Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-11-2024 07:55

General

  • Target

    a7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f.exe

  • Size

    1.8MB

  • MD5

    6232a1aa692fe2b9f3f8e67d35c7dab7

  • SHA1

    87dc7bd254cac48669668a1833c10b8aab3775be

  • SHA256

    a7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f

  • SHA512

    c29f2e3b76fe7c2ef81370990b02ee978b81f8ceebb191cc218672184ad7fd5046d8088bcc954f62b05f72255ce15d89c909c99ca3d2ab6d097725d13736300a

  • SSDEEP

    49152:P2VKHlPtXQxOpYkv5bhxX84iAMEoatUvyuCy9CIwD:P2mtg4+kvBNKzatUquL9CV

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

mars

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

  • Cryptbot family
  • Detects CryptBot payload 1 IoCs

    CryptBot is a C++ stealer distributed widely in bundle with other software.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 4 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Identifies Wine through registry keys 2 TTPs 9 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 5 IoCs
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 59 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f.exe
    "C:\Users\Admin\AppData\Local\Temp\a7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:368
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2012
      • C:\Users\Admin\AppData\Local\Temp\1007612001\6103860804.exe
        "C:\Users\Admin\AppData\Local\Temp\1007612001\6103860804.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:3056
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
          4⤵
          • Uses browser remote debugging
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:5776
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa9fbbcc40,0x7ffa9fbbcc4c,0x7ffa9fbbcc58
            5⤵
              PID:5796
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2468,i,2354462686368162739,1312691606186963376,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2180 /prefetch:2
              5⤵
                PID:5396
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1764,i,2354462686368162739,1312691606186963376,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2508 /prefetch:3
                5⤵
                  PID:5384
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1964,i,2354462686368162739,1312691606186963376,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2448 /prefetch:8
                  5⤵
                    PID:5380
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3168,i,2354462686368162739,1312691606186963376,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3188 /prefetch:1
                    5⤵
                    • Uses browser remote debugging
                    PID:2528
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3196,i,2354462686368162739,1312691606186963376,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3228 /prefetch:1
                    5⤵
                    • Uses browser remote debugging
                    PID:6036
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4576,i,2354462686368162739,1312691606186963376,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4352 /prefetch:1
                    5⤵
                    • Uses browser remote debugging
                    PID:4872
                • C:\Users\Admin\AppData\Local\Temp\service123.exe
                  "C:\Users\Admin\AppData\Local\Temp\service123.exe"
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:5848
                • C:\Windows\SysWOW64\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:3816
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 1304
                  4⤵
                  • Program crash
                  PID:3412
              • C:\Users\Admin\AppData\Local\Temp\1007613001\930103daed.exe
                "C:\Users\Admin\AppData\Local\Temp\1007613001\930103daed.exe"
                3⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:4200
              • C:\Users\Admin\AppData\Local\Temp\1007614001\10a4315eb9.exe
                "C:\Users\Admin\AppData\Local\Temp\1007614001\10a4315eb9.exe"
                3⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:4996
              • C:\Users\Admin\AppData\Local\Temp\1007615001\0cee39ef5d.exe
                "C:\Users\Admin\AppData\Local\Temp\1007615001\0cee39ef5d.exe"
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:4460
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM firefox.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2672
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM chrome.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3172
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM msedge.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4468
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM opera.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3240
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM brave.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:760
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:836
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                    5⤵
                    • Checks processor information in registry
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:2344
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1960 -prefMapHandle 1952 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {725980f8-9c04-42f7-a0d9-7f6537363433} 2344 "\\.\pipe\gecko-crash-server-pipe.2344" gpu
                      6⤵
                        PID:2312
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2476 -parentBuildID 20240401114208 -prefsHandle 2452 -prefMapHandle 2448 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6520cc39-57c7-4a6e-b7c4-c9b7c1c5c0ef} 2344 "\\.\pipe\gecko-crash-server-pipe.2344" socket
                        6⤵
                          PID:1772
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2972 -childID 1 -isForBrowser -prefsHandle 2900 -prefMapHandle 2968 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba95d0cc-08bb-4ec4-ad7e-6b6be77c78da} 2344 "\\.\pipe\gecko-crash-server-pipe.2344" tab
                          6⤵
                            PID:4620
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4140 -childID 2 -isForBrowser -prefsHandle 4048 -prefMapHandle 4044 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ac6cc6f-6dad-452e-8bfc-89527bd25d69} 2344 "\\.\pipe\gecko-crash-server-pipe.2344" tab
                            6⤵
                              PID:3240
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4824 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4816 -prefMapHandle 4812 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8eaa048a-2217-4177-9853-05f07487c03f} 2344 "\\.\pipe\gecko-crash-server-pipe.2344" utility
                              6⤵
                              • Checks processor information in registry
                              PID:5260
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5348 -childID 3 -isForBrowser -prefsHandle 5272 -prefMapHandle 5276 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f341652-4448-4f55-8b9e-51b0cf8a2eaf} 2344 "\\.\pipe\gecko-crash-server-pipe.2344" tab
                              6⤵
                                PID:5196
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5508 -childID 4 -isForBrowser -prefsHandle 5588 -prefMapHandle 5584 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf17edc3-8583-4f08-bbb0-fd1bccea65f7} 2344 "\\.\pipe\gecko-crash-server-pipe.2344" tab
                                6⤵
                                  PID:5208
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5704 -childID 5 -isForBrowser -prefsHandle 5788 -prefMapHandle 5372 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf5cdcea-8eec-4054-8655-0461a56d8805} 2344 "\\.\pipe\gecko-crash-server-pipe.2344" tab
                                  6⤵
                                    PID:5684
                            • C:\Users\Admin\AppData\Local\Temp\1007616001\e7fd92ed15.exe
                              "C:\Users\Admin\AppData\Local\Temp\1007616001\e7fd92ed15.exe"
                              3⤵
                              • Modifies Windows Defender Real-time Protection settings
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Windows security modification
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2212
                        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          1⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3300
                        • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                          1⤵
                            PID:4836
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3056 -ip 3056
                            1⤵
                              PID:3580
                            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5204
                            • C:\Users\Admin\AppData\Local\Temp\service123.exe
                              C:\Users\Admin\AppData\Local\Temp\/service123.exe
                              1⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              PID:5836
                            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4628
                            • C:\Users\Admin\AppData\Local\Temp\service123.exe
                              C:\Users\Admin\AppData\Local\Temp\/service123.exe
                              1⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              PID:3664

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\activity-stream.discovery_stream.json

                              Filesize

                              28KB

                              MD5

                              a694679fa4c8f110247fa5c79ad98f78

                              SHA1

                              2cf65ccf5e250c3850dbfd235d92aaac7e360972

                              SHA256

                              e0a59410de62c3c9578c18c0bd1fb06f3d12fe0472508ee6b49b4f6379503bed

                              SHA512

                              8b4e606d33a1085292756c15861d962971db2d6e004578afa90e16ab366b2883f0d55e9a3606b9b4df17a788e0a2d4bf44ffd4e775a7141d300c77f4f1339a7a

                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878

                              Filesize

                              13KB

                              MD5

                              7f128c2acb271fa3fa8986c7ec726ea7

                              SHA1

                              ec16a6b10dc4ea454a4850f2f13eb12a085548d9

                              SHA256

                              1516b88659f66678ea9059d4af5fc739514a60acba0037b0f2cf32651726a4e9

                              SHA512

                              8019d6c997b1f9563eab921cf3a2613fea895c7fdf06e20e607cdfc39985d93d75ea4d2e04b48ec02eb58c3de2c6a7cf944d1249522452d8ecf7f930d9ae60e5

                            • C:\Users\Admin\AppData\Local\Temp\1007612001\6103860804.exe

                              Filesize

                              4.2MB

                              MD5

                              86dce43872ffd26d6225323bf7f0c76f

                              SHA1

                              9bee03858ee62de271b3b29b0144b27892927a13

                              SHA256

                              2eeba583715e37c4f8632f58d1c49a6d0ef7fdf6815d4bc7593c492a45aca663

                              SHA512

                              3768ec45560096f81b6071c201a6bb52f19c294051d2399cd77a6a915e91fa4243d031856321cead807a22f8c71c7bb9c4e1cee1bae70d5d4b9c956abddaa290

                            • C:\Users\Admin\AppData\Local\Temp\1007613001\930103daed.exe

                              Filesize

                              1.8MB

                              MD5

                              7a1f4e4b815b73f671f80a09012fe4f6

                              SHA1

                              e6cee5745cdc3c66d619a3a9721d32884f6eb348

                              SHA256

                              b5acc9bfb7c8193548ef6d69fde0e68b7645c9fb55a7d13c5fba56becb830358

                              SHA512

                              f94343417608e824af93ac0e77a0a6ccaa2db0a71c338c0d9a3eff1859d90e3e53a4fdcefeabe3c7da599b0349a595a8291806d688fe0a2f8e0a211e048dd72e

                            • C:\Users\Admin\AppData\Local\Temp\1007614001\10a4315eb9.exe

                              Filesize

                              1.7MB

                              MD5

                              c543b2872840d40556cb383bd113cb5f

                              SHA1

                              36a4cf336fab929637a23e5a7c541c1397e775cf

                              SHA256

                              0cf722b0faacd95724ff91530727c4236da45027fe06882f7485c4ea160ebfb7

                              SHA512

                              f7b57287f27a8119b1d0c8a5ec4afdc751e1b5574125a5ca3bc973108f8ba53c931708589a5c73c2afd358ef8245d30a21dcecdba7ccb6fd0bc038bb5cee853e

                            • C:\Users\Admin\AppData\Local\Temp\1007615001\0cee39ef5d.exe

                              Filesize

                              900KB

                              MD5

                              8c0ecab1bfb7b72e454ccb604d9b01b1

                              SHA1

                              8eb0311bfd146d6c4cec42622c4d3001bef548dc

                              SHA256

                              0676a41db2bebcb07161a3240c0ad432c5e34acf87c305d5fcbc9ca5bf810696

                              SHA512

                              96befb3937d66841e0e58151f064e79e121429d2d34f217b47ea8e26fdbb6a54507cf23425646a972aee94c4312facbc5a4fcb170594d72c293474dd8d123c51

                            • C:\Users\Admin\AppData\Local\Temp\1007616001\e7fd92ed15.exe

                              Filesize

                              2.7MB

                              MD5

                              6ac52e3a9a029fceeb211529a6c15eaa

                              SHA1

                              943adba70ce4cd0fc3ccf97978da2b5b507dcfeb

                              SHA256

                              c4d6ec26e110419eeefeb8121f9be4f059a798d3746e40546d32136e5a12e981

                              SHA512

                              2188b93600af285097bd412b383234719b875a1b45d8246833a496cde4f06c1cc58e31cff4f441bb5b313bbe61e46b7929b2ed288b13aab99164ec4512fe71d6

                            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

                              Filesize

                              1.8MB

                              MD5

                              6232a1aa692fe2b9f3f8e67d35c7dab7

                              SHA1

                              87dc7bd254cac48669668a1833c10b8aab3775be

                              SHA256

                              a7cf50803925abf03bcd899b82745e472e99963b2cd8063aa44249bd6c75395f

                              SHA512

                              c29f2e3b76fe7c2ef81370990b02ee978b81f8ceebb191cc218672184ad7fd5046d8088bcc954f62b05f72255ce15d89c909c99ca3d2ab6d097725d13736300a

                            • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                              Filesize

                              479KB

                              MD5

                              09372174e83dbbf696ee732fd2e875bb

                              SHA1

                              ba360186ba650a769f9303f48b7200fb5eaccee1

                              SHA256

                              c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                              SHA512

                              b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                            • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                              Filesize

                              13.8MB

                              MD5

                              0a8747a2ac9ac08ae9508f36c6d75692

                              SHA1

                              b287a96fd6cc12433adb42193dfe06111c38eaf0

                              SHA256

                              32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                              SHA512

                              59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin

                              Filesize

                              6KB

                              MD5

                              c6d53ea8c2ffedf3bc5521af9e9fd366

                              SHA1

                              90de8481218e1ced4a10ec2fda7eb026b211a4aa

                              SHA256

                              7bce12ac5c73d465889b91e4dbfe3b6505d08feae2f25099ccbc122ccf2ca8e6

                              SHA512

                              9c1f701c6baa7dce08b63e9551a85cf1ed74ffafbe60a47751ed1b8ec69e4354eb5a1a6431baddaf5e55a4d830909e70de54e872fd98dc522052d3c64b921358

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin

                              Filesize

                              18KB

                              MD5

                              45e7aa868e933091c75a100feb83375c

                              SHA1

                              21de7dfab3dcf157449580802739af9d4700da3d

                              SHA256

                              a4ca48a5883f1c8dad5f103fca0048eb359d020c050d7604160b2b1e3cd4ce8a

                              SHA512

                              ae97f294241c89f0076841377a04d2c5badd867e9a9f6774e3ae6ed0fc3926a1dddeb6076618fbb1aba35654268b1904d46ea2fcc775007b7482877ecc0490fb

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin

                              Filesize

                              8KB

                              MD5

                              f85007d33c83f833d79fe4ce18165d1f

                              SHA1

                              afed69ff340938d6153d1bd3277874b18655c9c9

                              SHA256

                              ef56417d8c32b22af7f83171201fc8476f3b4b0f43873dc11846dfbdc01f5736

                              SHA512

                              1b4b0dba757f77892d29a44833fcfaca1a83c5b6ef62a220035669c0d7b82602a8279e212c37a60e1fc8099f13e9697291368c61bc65676c9b1a74efa231ea0e

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp

                              Filesize

                              5KB

                              MD5

                              a90ce90014be95d74b23945b2524bd32

                              SHA1

                              2e501aae2dbaa15c80d0e7efe9bef97bcf4f7d21

                              SHA256

                              1c4e96775c1e7c38d3605cb01c1629f22ee6382183d6e4e387c88f0e217e0d77

                              SHA512

                              7d0761714e98479cc5775b28263ff14946543f0c51952988eb655537b1fb5c5829015eab1c65d4d601b97488adadcb827c5a4478aa981d17dca8b30b01bfe7f8

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp

                              Filesize

                              6KB

                              MD5

                              bed4e8f12357dc3a9c0fa5d4efa5f8f4

                              SHA1

                              ca526b90e45f2340833e589cd2b96196c7167198

                              SHA256

                              a2db19cd0cfc1bef30f90281b23700628880058ca8f1ab066ba51c46347effad

                              SHA512

                              92a530e0a0f9930a4575946300c6600356554dd60a430373a19ea6064f124c4e1ad9e877694b199b56770b719f7b9cfe1bcaa5f56e743822bf3aa1d41b8dce4f

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp

                              Filesize

                              15KB

                              MD5

                              66dd346af2eff336f438445ecdcad289

                              SHA1

                              00a0a3ec1200e37d0cad761cae75145c754a4aa0

                              SHA256

                              f4f09fb5d602bd1fddc7807e374b37ff18d4094d725537c8835e248cde55cab7

                              SHA512

                              9d2f020246bb61a37ea75cd762398a5e9be4d7f788a9b99237d6fed3641c0ae06e78a2127b2b2c0f0929ce4d1465c2f20e41a589e9d52bc346bee6f30946674b

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\ad17851a-f5ba-4e18-a325-1cc94911fcb1

                              Filesize

                              671B

                              MD5

                              46a5e10f0d854847a92d02d3f51970bc

                              SHA1

                              4efc35db364c1536dde5bc7d887968d9d7707632

                              SHA256

                              86c14325a55672607bfe21a440e96430f47c44b40f8a519e84738cf6844502dd

                              SHA512

                              b7707168bfc007a889bedda5be85313e53a2b6f148055d6be1ef14b36921f4080dc4890b15a1d796c207a6a9fb6b12a474960ac731d8fd854dc0686d0fb2a221

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\cdf0f5b3-7fba-416b-a2da-2fe57636c0db

                              Filesize

                              27KB

                              MD5

                              638e19b1b944ee5a0f364a1b67d49c53

                              SHA1

                              6d00afd8f820875519ecd4fa9a0bdda51b63fe1a

                              SHA256

                              bfbccdc8106d1f42863df9152cee00aad6eb4c8a466c600fed7b1ab4d9e48b22

                              SHA512

                              844f333953a65bc1c7e1c452cdbe6fc2d54ae60d54613e350a9346b2e410576457c698aed6e430ebfc9d3902be76658da4b6ac2624ac24c2ee255af18155478a

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\d7f1ff8e-7fad-435f-a182-a758af696080

                              Filesize

                              982B

                              MD5

                              79d75f6ebb65d6d1cc13f8a0ebc38cff

                              SHA1

                              a3dd28e726cdffcb71a2700bb3278dabc3be12a4

                              SHA256

                              6691c4de0ace219fefe2a5a4068d407f785341b67250de3a36d3af427fcee459

                              SHA512

                              9aecf59dedb70874ee06ce0a54c9302aa6657cc6a7fe520896a51e5a29cbfbf50de184eb5b5731c3a5aa224feb6c624353804a6ff9bc9d4087bda2640b65a06a

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                              Filesize

                              1.1MB

                              MD5

                              842039753bf41fa5e11b3a1383061a87

                              SHA1

                              3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                              SHA256

                              d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                              SHA512

                              d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                              Filesize

                              116B

                              MD5

                              2a461e9eb87fd1955cea740a3444ee7a

                              SHA1

                              b10755914c713f5a4677494dbe8a686ed458c3c5

                              SHA256

                              4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                              SHA512

                              34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                              Filesize

                              372B

                              MD5

                              bf957ad58b55f64219ab3f793e374316

                              SHA1

                              a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                              SHA256

                              bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                              SHA512

                              79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                              Filesize

                              17.8MB

                              MD5

                              daf7ef3acccab478aaa7d6dc1c60f865

                              SHA1

                              f8246162b97ce4a945feced27b6ea114366ff2ad

                              SHA256

                              bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                              SHA512

                              5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs-1.js

                              Filesize

                              10KB

                              MD5

                              e307dbae1440f08c04e98bf05e50fd14

                              SHA1

                              72c7b8bad49debb0546c3c8a04db9b16fd100c91

                              SHA256

                              acb3210737f4b7606f19dec46223b130bf8a1f86225bf51cd021afc7e3ecb8ee

                              SHA512

                              0f2e2f50ac9ecf0cb86f5c649f7b93dc78a1ca0e6e269cf7ab2983c859b0fbdc0c434663b76bbe0b310b8f08f9cb14b6068b492975c16dc0c50dd59db1bfd4ee

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs-1.js

                              Filesize

                              15KB

                              MD5

                              1ce8addaff4be2165bed0ccbbfcfb79f

                              SHA1

                              8e8d4e7f815675e21614755bc800b8c5f53e23b2

                              SHA256

                              36f496d94e3d753b6d995852d58f65a186fffaff68f100d7d822b6bdafdb9c75

                              SHA512

                              ac7cb861f9e7aa7384dc94c6cfcdff7cc466e8451c93fd193e0032b1e4633fb70b118b731cba750523a1870fb4b82c2004a28d60d6cbce040d43bc5c8c4b9255

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs.js

                              Filesize

                              10KB

                              MD5

                              67d67436266e77b1a72099cf39af33ee

                              SHA1

                              08809e0dd61c727589b1647c3c1449f0e24479e8

                              SHA256

                              e979c04a63d9a93cd0dcb3ecbc0b53fab20176b29831287aa9cc8883b115fddb

                              SHA512

                              6bb728c17266021750bb60708b1521dd806a905137853fdfc38933f3b14b5c0b7c711def46fe6a0255c2dd48c464a23338bcdd550e7626b26de4b9f9d37616d1

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs.js

                              Filesize

                              12KB

                              MD5

                              40bfe356cdb4e388c8f925bb45776213

                              SHA1

                              3571b4e6c5031ea4c3b770a8e3f350325774746e

                              SHA256

                              94751615df509cc0b020bdca29e64e60ef922c43012aafeb96396364a79032b4

                              SHA512

                              b60ea35d720c66af617b7cabc07911a89291b9f6e537320d83f2554a73637c858efecb9a75045bdf7c614223852f463b74d5790406923cb517a249d3ac9af8d9

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                              Filesize

                              3.0MB

                              MD5

                              d905aedeb12af7c414d547b1360c90a6

                              SHA1

                              a23f3846f07b3e8b38041d596be88181b0778973

                              SHA256

                              5675b283b39eb9476e4112ab74037841e1bd7320f0228732187bceeacd8fcaf7

                              SHA512

                              7d7f8d8c9c6fd9f8da6397cc0319907b82120fa8dd7895d457808371efaf4b1583b451136da973815daab61d0b5e849fe949530ee4ac65698ee3b713f15fcf91

                            • \??\pipe\crashpad_5776_PQZAXHJPCWTFEAKV

                              MD5

                              d41d8cd98f00b204e9800998ecf8427e

                              SHA1

                              da39a3ee5e6b4b0d3255bfef95601890afd80709

                              SHA256

                              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                              SHA512

                              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                            • memory/368-4-0x0000000000B20000-0x0000000000FDE000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/368-0-0x0000000000B20000-0x0000000000FDE000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/368-3-0x0000000000B20000-0x0000000000FDE000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/368-18-0x0000000000B20000-0x0000000000FDE000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/368-2-0x0000000000B21000-0x0000000000B4F000-memory.dmp

                              Filesize

                              184KB

                            • memory/368-1-0x0000000077B04000-0x0000000077B06000-memory.dmp

                              Filesize

                              8KB

                            • memory/2012-2649-0x0000000000C00000-0x00000000010BE000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/2012-22-0x0000000000C00000-0x00000000010BE000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/2012-3233-0x0000000000C00000-0x00000000010BE000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/2012-3230-0x0000000000C00000-0x00000000010BE000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/2012-20-0x0000000000C00000-0x00000000010BE000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/2012-16-0x0000000000C00000-0x00000000010BE000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/2012-110-0x0000000000C00000-0x00000000010BE000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/2012-3221-0x0000000000C00000-0x00000000010BE000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/2012-3218-0x0000000000C00000-0x00000000010BE000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/2012-19-0x0000000000C01000-0x0000000000C2F000-memory.dmp

                              Filesize

                              184KB

                            • memory/2012-3215-0x0000000000C00000-0x00000000010BE000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/2012-532-0x0000000000C00000-0x00000000010BE000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/2012-3212-0x0000000000C00000-0x00000000010BE000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/2012-3206-0x0000000000C00000-0x00000000010BE000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/2012-3198-0x0000000000C00000-0x00000000010BE000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/2012-546-0x0000000000C00000-0x00000000010BE000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/2012-36-0x0000000000C00000-0x00000000010BE000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/2012-990-0x0000000000C00000-0x00000000010BE000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/2012-44-0x0000000000C00000-0x00000000010BE000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/2012-45-0x0000000000C00000-0x00000000010BE000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/2012-21-0x0000000000C00000-0x00000000010BE000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/2212-534-0x0000000000640000-0x00000000008F2000-memory.dmp

                              Filesize

                              2.7MB

                            • memory/2212-355-0x0000000000640000-0x00000000008F2000-memory.dmp

                              Filesize

                              2.7MB

                            • memory/2212-356-0x0000000000640000-0x00000000008F2000-memory.dmp

                              Filesize

                              2.7MB

                            • memory/2212-137-0x0000000000640000-0x00000000008F2000-memory.dmp

                              Filesize

                              2.7MB

                            • memory/2212-543-0x0000000000640000-0x00000000008F2000-memory.dmp

                              Filesize

                              2.7MB

                            • memory/3056-544-0x0000000000EC0000-0x0000000001B0E000-memory.dmp

                              Filesize

                              12.3MB

                            • memory/3056-63-0x0000000069CC0000-0x000000006A71B000-memory.dmp

                              Filesize

                              10.4MB

                            • memory/3056-835-0x0000000000EC0000-0x0000000001B0E000-memory.dmp

                              Filesize

                              12.3MB

                            • memory/3056-109-0x0000000000EC0000-0x0000000001B0E000-memory.dmp

                              Filesize

                              12.3MB

                            • memory/3056-108-0x0000000000EC0000-0x0000000001B0E000-memory.dmp

                              Filesize

                              12.3MB

                            • memory/3056-2051-0x0000000000EC0000-0x0000000001B0E000-memory.dmp

                              Filesize

                              12.3MB

                            • memory/3056-525-0x0000000000EC0000-0x0000000001B0E000-memory.dmp

                              Filesize

                              12.3MB

                            • memory/3056-41-0x0000000000EC0000-0x0000000001B0E000-memory.dmp

                              Filesize

                              12.3MB

                            • memory/3300-39-0x0000000000C00000-0x00000000010BE000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/3300-43-0x0000000000C00000-0x00000000010BE000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/3664-3228-0x0000000000800000-0x0000000000812000-memory.dmp

                              Filesize

                              72KB

                            • memory/4200-61-0x0000000000E90000-0x000000000134A000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/4200-88-0x0000000000E90000-0x000000000134A000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/4628-3225-0x0000000000C00000-0x00000000010BE000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/4628-3229-0x0000000000C00000-0x00000000010BE000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/4996-89-0x0000000000B00000-0x00000000011A6000-memory.dmp

                              Filesize

                              6.6MB

                            • memory/4996-85-0x0000000000B00000-0x00000000011A6000-memory.dmp

                              Filesize

                              6.6MB

                            • memory/5204-3191-0x0000000000C00000-0x00000000010BE000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/5204-3192-0x0000000000C00000-0x00000000010BE000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/5836-3195-0x0000000000800000-0x0000000000812000-memory.dmp

                              Filesize

                              72KB

                            • memory/5848-2889-0x0000000073C30000-0x0000000073D64000-memory.dmp

                              Filesize

                              1.2MB

                            • memory/5848-2888-0x0000000000800000-0x0000000000812000-memory.dmp

                              Filesize

                              72KB