Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-09-2024 14:55

General

  • Target

    416f915fb3b582641972ea178d5b5e55019589fce18916218b5ae4cf8db850ef.exe

  • Size

    1.8MB

  • MD5

    ccf7de51b317996803c0ce2b2643db99

  • SHA1

    41714678c993ef55bc0593383b7eff9e8b43bfb3

  • SHA256

    416f915fb3b582641972ea178d5b5e55019589fce18916218b5ae4cf8db850ef

  • SHA512

    5672f9cc1c120dc2e35a2e99c6261ea33b36d7c21b88dc27dc4ec733fe7df38586dc63fbe0161888d122a22a8768c856f26c5293f47f0657174dbb4eee90a395

  • SSDEEP

    49152:qwlE3HI4/C1FFYIQgbNbLzjFR5cRjLqOF:qwSHa1fYP6Nzo

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 46 IoCs
  • Suspicious use of SendNotifyMessage 44 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\416f915fb3b582641972ea178d5b5e55019589fce18916218b5ae4cf8db850ef.exe
    "C:\Users\Admin\AppData\Local\Temp\416f915fb3b582641972ea178d5b5e55019589fce18916218b5ae4cf8db850ef.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4848
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1356
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:860
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start msedge https://www.youtube.com/account
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          PID:3156
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com/account
            5⤵
              PID:2448
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc08dd46f8,0x7ffc08dd4708,0x7ffc08dd4718
                6⤵
                  PID:2748
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,10066899169926173284,1264493183454012474,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
                  6⤵
                    PID:6052
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,10066899169926173284,1264493183454012474,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
                    6⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:6060
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c start msedge https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                4⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                PID:3416
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings
                  5⤵
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:4576
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc08dd46f8,0x7ffc08dd4708,0x7ffc08dd4718
                    6⤵
                      PID:4772
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,17720885290256933913,9020692078897535112,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
                      6⤵
                        PID:6080
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,17720885290256933913,9020692078897535112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
                        6⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:6136
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,17720885290256933913,9020692078897535112,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
                        6⤵
                          PID:1364
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17720885290256933913,9020692078897535112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
                          6⤵
                            PID:3760
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17720885290256933913,9020692078897535112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
                            6⤵
                              PID:724
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17720885290256933913,9020692078897535112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3852 /prefetch:1
                              6⤵
                                PID:4652
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17720885290256933913,9020692078897535112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
                                6⤵
                                  PID:5352
                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,17720885290256933913,9020692078897535112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
                                  6⤵
                                    PID:5868
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,17720885290256933913,9020692078897535112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
                                    6⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:1884
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17720885290256933913,9020692078897535112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
                                    6⤵
                                      PID:532
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17720885290256933913,9020692078897535112,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
                                      6⤵
                                        PID:4500
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17720885290256933913,9020692078897535112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
                                        6⤵
                                          PID:5580
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17720885290256933913,9020692078897535112,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
                                          6⤵
                                            PID:2948
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                        4⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:1884
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                          5⤵
                                          • Checks processor information in registry
                                          • Modifies registry class
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          • Suspicious use of SetWindowsHookEx
                                          • Suspicious use of WriteProcessMemory
                                          PID:3672
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1956 -parentBuildID 20240401114208 -prefsHandle 1876 -prefMapHandle 1868 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc80dc92-babd-4e37-9a9e-a819a2f721fc} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" gpu
                                            6⤵
                                              PID:3020
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2436 -parentBuildID 20240401114208 -prefsHandle 2428 -prefMapHandle 2424 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9859455d-9945-47be-a6e5-10b5563b975b} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" socket
                                              6⤵
                                                PID:3464
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3316 -childID 1 -isForBrowser -prefsHandle 3160 -prefMapHandle 3176 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {83a0053a-eb36-42e8-91b8-dd96b21f36fb} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" tab
                                                6⤵
                                                  PID:3720
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3644 -childID 2 -isForBrowser -prefsHandle 3252 -prefMapHandle 1440 -prefsLen 22693 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {34281f26-2285-428a-8deb-4dce51247c53} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" tab
                                                  6⤵
                                                    PID:3280
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3832 -childID 3 -isForBrowser -prefsHandle 3844 -prefMapHandle 3664 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fca65350-552f-404d-a89e-4860c256df78} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" tab
                                                    6⤵
                                                      PID:4704
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4660 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4756 -prefMapHandle 4752 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {63124642-e234-4dec-89bb-4b9eacf9427f} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" utility
                                                      6⤵
                                                      • Checks processor information in registry
                                                      PID:5332
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5864 -childID 4 -isForBrowser -prefsHandle 5784 -prefMapHandle 5884 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a152fa5-858d-490a-9b26-423adb191fbb} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" tab
                                                      6⤵
                                                        PID:5652
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6004 -childID 5 -isForBrowser -prefsHandle 6012 -prefMapHandle 6016 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {41328d84-ae30-41b3-9812-f50bbb305b78} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" tab
                                                        6⤵
                                                          PID:5912
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6276 -childID 6 -isForBrowser -prefsHandle 6196 -prefMapHandle 6200 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2cd4e60-f0c2-4596-b894-2ee154158b1c} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" tab
                                                          6⤵
                                                            PID:1400
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                        4⤵
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4556
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                          5⤵
                                                          • Checks processor information in registry
                                                          PID:1004
                                                • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                  C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                  1⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4744
                                                • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                  C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                  1⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:5044
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:2232
                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                    1⤵
                                                      PID:5264

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      38f59a47b777f2fc52088e96ffb2baaf

                                                      SHA1

                                                      267224482588b41a96d813f6d9e9d924867062db

                                                      SHA256

                                                      13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

                                                      SHA512

                                                      4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      ab8ce148cb7d44f709fb1c460d03e1b0

                                                      SHA1

                                                      44d15744015155f3e74580c93317e12d2cc0f859

                                                      SHA256

                                                      014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

                                                      SHA512

                                                      f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                      Filesize

                                                      111B

                                                      MD5

                                                      807419ca9a4734feaf8d8563a003b048

                                                      SHA1

                                                      a723c7d60a65886ffa068711f1e900ccc85922a6

                                                      SHA256

                                                      aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

                                                      SHA512

                                                      f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      7710d134e7a4643d51796ddd53978970

                                                      SHA1

                                                      ab31fe63444147db223ca36291c5e3ab825bbfd8

                                                      SHA256

                                                      e86dd22aa6b2c670dfb4e702670c551911f185a998bcb094bfabe5339b9c034f

                                                      SHA512

                                                      07611d02e122b86dbfef88a60103c36bc8746405b280dda5657b2e8d8b122aec513a5e6c993d7cefa1aa5c2c2aaab02d0842c8ae9a5208ae6fc7ce8568b13214

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      7KB

                                                      MD5

                                                      3357d4f8c81ce499f7b866e562e112de

                                                      SHA1

                                                      b3caae1af7457c53d2fd09ec69f2a1524c42d428

                                                      SHA256

                                                      cec145de2a9264139d6bfe285c3c785d082943769ccb3141bfde40c461ac37c5

                                                      SHA512

                                                      b35fff486e541a6d29a09a21e2d6bda47d3158aa49b487d0772f5cb3d0dd24e8d52b5c7966ae187cbd9a6a5543daaff305be4ba1d05bc07231da6fcf8ae15e0c

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                      Filesize

                                                      16B

                                                      MD5

                                                      6752a1d65b201c13b62ea44016eb221f

                                                      SHA1

                                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                      SHA256

                                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                      SHA512

                                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      10KB

                                                      MD5

                                                      3664b06041742b88f4846fca123501ac

                                                      SHA1

                                                      f227487805cb296b3d24aa9c855526d7d5c44928

                                                      SHA256

                                                      b665a3a5e01e51a9e0c9307380500b1c49e4c194dceb0dd94298fbe9d6e7c42d

                                                      SHA512

                                                      24b0cbe3f5c07ae616392dbe8cbaedb72d4ccb09b622163a528116cd068f0a5bb7843b8aebcd9eaf1681724920a66acb2eb2930fbddbee17ea3e57338dfdbefb

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      8KB

                                                      MD5

                                                      062bc60dc1749eabc7148d229e135a44

                                                      SHA1

                                                      c9d85902cb40128094eebbcdbbdd81415fb2752d

                                                      SHA256

                                                      a594e566ab73317d85dac7182ef77394ba3a1fc23eefe298937cba00593db408

                                                      SHA512

                                                      543f03172003c65a3047ca7462bca0d50123a6c7c0f2c4b4ef505b27e6ce63484119632ec74990a2a2ef3a18c7c5df59b2f2c3b9050b5b4794430428b8d2d83a

                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yaq795em.default-release\activity-stream.discovery_stream.json

                                                      Filesize

                                                      26KB

                                                      MD5

                                                      4a4a034b1ef9b491a43b70531a3b4b7b

                                                      SHA1

                                                      2f5465756369eb4b7996904e5196bdce7149757d

                                                      SHA256

                                                      da980d12e352b0ac777b61cb0ffcab25395466960b37bb42b952ac276ff592f4

                                                      SHA512

                                                      5fd454c98575224bea5890f91da68758d30033f8d4ca2d3a18e764cc10ac147bce95ff1bbe0fe2cc9c97de01972a9977483ae2c5513eae3b816ea53fc537ec5f

                                                    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                                                      Filesize

                                                      1.8MB

                                                      MD5

                                                      ccf7de51b317996803c0ce2b2643db99

                                                      SHA1

                                                      41714678c993ef55bc0593383b7eff9e8b43bfb3

                                                      SHA256

                                                      416f915fb3b582641972ea178d5b5e55019589fce18916218b5ae4cf8db850ef

                                                      SHA512

                                                      5672f9cc1c120dc2e35a2e99c6261ea33b36d7c21b88dc27dc4ec733fe7df38586dc63fbe0161888d122a22a8768c856f26c5293f47f0657174dbb4eee90a395

                                                    • C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1

                                                      Filesize

                                                      2KB

                                                      MD5

                                                      e05e8f072b373beafe27cc11d85f947c

                                                      SHA1

                                                      1d6daeb98893e8122b8b69287ebd9d43f3c6138e

                                                      SHA256

                                                      717c09427fa5754ba92f92961545534048d0a76528c2e95c4d5ec6cef47c612f

                                                      SHA512

                                                      b3e34162e5ee43bb01f289eebc45fd3ea3e07f30be40dcf6635606540f912fe5c84d301e9f78e97dfe3ffe53e72547e50f3bcd7d4ebe5ab8da451a1989c469a0

                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zg0ydfic.rdp.ps1

                                                      Filesize

                                                      60B

                                                      MD5

                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                      SHA1

                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                      SHA256

                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                      SHA512

                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                    • C:\Users\Admin\AppData\Roaming\1000026000\1f91be8a99.exe

                                                      Filesize

                                                      880KB

                                                      MD5

                                                      02b0af0a4601ed1197aef1bddb2a0511

                                                      SHA1

                                                      30867d067e7c1bf38952b686250772b91b8a7198

                                                      SHA256

                                                      9ad1bdbc482380856c2499d90a78113ef91b3189bf42df62e1a054b98ee8f0bf

                                                      SHA512

                                                      23ca31b74ee12395314bd4532a8a07dd040b08f2bb75e8fcc577f76eb5f3c0616c4de52792d1cc66969b0a320169992f6fbd863d10c0137d9f31436970e0c185

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\AlternateServices.bin

                                                      Filesize

                                                      8KB

                                                      MD5

                                                      58c5fb1c62533ab1a0cec82d5d58fadc

                                                      SHA1

                                                      c77c3281e16fc6e9135d6ec17eb7d3a976a72f67

                                                      SHA256

                                                      15f5f2314058f3b6124969b2cb7973b89d210204169b3035169884ff418b8dc0

                                                      SHA512

                                                      30e056b665766b4e845bd3bdfe2675b9615bb557c89bc9a2348d224b820e417c002541ce4c3575e2a9d16651aa187ce8d26f3553d73ca14dfbf09940cdaf4b93

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\AlternateServices.bin

                                                      Filesize

                                                      10KB

                                                      MD5

                                                      b429a674e7fe1a3cff4e97176ae639df

                                                      SHA1

                                                      ed9fc969190bcbedf7a67091b33b96cbafbf5ef8

                                                      SHA256

                                                      e692dd8cc50f1435a028a8e477a76c9275d30edb13f4a9b0f588d5ec1611ec83

                                                      SHA512

                                                      80e54e89003a4e5d5b47c0fa12cc4794ce5cc207073d1f9fcd0fd673cc08bb04c87a9598300b5e106ae5be3c042a60532466d66e267c9a9f3eba1b2391c26459

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\AlternateServices.bin

                                                      Filesize

                                                      13KB

                                                      MD5

                                                      11fcccb99f0b51e69c169ae504e0f74c

                                                      SHA1

                                                      bb00764afb5cbdf664fe1c68e13e61fbcdc99cd2

                                                      SHA256

                                                      53e340a05dad30e4a3051b4ab0846c74ba8803de0372938594d2fbbc18018748

                                                      SHA512

                                                      af04e1bc2a6bd8c7c05d84c68f21c68d5936bbbeaa65c69fab7d4408230ed471a4a2a9af276c5725371f7c16197e6882ad92024925ec61056b81c7d89c7301bf

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      7f75dd26a072ea598c1159657a19cce5

                                                      SHA1

                                                      c163877ac6324ee67130ef1b0efbc3ca0b2249a1

                                                      SHA256

                                                      87a599d98d1f234f323fb1f7575dd5730c5ccb912cc76762ed7f5302afb5d6c1

                                                      SHA512

                                                      ed4fabcf2e149a1b24e28e0bf1d0752ed312df82fada49b9a098644d2ed9b8c96b4a2c27f217564b755c63340aebe031cdfd7817de10b0e348b759ab969837c3

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\db\data.safe.tmp

                                                      Filesize

                                                      15KB

                                                      MD5

                                                      d1de9d5c288f5ac7471fe66e1f002abe

                                                      SHA1

                                                      035c6b507dfe728ff1a5e77e06e906efd07c479c

                                                      SHA256

                                                      57417edcadf7768b185fc34941787404b1827f85e04852b21e99dfe9ba7cf730

                                                      SHA512

                                                      f2d947aa8fe3bfbafad208e8ebd465b9c1bd9efd4df051d40952d349e6daf0d1380500e161960dfcba21ee80b0f0baf8efb1dd88fa731c35c2cd44c9ff7a9b45

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\pending_pings\2827b580-f25f-4a4a-9b2e-3682f85051ac

                                                      Filesize

                                                      982B

                                                      MD5

                                                      ab55537ebb73e2c9f5dadb8b6d6d01c1

                                                      SHA1

                                                      3e152d8a2ba2332db6897dcf98f7f4991171a661

                                                      SHA256

                                                      ebeb18720e53059b56ab1d8b1cf57b2c3792096ef138805c57857465477bc106

                                                      SHA512

                                                      34d5dd2ade8d135f4da29dee90d696254e283552d68e9f4e3c3d6aba0227aeb7a0627736039f7e9f3f5eab18352875e62fc4b8c72bcdecf12ee9216951f1b433

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\pending_pings\a5669e98-d7b7-4d11-9807-c6c25396b88e

                                                      Filesize

                                                      671B

                                                      MD5

                                                      b4cdfea470f85d8404530ee0a207e414

                                                      SHA1

                                                      942d0737ed2b205ce359e6ec5c9cc14c264ac0db

                                                      SHA256

                                                      c42cb181788762df5b6a53207509ef0e16fc8616d0980d234e9894d9e14ff32e

                                                      SHA512

                                                      24484020e35064bda4dfc6ce4d168b8d78778565cf255717394202a02e4c099c2e21917b4b7cb531be08b9889993cd10a9a5c77656addad3894cfca5c65146e1

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\pending_pings\c227d61a-8f67-4173-a88c-3eea5979d831

                                                      Filesize

                                                      27KB

                                                      MD5

                                                      9f47e8a43d5a78f95306f1bcb847097d

                                                      SHA1

                                                      7f4e829d5a1c94eec346fcdb48a54f7a7ee6ea8b

                                                      SHA256

                                                      dc029418be1be83d1614c40d9b7f07ba919c9e1c59ea7f051782e9fe3d6f7e35

                                                      SHA512

                                                      ec18f13f501d7da52f713d1a91c4c63996a6244de02a2ec723784fc7ef8bc63ad5cad7a4e8e1e2c0ba73c33906bf941a0bdb24043a261200e64df4f32eb36eb7

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\sessionstore-backups\recovery.baklz4

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      cd7dec8254be521443d2d0f110e505a4

                                                      SHA1

                                                      706eba69773d98081417178f4c99d03dcf558511

                                                      SHA256

                                                      0fe2c16af49e18eb026f08050f583ae4d7e2173cd7fedadf9ee1d9a1d0e3cc58

                                                      SHA512

                                                      268ab92ef1b2dabb42aaa20068c33ba7769184bda19121a11e9ac9427eb8e0bb0668ca0c027b72576e08b201f9ba5700e9fafdef8976abe2e088a4b0c676a673

                                                    • \??\pipe\LOCAL\crashpad_2448_RPWTLOEMVYEMBMFW

                                                      MD5

                                                      d41d8cd98f00b204e9800998ecf8427e

                                                      SHA1

                                                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                      SHA256

                                                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                      SHA512

                                                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                    • memory/860-82-0x0000000002DB0000-0x0000000002DE6000-memory.dmp

                                                      Filesize

                                                      216KB

                                                    • memory/860-103-0x0000000007DC0000-0x0000000008364000-memory.dmp

                                                      Filesize

                                                      5.6MB

                                                    • memory/860-101-0x0000000006C50000-0x0000000006C6A000-memory.dmp

                                                      Filesize

                                                      104KB

                                                    • memory/860-102-0x0000000006CE0000-0x0000000006D02000-memory.dmp

                                                      Filesize

                                                      136KB

                                                    • memory/860-100-0x0000000007710000-0x00000000077A6000-memory.dmp

                                                      Filesize

                                                      600KB

                                                    • memory/860-98-0x0000000006740000-0x000000000678C000-memory.dmp

                                                      Filesize

                                                      304KB

                                                    • memory/860-97-0x0000000006700000-0x000000000671E000-memory.dmp

                                                      Filesize

                                                      120KB

                                                    • memory/860-96-0x0000000006260000-0x00000000065B4000-memory.dmp

                                                      Filesize

                                                      3.3MB

                                                    • memory/860-86-0x00000000060F0000-0x0000000006156000-memory.dmp

                                                      Filesize

                                                      408KB

                                                    • memory/860-85-0x0000000005990000-0x00000000059F6000-memory.dmp

                                                      Filesize

                                                      408KB

                                                    • memory/860-84-0x0000000005830000-0x0000000005852000-memory.dmp

                                                      Filesize

                                                      136KB

                                                    • memory/860-83-0x0000000005A50000-0x0000000006078000-memory.dmp

                                                      Filesize

                                                      6.2MB

                                                    • memory/1356-27-0x0000000000830000-0x0000000000D00000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/1356-511-0x0000000000830000-0x0000000000D00000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/1356-59-0x0000000000830000-0x0000000000D00000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/1356-654-0x0000000000830000-0x0000000000D00000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/1356-34-0x0000000000830000-0x0000000000D00000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/1356-57-0x0000000000830000-0x0000000000D00000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/1356-18-0x0000000000830000-0x0000000000D00000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/1356-26-0x0000000000830000-0x0000000000D00000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/1356-53-0x0000000000830000-0x0000000000D00000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/1356-36-0x0000000000830000-0x0000000000D00000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/1356-38-0x0000000000830000-0x0000000000D00000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/1356-37-0x0000000000830000-0x0000000000D00000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/1356-35-0x0000000000830000-0x0000000000D00000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/1356-25-0x0000000000830000-0x0000000000D00000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/1356-19-0x0000000000831000-0x000000000085F000-memory.dmp

                                                      Filesize

                                                      184KB

                                                    • memory/1356-20-0x0000000000830000-0x0000000000D00000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/1356-58-0x0000000000830000-0x0000000000D00000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/1356-21-0x0000000000830000-0x0000000000D00000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/1356-22-0x0000000000830000-0x0000000000D00000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/1356-24-0x0000000000830000-0x0000000000D00000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/1356-23-0x0000000000830000-0x0000000000D00000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/4744-31-0x0000000000830000-0x0000000000D00000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/4744-29-0x0000000000830000-0x0000000000D00000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/4744-30-0x0000000000830000-0x0000000000D00000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/4744-33-0x0000000000830000-0x0000000000D00000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/4848-17-0x0000000000240000-0x0000000000710000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/4848-4-0x0000000000240000-0x0000000000710000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/4848-0-0x0000000000240000-0x0000000000710000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/4848-3-0x0000000000240000-0x0000000000710000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/4848-2-0x0000000000241000-0x000000000026F000-memory.dmp

                                                      Filesize

                                                      184KB

                                                    • memory/4848-1-0x00000000774B4000-0x00000000774B6000-memory.dmp

                                                      Filesize

                                                      8KB

                                                    • memory/5044-55-0x0000000000830000-0x0000000000D00000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                    • memory/5044-56-0x0000000000830000-0x0000000000D00000-memory.dmp

                                                      Filesize

                                                      4.8MB