-2950-0x0000000000CE0000-0x000000000119F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4444-2953-0x0000000000CE0000-0x000000000119F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4444-480-0x0000000000CE0000-0x000000000119F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4444-337-0x0000000000CE0000-0x000000000119F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4444-2957-0x0000000000CE0000-0x000000000119F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4444-2958-0x0000000000CE0000-0x000000000119F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4444-2959-0x0000000000CE0000-0x000000000119F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4444-19-0x0000000000CE1000-0x0000000000D0F000-memory.dmp

                                                      Filesize

                                                      184KB

                                                    • memory/4444-2975-0x0000000000CE0000-0x000000000119F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/4444-729-0x0000000000CE0000-0x000000000119F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/6200-2956-0x0000000000CE0000-0x000000000119F000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/6200-2955-0x0000000000CE0000-0x000000000119F000-memory.dmp

                                                      Filesize

                                                      4.7MB