Analysis

  • max time kernel
    141s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    27/11/2024, 06:57

General

  • Target

    44e6b37ca76b0297d26d40de3f1c96fb04705cc236e24a93a564012a6f6be896.exe

  • Size

    1.8MB

  • MD5

    9a612228c9f2ed059ed4d47809793b1d

  • SHA1

    50bfcb257336d3251865f07f69f65591a2bd41bb

  • SHA256

    44e6b37ca76b0297d26d40de3f1c96fb04705cc236e24a93a564012a6f6be896

  • SHA512

    ed1381301bfa27e39a2c92f54462f75d96dfe3753254c1532d788f149ff9bd448fb0c75269d092b65df6003b400801aa86f8a3c3f534c54fe9b9a8ac810f9d53

  • SSDEEP

    49152:hTJbkWiqmN/uVQe62Bx096bkOn108UIX:hTRVmNaQerBx096bplLX

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://powerful-avoids.sbs

https://motion-treesz.sbs

https://disobey-curly.sbs

https://leg-sate-boat.sbs

https://story-tense-faz.sbs

https://blade-govern.sbs

https://occupy-blushi.sbs

https://frogs-severz.sbs

https://push-hook.cyou

https://property-imper.sbs

Extracted

Family

stealc

Botnet

mars

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

lumma

C2

https://push-hook.cyou/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 4 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 12 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 13 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 5 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 33 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of FindShellTrayWindow 52 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1200
      • C:\Users\Admin\AppData\Local\Temp\44e6b37ca76b0297d26d40de3f1c96fb04705cc236e24a93a564012a6f6be896.exe
        "C:\Users\Admin\AppData\Local\Temp\44e6b37ca76b0297d26d40de3f1c96fb04705cc236e24a93a564012a6f6be896.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1644
        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2916
          • C:\Users\Admin\AppData\Local\Temp\1009118001\x4lburt.exe
            "C:\Users\Admin\AppData\Local\Temp\1009118001\x4lburt.exe"
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:2040
            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\computerlead.exe
              C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\computerlead.exe
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:556
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                6⤵
                • Suspicious use of NtCreateUserProcessOtherParentProcess
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:3528
          • C:\Users\Admin\AppData\Local\Temp\1009238001\vg9qcBa.exe
            "C:\Users\Admin\AppData\Local\Temp\1009238001\vg9qcBa.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1492
            • C:\Users\Admin\AppData\Local\Temp\1009238001\vg9qcBa.exe
              "C:\Users\Admin\AppData\Local\Temp\1009238001\vg9qcBa.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies system certificate store
              PID:2948
          • C:\Users\Admin\AppData\Local\Temp\1009342001\VBVEd6f.exe
            "C:\Users\Admin\AppData\Local\Temp\1009342001\VBVEd6f.exe"
            4⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1672
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c copy Appreciate Appreciate.cmd && Appreciate.cmd
              5⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2436
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist
                6⤵
                • Enumerates processes with tasklist
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:932
              • C:\Windows\SysWOW64\findstr.exe
                findstr /I "wrsa opssvc"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2220
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist
                6⤵
                • Enumerates processes with tasklist
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:2196
              • C:\Windows\SysWOW64\findstr.exe
                findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:992
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c md 397506
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1720
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c copy /b ..\Concept + ..\Mix + ..\Trunk + ..\Answers + ..\Bufing + ..\Benefits + ..\Ram + ..\Guides k
                6⤵
                • System Location Discovery: System Language Discovery
                PID:3008
              • C:\Users\Admin\AppData\Local\Temp\397506\Mesa.com
                Mesa.com k
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Checks processor information in registry
                • Modifies system certificate store
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:2084
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
                  7⤵
                  • Uses browser remote debugging
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  PID:2388
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6a69758,0x7fef6a69768,0x7fef6a69778
                    8⤵
                      PID:2400
                    • C:\Windows\system32\ctfmon.exe
                      ctfmon.exe
                      8⤵
                        PID:2720
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1136 --field-trial-handle=1208,i,15436709602313204637,12700480220325278217,131072 /prefetch:2
                        8⤵
                          PID:1604
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1532 --field-trial-handle=1208,i,15436709602313204637,12700480220325278217,131072 /prefetch:8
                          8⤵
                            PID:1716
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1552 --field-trial-handle=1208,i,15436709602313204637,12700480220325278217,131072 /prefetch:8
                            8⤵
                              PID:2868
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2256 --field-trial-handle=1208,i,15436709602313204637,12700480220325278217,131072 /prefetch:1
                              8⤵
                              • Uses browser remote debugging
                              PID:2700
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2264 --field-trial-handle=1208,i,15436709602313204637,12700480220325278217,131072 /prefetch:1
                              8⤵
                              • Uses browser remote debugging
                              PID:852
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1288 --field-trial-handle=1208,i,15436709602313204637,12700480220325278217,131072 /prefetch:2
                              8⤵
                                PID:2704
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1464 --field-trial-handle=1208,i,15436709602313204637,12700480220325278217,131072 /prefetch:1
                                8⤵
                                • Uses browser remote debugging
                                PID:1736
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3932 --field-trial-handle=1208,i,15436709602313204637,12700480220325278217,131072 /prefetch:8
                                8⤵
                                  PID:1000
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\397506\Mesa.com" & rd /s /q "C:\ProgramData\GCGIDGCGIEGD" & exit
                                7⤵
                                • System Location Discovery: System Language Discovery
                                PID:3224
                                • C:\Windows\SysWOW64\timeout.exe
                                  timeout /t 10
                                  8⤵
                                  • System Location Discovery: System Language Discovery
                                  • Delays execution with timeout.exe
                                  PID:3368
                            • C:\Windows\SysWOW64\choice.exe
                              choice /d y /t 5
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:2820
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1009351041\PeRVAzl.ps1"
                          4⤵
                          • Command and Scripting Interpreter: PowerShell
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2784
                        • C:\Users\Admin\AppData\Local\Temp\1009542001\bc4113c669.exe
                          "C:\Users\Admin\AppData\Local\Temp\1009542001\bc4113c669.exe"
                          4⤵
                          • Enumerates VirtualBox registry keys
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1316
                        • C:\Users\Admin\AppData\Local\Temp\1009543001\05f1bed00a.exe
                          "C:\Users\Admin\AppData\Local\Temp\1009543001\05f1bed00a.exe"
                          4⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1952
                        • C:\Users\Admin\AppData\Local\Temp\1009544001\d9d72b2ebd.exe
                          "C:\Users\Admin\AppData\Local\Temp\1009544001\d9d72b2ebd.exe"
                          4⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:884
                        • C:\Users\Admin\AppData\Local\Temp\1009545001\a608ee9925.exe
                          "C:\Users\Admin\AppData\Local\Temp\1009545001\a608ee9925.exe"
                          4⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          PID:1552
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /F /IM firefox.exe /T
                            5⤵
                            • System Location Discovery: System Language Discovery
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1400
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /F /IM chrome.exe /T
                            5⤵
                            • System Location Discovery: System Language Discovery
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2840
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /F /IM msedge.exe /T
                            5⤵
                            • System Location Discovery: System Language Discovery
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2396
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /F /IM opera.exe /T
                            5⤵
                            • System Location Discovery: System Language Discovery
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3032
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /F /IM brave.exe /T
                            5⤵
                            • System Location Discovery: System Language Discovery
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2400
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                            5⤵
                              PID:1616
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                                6⤵
                                • Checks processor information in registry
                                • Modifies registry class
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                PID:2532
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2532.0.74623523\1291408134" -parentBuildID 20221007134813 -prefsHandle 1236 -prefMapHandle 1232 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {58ddd030-9d9f-4b74-b274-a387f424363c} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" 1336 109d6958 gpu
                                  7⤵
                                    PID:2592
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2532.1.1496027160\505824847" -parentBuildID 20221007134813 -prefsHandle 1484 -prefMapHandle 1480 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b3f32cd-8bd3-4c0e-ac4c-693d46477a66} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" 1508 d73958 socket
                                    7⤵
                                      PID:2008
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2532.2.1658583688\512587096" -childID 1 -isForBrowser -prefsHandle 2112 -prefMapHandle 2100 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 596 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7993f98d-a2fc-416c-9fd9-52f987f61073} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" 2124 190a9358 tab
                                      7⤵
                                        PID:2688
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2532.3.2021682622\1714480894" -childID 2 -isForBrowser -prefsHandle 2712 -prefMapHandle 2708 -prefsLen 26151 -prefMapSize 233444 -jsInitHandle 596 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {493a02bb-1b75-43fd-aa53-9da185aeed9d} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" 2724 1af11d58 tab
                                        7⤵
                                          PID:3044
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2532.4.936932437\147887087" -childID 3 -isForBrowser -prefsHandle 3820 -prefMapHandle 3816 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 596 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {df9f06cb-c9bb-4093-ae21-c9657079f1e4} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" 3832 2056e658 tab
                                          7⤵
                                            PID:2052
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2532.5.394912209\1256421469" -childID 4 -isForBrowser -prefsHandle 3936 -prefMapHandle 3940 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 596 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8c3c4922-f3f4-4bdd-80d7-7b1d87a92436} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" 3836 205c0258 tab
                                            7⤵
                                              PID:1516
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2532.6.1545624905\342563848" -childID 5 -isForBrowser -prefsHandle 4112 -prefMapHandle 4116 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 596 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fb9fcaba-91bc-4b5d-bc1e-4c3a45ac83f0} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" 4100 205c2658 tab
                                              7⤵
                                                PID:1112
                                        • C:\Users\Admin\AppData\Local\Temp\1009546001\7da9e2c7cb.exe
                                          "C:\Users\Admin\AppData\Local\Temp\1009546001\7da9e2c7cb.exe"
                                          4⤵
                                          • Modifies Windows Defender Real-time Protection settings
                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                          • Checks BIOS information in registry
                                          • Executes dropped EXE
                                          • Identifies Wine through registry keys
                                          • Windows security modification
                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3212
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                                      2⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:4000
                                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                    1⤵
                                      PID:2064

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\ProgramData\GCGIDGCGIEGD\BKKKFC

                                      Filesize

                                      6KB

                                      MD5

                                      f99ed23ff09cdec76cdbc0a5c048c5c1

                                      SHA1

                                      a73d5943bdbdb02523c8adbe84f79fa8af6af819

                                      SHA256

                                      abb21e884a9ffea437ba69994636baf16ce0d0b7f6d99c3a42591ba2ad043a9d

                                      SHA512

                                      7e5922845a28cfc8468117a79faaf13e1aff5855e32289513bc809d97743aaa57484f4ec40ca55bcee19f57af1fe33ce4f2853a2bfa4cd37cefb84dd69a11d7e

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                      Filesize

                                      342B

                                      MD5

                                      7b0b1337126c4b130b9979874ce86270

                                      SHA1

                                      9b2212e04cd0fcb5cd57d3f10228108b9ebbf317

                                      SHA256

                                      e5462e23e03020a35c975bbdd419b15f5a69fa062477057bbb70a49c59ed73b4

                                      SHA512

                                      e7538eba0ae05063d6054e80477ae0e433c610e695f3065a91a726669284f03c3770f8ec087fe9f15fd5f5fe593c26676bf042e4c23ffc17b4d23d6c92f4c18b

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                      Filesize

                                      264KB

                                      MD5

                                      f50f89a0a91564d0b8a211f8921aa7de

                                      SHA1

                                      112403a17dd69d5b9018b8cede023cb3b54eab7d

                                      SHA256

                                      b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                      SHA512

                                      bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

                                      Filesize

                                      16B

                                      MD5

                                      18e723571b00fb1694a3bad6c78e4054

                                      SHA1

                                      afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                      SHA256

                                      8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                      SHA512

                                      43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\activity-stream.discovery_stream.json.tmp

                                      Filesize

                                      32KB

                                      MD5

                                      18db82633b69a6ec72a63b91c2c0164f

                                      SHA1

                                      a92d10f41e487aa8897339b2a8ecd40707a5adf8

                                      SHA256

                                      068053325f37ab79e7fa99af4c8039d7ffa9e2e0f5c754d078e94c849b550ee6

                                      SHA512

                                      7c77202b6cdb2f6174d1384232bb042bab24e0ff20904c95fe3c86f4b428f2e92afa346d491c7659a4ef1656b890805cbb7f1b56b5aceb19f6c5ca9f784af564

                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

                                      Filesize

                                      13KB

                                      MD5

                                      f99b4984bd93547ff4ab09d35b9ed6d5

                                      SHA1

                                      73bf4d313cb094bb6ead04460da9547106794007

                                      SHA256

                                      402571262fd1f6dca336f822ceb0ec2a368a25dfe2f4bfa13b45c983e88b6069

                                      SHA512

                                      cd0ed84a24d3faae94290aca1b5ef65eef4cfba8a983da9f88ee3268fc611484a72bd44ca0947c0ca8de174619debae4604e15e4b2c364e636424ba1d37e1759

                                    • C:\Users\Admin\AppData\Local\Temp\1009118001\x4lburt.exe

                                      Filesize

                                      932KB

                                      MD5

                                      96a7b754ca8e8f35ae9e2b88b9f25658

                                      SHA1

                                      ed24a27a726b87c1d5bf1da60527e5801603bb8e

                                      SHA256

                                      21d262741b3661b4bf1569f744dc5b5e6119cfa4f0748b9c0fa240f75442cc50

                                      SHA512

                                      facb2e44f5a506349710e9b2d29f6664357d057444a6bd994cf3901dee7bea471247b47496cc4480f1ad2fac4b1867117072ea7a0bfa83d55ced4e00dda96745

                                    • C:\Users\Admin\AppData\Local\Temp\1009238001\vg9qcBa.exe

                                      Filesize

                                      460KB

                                      MD5

                                      20160349422aeb131ed9da71a82eb7ab

                                      SHA1

                                      bb01e4225a1e1797c9b5858d0edf063d5f8bc44f

                                      SHA256

                                      d8f6ce51eba058276c4722747655b68711682afc5654414e8c195ada38fdc0ea

                                      SHA512

                                      907f3f61ac9ebeda534b3a330fd8673e8d09b243847b6a7a8d8d30f74ba8c699eafb8338a8d4f36824871609c1f226cb4db1e4a931fdf312f0e4331e7110c6b8

                                    • C:\Users\Admin\AppData\Local\Temp\1009278001\DPQSEDd.exe

                                      Filesize

                                      30B

                                      MD5

                                      aba880e8d68c1ddc29af3b2fdb32a896

                                      SHA1

                                      8611c3e60d702e34f17a00e15f0ba4253ef00179

                                      SHA256

                                      a2ec5866c667c1261f906973133c39b1889db748852275ce9aa4a410e360fbd3

                                      SHA512

                                      36727e71873a241207283576279f7bc14ec67c92c09a3661a4e248a32dfd7a3f3ac44d031906b0547ec67ab171470bd129a9b7623a0f708d9214bf12b399282c

                                    • C:\Users\Admin\AppData\Local\Temp\1009342001\VBVEd6f.exe

                                      Filesize

                                      1.1MB

                                      MD5

                                      7f8c660bbf823d65807e4164a91dd058

                                      SHA1

                                      97ac83cbe12b04fbe1b4d98e812480e1f66d577d

                                      SHA256

                                      5a45b35e922d52f1bc47530634465ed1f989d9916684bf9591006a6172542509

                                      SHA512

                                      89872cc15ca3a91d43b0b4261b04c38b8ac545c9b4afdb47d2b0288167b512fbe709de04fd2d1809ca1afee67a5a799aa7943f5aff65a5aa3197f9e10545c919

                                    • C:\Users\Admin\AppData\Local\Temp\1009351041\PeRVAzl.ps1

                                      Filesize

                                      3.0MB

                                      MD5

                                      2b918bf4566595e88a664111ce48b161

                                      SHA1

                                      e32fbdf64bb71dc870bfad9bbd571f11c6a723f4

                                      SHA256

                                      48492827286d403668996ae3814b2216b3b616f2fb4af2022bf3d2fc3f979a26

                                      SHA512

                                      e3d58adbe13befe91fb950cc52b16d6d2fcb8f6d65bab4020222713207b07ce78b76e2e2532cf3de23149e934ba1e1cb9046a95a18424a668bfa4a355af6f44a

                                    • C:\Users\Admin\AppData\Local\Temp\1009542001\bc4113c669.exe

                                      Filesize

                                      4.3MB

                                      MD5

                                      0473a8e8e6d92ece5fe21d23552391d2

                                      SHA1

                                      5f8b811f0df1a5c7c5de0d7d20965809b120e034

                                      SHA256

                                      42c6787fac49fff1f3b622983357d0346048598dd8c7f790fcabd5ed5503a127

                                      SHA512

                                      7672688ee9e1c7a204b03d611c110c2930b7a46559111379b34d5abac2d0ce6b38dcc52060fc855e6620cc5fff54ae5783358b0b7d2df24d4e5439427efaa0b7

                                    • C:\Users\Admin\AppData\Local\Temp\1009543001\05f1bed00a.exe

                                      Filesize

                                      1.8MB

                                      MD5

                                      2beba791d39cfddddf945d36f85141dc

                                      SHA1

                                      24aef72a20886655340a60f36d076e56c240d983

                                      SHA256

                                      3e02bdb0b14763d8bf75b22c8d2e17252761304cae329e4d69b9082dddaaf958

                                      SHA512

                                      8e99ca3f90ebe567200f482f66fdec9eb9a695a32e6dbaf16768437e428059f2490a2a3138f26c83cfd84bf9216e5f399e675bd4faffddbf224329b405823cfe

                                    • C:\Users\Admin\AppData\Local\Temp\1009544001\d9d72b2ebd.exe

                                      Filesize

                                      1.7MB

                                      MD5

                                      7201b45617fddde515846336e78d95b2

                                      SHA1

                                      a00afe2646990b1ba446d282143f0b717a61663c

                                      SHA256

                                      715feed9e8e28808cd140b740f3e456c17258fac1ad8c098cf68fe73b355d3bb

                                      SHA512

                                      1978ecfb11a3564a7b3f215a833d7ca5d9459577be4cf894828c758feac931ffa3dfa1bc2c8eb4f7477445ca88bf598606e4f42ccb7c76cd5d597bcb8d92ea10

                                    • C:\Users\Admin\AppData\Local\Temp\1009545001\a608ee9925.exe

                                      Filesize

                                      900KB

                                      MD5

                                      acdda6bed858e47c7154c1bf9440f92b

                                      SHA1

                                      a043e28b26ef1446470e331abcf4917601c20348

                                      SHA256

                                      f8b791be04ffc8d7b3ed60c9283bb7ac1afc1f1fc53ec30530cd779711201e23

                                      SHA512

                                      46c8adf0434f049dc3d4efb51dc00081dc38650f9bc2526c8916aca7be979478036b739fd60380e2c312e4116418fd58f059dd1d052851a0952dfdc512874a4d

                                    • C:\Users\Admin\AppData\Local\Temp\1009546001\7da9e2c7cb.exe

                                      Filesize

                                      2.6MB

                                      MD5

                                      e61785a3a3d383435c9e19bf3b694811

                                      SHA1

                                      88d531034fcb42649a2e28be1e391450f090dbfc

                                      SHA256

                                      29d54aefca55bfbdf08555b15e4361226b87e81dee3ee26b965e263bc8ddb48e

                                      SHA512

                                      fc1bf899d3d4f079f45da99383d7175dfbbcbe5a3da21c504d80199420a9f2c2aea644188fbddfb148f5b78dcbb3d06878ca7bb0d4657ac1e8e88d91f83cdd6e

                                    • C:\Users\Admin\AppData\Local\Temp\397506\k

                                      Filesize

                                      540KB

                                      MD5

                                      c3f398f77bbc21294aa17caf6b0e6994

                                      SHA1

                                      9753fe7ddb15ab965155838192ca6aed909ff56b

                                      SHA256

                                      776d72e984f777c04609464a94576539908202dece7b8631feee29ab5b6ece50

                                      SHA512

                                      6b43a9bc32725c3e25abae17f6a7accb83b13f446479f1253630b72ab3c4ccb3dd4e36be26cf65b910f36f3bf3b48138c3c2684782dd361477a7e4e2bb4ac463

                                    • C:\Users\Admin\AppData\Local\Temp\Answers

                                      Filesize

                                      97KB

                                      MD5

                                      287cadd3b072c264654b2e6e2566fb2b

                                      SHA1

                                      5e382082ef2dcfcb9b0312b9d8d76ac07625449e

                                      SHA256

                                      c3bcb56ffda3326608d754fdae6fa5785161206d8c9f06abbfa6f0cf3a05e459

                                      SHA512

                                      3c3988f6810772f112f2d05b8b4baf31c23ac1e0b441be93c9552fb2f64eec8d8779b3da2d08515cdbbf41140e8500a2982712fefbd6c8b03ad3168b1b21c734

                                    • C:\Users\Admin\AppData\Local\Temp\Appreciate

                                      Filesize

                                      15KB

                                      MD5

                                      cf4a755aa7bfb2afae9d7b0bae7a56cb

                                      SHA1

                                      f6fe9d88779c3277c86c52918fc050c585007d93

                                      SHA256

                                      2853c2f9d3db94ea67286c50a896f30c0eb4914763d8d74b450ac3faeea2c5d2

                                      SHA512

                                      bc185b1886fe438418b282df25d234b92f80386697bdd743d568849de572776439d0336263b3b9ffc4d6994e79316747e4483067ead4c5b8ec5ed09f6f592967

                                    • C:\Users\Admin\AppData\Local\Temp\Benefits

                                      Filesize

                                      51KB

                                      MD5

                                      31772333ac1e8ac850ac86b9fda3ee23

                                      SHA1

                                      153a8bf471248744befd0fff259d515c875b4b1f

                                      SHA256

                                      a9101d5b78c38b72c53eed0ec896c4fbaa3bfdc9f72cd5c44688b48d66e31b6c

                                      SHA512

                                      7ebfe1dab4d62a0174487b70ccb7befdab182d1bc6f2f0319a27a7bc7b398e87968bbc6b59e4bf3058a5ebfabb2efe96561535c6b01d44943ab82ea26e0a488b

                                    • C:\Users\Admin\AppData\Local\Temp\Bufing

                                      Filesize

                                      59KB

                                      MD5

                                      8d89a2fed5fe22eb7fd25f7f84feefc1

                                      SHA1

                                      7f9b5b806071b312b4d9e95391d6d96dbd66dde3

                                      SHA256

                                      5c16191e8d38db8381d2e67a324d0dc481c97f2647010a1b343e26277ab2d689

                                      SHA512

                                      88b04c9030d1ad1844f05134682c3a9b3adfabdfb22d1145d730a6508ff4ea0a81e21e46f493ff715acb9d3a4e6bb341c885d8b735cea601a86b8e54e9a52b12

                                    • C:\Users\Admin\AppData\Local\Temp\CabD867.tmp

                                      Filesize

                                      70KB

                                      MD5

                                      49aebf8cbd62d92ac215b2923fb1b9f5

                                      SHA1

                                      1723be06719828dda65ad804298d0431f6aff976

                                      SHA256

                                      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                      SHA512

                                      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                    • C:\Users\Admin\AppData\Local\Temp\Concept

                                      Filesize

                                      74KB

                                      MD5

                                      ba279e43bc3824f4dd387a5a6c15bd60

                                      SHA1

                                      857ce7750d1bf83461965e5069f6734c483ceae4

                                      SHA256

                                      fff37d64d11ab1cd68e00abf6774656e314388b6cca79fc19e01e33e7bd8c688

                                      SHA512

                                      c91b53e8c4b674ab7219e0b41899f95828aecf32b86733174a20700f9d70e658063b1ee26368412c977dd1b3aa812b82073d8d2d3321c3504c4d68c3cb50b784

                                    • C:\Users\Admin\AppData\Local\Temp\Filter

                                      Filesize

                                      872KB

                                      MD5

                                      6ee7ddebff0a2b78c7ac30f6e00d1d11

                                      SHA1

                                      f2f57024c7cc3f9ff5f999ee20c4f5c38bfc20a2

                                      SHA256

                                      865347471135bb5459ad0e647e75a14ad91424b6f13a5c05d9ecd9183a8a1cf4

                                      SHA512

                                      57d56de2bb882f491e633972003d7c6562ef2758c3731b913ff4d15379ada575062f4de2a48ca6d6d9241852a5b8a007f52792753fd8d8fee85b9a218714efd0

                                    • C:\Users\Admin\AppData\Local\Temp\Guides

                                      Filesize

                                      51KB

                                      MD5

                                      1214c7903301b6105f1751d35f8677a6

                                      SHA1

                                      43097cbab70e5007ed435eca7839cf693310a632

                                      SHA256

                                      9021d861a44500218566588391a3a17f1b1f0b00ab781b27fad7f57a1aa46c52

                                      SHA512

                                      93e1b42da3aa5bf7809ac8e4c51fe9bbffc53b54997b0e877c2adeb3d2459f8cde91ab3cd7913146491d5ded88a6b6815fc3b44f4d59844d7e4baa78e6ed37bc

                                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\computerlead.exe

                                      Filesize

                                      1.1MB

                                      MD5

                                      2354e800eefc681a7d60f3b6b28acfd9

                                      SHA1

                                      10b6a3d9d2283b5f98c9924fa1fca6da79edb720

                                      SHA256

                                      d3c21f6c3892f0c444ffb4b06f962caddf68d2c3938bbd399a3056db255007e3

                                      SHA512

                                      0395737b77891d8cf7761266c2b3d594deb8e742bd5f12f15f58b2c161c242356b953ebf8cd1f41924a917b2c1332bd2e05ef275efd2419a6134a60729195354

                                    • C:\Users\Admin\AppData\Local\Temp\Mix

                                      Filesize

                                      92KB

                                      MD5

                                      ebcaa458524017b6b69e50610fdcdfdc

                                      SHA1

                                      dde54c9c52267d42df70d932182413757a524050

                                      SHA256

                                      95365d774498df62fb358077e847f1dbad95ba6d09b1d6cc76c22d35b0bc9118

                                      SHA512

                                      dd146de78e15a86184350ef355cf48b63abbdeda20c10d6bc7507a8699f55e1bc80250986a9cb091f621e9cc5b34cdac552f7ad95f6aed7b09c3988d89471e22

                                    • C:\Users\Admin\AppData\Local\Temp\Ram

                                      Filesize

                                      66KB

                                      MD5

                                      d6e907bcb5843d6825949565bb20cab4

                                      SHA1

                                      722862a965ce62a21ee20b0b1fb80aa3ca1fdead

                                      SHA256

                                      5339cbc5d3fc6aacdcf8a4ff313696b3c23af83a6823f779d769a647df85750b

                                      SHA512

                                      f1563a7b3a2f102fc6eff61b35736c2cc3d0bde304532485afb88c434152d283096415905d5c7accf0ea6394fd3e8c1c5b34957688241f14befdba88a0d7bcea

                                    • C:\Users\Admin\AppData\Local\Temp\TarD889.tmp

                                      Filesize

                                      181KB

                                      MD5

                                      4ea6026cf93ec6338144661bf1202cd1

                                      SHA1

                                      a1dec9044f750ad887935a01430bf49322fbdcb7

                                      SHA256

                                      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                      SHA512

                                      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                    • C:\Users\Admin\AppData\Local\Temp\Trunk

                                      Filesize

                                      50KB

                                      MD5

                                      63b9ae899f5a5c8bfe0ab9d6d583bd01

                                      SHA1

                                      013d6416534001cb5be061efd020af56e47eea1f

                                      SHA256

                                      e0cfff56e7141f31a568781504048ad5e0308b22227629d4e2885a58a0499b18

                                      SHA512

                                      bcadf064b072a29a34ef4593161d8ee7bbe3e1079b1bf08dc7422249fe4181e881084a98b5ac3edbbacbe9de0c3d6804c7f4b2694a51f74840e89f6bca117e3d

                                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                      Filesize

                                      442KB

                                      MD5

                                      85430baed3398695717b0263807cf97c

                                      SHA1

                                      fffbee923cea216f50fce5d54219a188a5100f41

                                      SHA256

                                      a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                                      SHA512

                                      06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                      Filesize

                                      8.0MB

                                      MD5

                                      a01c5ecd6108350ae23d2cddf0e77c17

                                      SHA1

                                      c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                                      SHA256

                                      345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                                      SHA512

                                      b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\datareporting\glean\db\data.safe.bin

                                      Filesize

                                      2KB

                                      MD5

                                      11a6bab382e145f5d13ea6ae5983d7eb

                                      SHA1

                                      8f65a966b1423e2a75650929c514a09f25e2f0d4

                                      SHA256

                                      51b873071e7638bead3a197be5007d7c9c181f7d8cdd818d539a0a9a3c35c343

                                      SHA512

                                      1d55c65f61f4a7e0ebce80ee26bd359bbca1bbcaf4917a71e518f97c5c55f406de6828e08e90c61574f2d5a14079f953e195f54e7edb6c6b690f7f34d9fec723

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\datareporting\glean\pending_pings\1d6eabb8-5811-4874-b420-489276ca3b1f

                                      Filesize

                                      745B

                                      MD5

                                      061be7023c7eaabe74a0711a547f8cd9

                                      SHA1

                                      fcc3dfc2951509de1e3da9236f56c3e12e545b77

                                      SHA256

                                      accbfb14c9f62c185b37fbc11ce24c2cbe153c7d63049d3bf271c0c2769cc523

                                      SHA512

                                      a5c0de7ff0a6582454bfa658dcbde29c3cda1d3d18c00f81827bfd990b1031984dff7e84d7c17be0e456848e6a7a79b8a369281408a8b32918b32ed922b79958

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\datareporting\glean\pending_pings\4d3aabee-d7f2-4297-8eb7-af8e435e46a4

                                      Filesize

                                      11KB

                                      MD5

                                      b740b191c2e716ea4c0ce77be8cc3c26

                                      SHA1

                                      c491fead8d73b7154e3c134e73e4f25ddae3e1c8

                                      SHA256

                                      b501876006f6b34e41a5762c36b389208cd04f9f19333130d5207d243fb3fc90

                                      SHA512

                                      0d2b931934f3b3490a255cce7772263f1c3d323f13d51c1f82bc0545a4adee628793ee34bb5c0bf83cfa9b44300afc17fdfde51e188ecef8fa1971ac8826777b

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                                      Filesize

                                      997KB

                                      MD5

                                      fe3355639648c417e8307c6d051e3e37

                                      SHA1

                                      f54602d4b4778da21bc97c7238fc66aa68c8ee34

                                      SHA256

                                      1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                                      SHA512

                                      8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                                      Filesize

                                      116B

                                      MD5

                                      3d33cdc0b3d281e67dd52e14435dd04f

                                      SHA1

                                      4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                                      SHA256

                                      f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                                      SHA512

                                      a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                                      Filesize

                                      479B

                                      MD5

                                      49ddb419d96dceb9069018535fb2e2fc

                                      SHA1

                                      62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                                      SHA256

                                      2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                                      SHA512

                                      48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                                      Filesize

                                      372B

                                      MD5

                                      8be33af717bb1b67fbd61c3f4b807e9e

                                      SHA1

                                      7cf17656d174d951957ff36810e874a134dd49e0

                                      SHA256

                                      e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                                      SHA512

                                      6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                                      Filesize

                                      11.8MB

                                      MD5

                                      33bf7b0439480effb9fb212efce87b13

                                      SHA1

                                      cee50f2745edc6dc291887b6075ca64d716f495a

                                      SHA256

                                      8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                                      SHA512

                                      d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                                      Filesize

                                      1KB

                                      MD5

                                      688bed3676d2104e7f17ae1cd2c59404

                                      SHA1

                                      952b2cdf783ac72fcb98338723e9afd38d47ad8e

                                      SHA256

                                      33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                                      SHA512

                                      7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                                      Filesize

                                      1KB

                                      MD5

                                      937326fead5fd401f6cca9118bd9ade9

                                      SHA1

                                      4526a57d4ae14ed29b37632c72aef3c408189d91

                                      SHA256

                                      68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                                      SHA512

                                      b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\prefs-1.js

                                      Filesize

                                      7KB

                                      MD5

                                      e3da86a5cbfb7c12a23d78ecc6f96608

                                      SHA1

                                      89deecac31ce730ac6ecd6187652a3e30bad6e3c

                                      SHA256

                                      cc6ea43152d810cc7666003793a9a588b00b6727d75c0ee2de76be5fbb661647

                                      SHA512

                                      60b726bf47f4e6e68401573fdb4e3c934371f1e670f1c36e7aeefc5db1bd36ff1fbbfb93ab8de9614c172192b749c3d29cd3840e24e3b910723f8258092fd511

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\prefs-1.js

                                      Filesize

                                      7KB

                                      MD5

                                      83712fee726bf8a3017a06ded251fcd0

                                      SHA1

                                      54926c6a0d4aba54b724858b10d3826d04536190

                                      SHA256

                                      c8387e8a7e21e5bfe760fb591f9a90ce1bd9005ddb4b972e14447f45470442a1

                                      SHA512

                                      af7b6b9e8e8e8bcc42c40927ec2acc1dd489168111b8738af49b1743e8f247f99905a5241a2234fab9703872404b9e7b3763d78934bc59a7275aa61c52428fca

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\prefs-1.js

                                      Filesize

                                      6KB

                                      MD5

                                      7a6749d5ccdb79f600f206e287ed65e0

                                      SHA1

                                      6d65005e6f2907676963ddea6690e48bee617563

                                      SHA256

                                      eeb24ab1ae89d08af03afe6395e1a55db93d16cb3f07de310941b123e7a02e4e

                                      SHA512

                                      3b7358c435dc39a3f5305a9cd5e4d42e8eae7590f2ecd46b4adda9c0831171c5b91da3becde17b1a8c111aa1c53bc9eab209e9663ea64b094579c33ca06313cf

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\sessionstore-backups\recovery.jsonlz4

                                      Filesize

                                      4KB

                                      MD5

                                      b022b4b6f54d73ae54bb6ea590536657

                                      SHA1

                                      80139346d0ee2803f788ff8f8b2b55500c26e4ab

                                      SHA256

                                      9a565e5040693051b26b652cf29c1d74d4c43a4a0f71910c9d81bb7fc95687b1

                                      SHA512

                                      280474bde006901176a3113e49ca4c867b78790b8acf44c9f0423b3123d597c3de575ddd29fa3aff2349779f269f3e309955806b13b043cb15c1717f3bb81225

                                    • \Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

                                      Filesize

                                      1.8MB

                                      MD5

                                      9a612228c9f2ed059ed4d47809793b1d

                                      SHA1

                                      50bfcb257336d3251865f07f69f65591a2bd41bb

                                      SHA256

                                      44e6b37ca76b0297d26d40de3f1c96fb04705cc236e24a93a564012a6f6be896

                                      SHA512

                                      ed1381301bfa27e39a2c92f54462f75d96dfe3753254c1532d788f149ff9bd448fb0c75269d092b65df6003b400801aa86f8a3c3f534c54fe9b9a8ac810f9d53

                                    • memory/556-1103-0x0000000000B00000-0x0000000000B06000-memory.dmp

                                      Filesize

                                      24KB

                                    • memory/556-57-0x0000000000920000-0x0000000000946000-memory.dmp

                                      Filesize

                                      152KB

                                    • memory/556-56-0x0000000001000000-0x0000000001126000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/556-1101-0x0000000000AE0000-0x0000000000AFA000-memory.dmp

                                      Filesize

                                      104KB

                                    • memory/884-809-0x0000000000E70000-0x0000000001502000-memory.dmp

                                      Filesize

                                      6.6MB

                                    • memory/884-797-0x0000000000E70000-0x0000000001502000-memory.dmp

                                      Filesize

                                      6.6MB

                                    • memory/1316-646-0x0000000001380000-0x000000000200F000-memory.dmp

                                      Filesize

                                      12.6MB

                                    • memory/1316-758-0x0000000001380000-0x000000000200F000-memory.dmp

                                      Filesize

                                      12.6MB

                                    • memory/1644-18-0x0000000007240000-0x000000000770C000-memory.dmp

                                      Filesize

                                      4.8MB

                                    • memory/1644-17-0x00000000013D0000-0x000000000189C000-memory.dmp

                                      Filesize

                                      4.8MB

                                    • memory/1644-5-0x00000000013D0000-0x000000000189C000-memory.dmp

                                      Filesize

                                      4.8MB

                                    • memory/1644-3-0x00000000013D0000-0x000000000189C000-memory.dmp

                                      Filesize

                                      4.8MB

                                    • memory/1644-2-0x00000000013D1000-0x00000000013FF000-memory.dmp

                                      Filesize

                                      184KB

                                    • memory/1644-1-0x00000000773C0000-0x00000000773C2000-memory.dmp

                                      Filesize

                                      8KB

                                    • memory/1644-0-0x00000000013D0000-0x000000000189C000-memory.dmp

                                      Filesize

                                      4.8MB

                                    • memory/1952-776-0x0000000000E40000-0x00000000012E9000-memory.dmp

                                      Filesize

                                      4.7MB

                                    • memory/1952-765-0x0000000000E40000-0x00000000012E9000-memory.dmp

                                      Filesize

                                      4.7MB

                                    • memory/2084-1085-0x0000000003AB0000-0x0000000003D1D000-memory.dmp

                                      Filesize

                                      2.4MB

                                    • memory/2084-886-0x0000000003AB0000-0x0000000003D1D000-memory.dmp

                                      Filesize

                                      2.4MB

                                    • memory/2084-684-0x0000000003AB0000-0x0000000003D1D000-memory.dmp

                                      Filesize

                                      2.4MB

                                    • memory/2084-694-0x0000000003AB0000-0x0000000003D1D000-memory.dmp

                                      Filesize

                                      2.4MB

                                    • memory/2084-704-0x0000000003AB0000-0x0000000003D1D000-memory.dmp

                                      Filesize

                                      2.4MB

                                    • memory/2084-1213-0x0000000003AB0000-0x0000000003D1D000-memory.dmp

                                      Filesize

                                      2.4MB

                                    • memory/2084-1186-0x0000000003AB0000-0x0000000003D1D000-memory.dmp

                                      Filesize

                                      2.4MB

                                    • memory/2084-558-0x0000000003AB0000-0x0000000003D1D000-memory.dmp

                                      Filesize

                                      2.4MB

                                    • memory/2084-557-0x0000000003AB0000-0x0000000003D1D000-memory.dmp

                                      Filesize

                                      2.4MB

                                    • memory/2084-1164-0x0000000003AB0000-0x0000000003D1D000-memory.dmp

                                      Filesize

                                      2.4MB

                                    • memory/2084-556-0x0000000003AB0000-0x0000000003D1D000-memory.dmp

                                      Filesize

                                      2.4MB

                                    • memory/2084-555-0x0000000003AB0000-0x0000000003D1D000-memory.dmp

                                      Filesize

                                      2.4MB

                                    • memory/2084-554-0x0000000003AB0000-0x0000000003D1D000-memory.dmp

                                      Filesize

                                      2.4MB

                                    • memory/2084-1123-0x0000000003AB0000-0x0000000003D1D000-memory.dmp

                                      Filesize

                                      2.4MB

                                    • memory/2084-553-0x0000000003AB0000-0x0000000003D1D000-memory.dmp

                                      Filesize

                                      2.4MB

                                    • memory/2084-665-0x0000000003AB0000-0x0000000003D1D000-memory.dmp

                                      Filesize

                                      2.4MB

                                    • memory/2084-1011-0x0000000003AB0000-0x0000000003D1D000-memory.dmp

                                      Filesize

                                      2.4MB

                                    • memory/2084-799-0x0000000003AB0000-0x0000000003D1D000-memory.dmp

                                      Filesize

                                      2.4MB

                                    • memory/2084-911-0x0000000003AB0000-0x0000000003D1D000-memory.dmp

                                      Filesize

                                      2.4MB

                                    • memory/2084-889-0x0000000003AB0000-0x0000000003D1D000-memory.dmp

                                      Filesize

                                      2.4MB

                                    • memory/2084-827-0x0000000003AB0000-0x0000000003D1D000-memory.dmp

                                      Filesize

                                      2.4MB

                                    • memory/2084-828-0x0000000003AB0000-0x0000000003D1D000-memory.dmp

                                      Filesize

                                      2.4MB

                                    • memory/2084-850-0x0000000003AB0000-0x0000000003D1D000-memory.dmp

                                      Filesize

                                      2.4MB

                                    • memory/2084-888-0x0000000003AB0000-0x0000000003D1D000-memory.dmp

                                      Filesize

                                      2.4MB

                                    • memory/2916-58-0x00000000002B0000-0x000000000077C000-memory.dmp

                                      Filesize

                                      4.8MB

                                    • memory/2916-29-0x0000000002680000-0x0000000002681000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2916-1375-0x00000000002B0000-0x000000000077C000-memory.dmp

                                      Filesize

                                      4.8MB

                                    • memory/2916-810-0x00000000002B0000-0x000000000077C000-memory.dmp

                                      Filesize

                                      4.8MB

                                    • memory/2916-20-0x00000000002B0000-0x000000000077C000-memory.dmp

                                      Filesize

                                      4.8MB

                                    • memory/2916-21-0x0000000002470000-0x0000000002472000-memory.dmp

                                      Filesize

                                      8KB

                                    • memory/2916-22-0x0000000002510000-0x0000000002511000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2916-23-0x0000000002450000-0x0000000002451000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2916-796-0x0000000006B80000-0x0000000007212000-memory.dmp

                                      Filesize

                                      6.6MB

                                    • memory/2916-24-0x0000000002690000-0x0000000002691000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2916-25-0x00000000008F0000-0x00000000008F1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2916-26-0x0000000002290000-0x0000000002291000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2916-1327-0x00000000002B0000-0x000000000077C000-memory.dmp

                                      Filesize

                                      4.8MB

                                    • memory/2916-1091-0x00000000064F0000-0x0000000006794000-memory.dmp

                                      Filesize

                                      2.6MB

                                    • memory/2916-27-0x0000000002440000-0x0000000002441000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2916-1090-0x0000000006B80000-0x0000000007212000-memory.dmp

                                      Filesize

                                      6.6MB

                                    • memory/2916-534-0x00000000002B0000-0x000000000077C000-memory.dmp

                                      Filesize

                                      4.8MB

                                    • memory/2916-35-0x00000000002B0000-0x000000000077C000-memory.dmp

                                      Filesize

                                      4.8MB

                                    • memory/2916-34-0x00000000002B0000-0x000000000077C000-memory.dmp

                                      Filesize

                                      4.8MB

                                    • memory/2916-28-0x0000000002460000-0x0000000002461000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2916-887-0x0000000006B80000-0x0000000007029000-memory.dmp

                                      Filesize

                                      4.7MB

                                    • memory/2916-777-0x0000000006B80000-0x000000000780F000-memory.dmp

                                      Filesize

                                      12.6MB

                                    • memory/2916-30-0x0000000002280000-0x0000000002281000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2916-31-0x0000000002230000-0x0000000002231000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2916-1287-0x00000000002B0000-0x000000000077C000-memory.dmp

                                      Filesize

                                      4.8MB

                                    • memory/2916-1279-0x00000000064F0000-0x0000000006794000-memory.dmp

                                      Filesize

                                      2.6MB

                                    • memory/2916-32-0x00000000002B1000-0x00000000002DF000-memory.dmp

                                      Filesize

                                      184KB

                                    • memory/2916-645-0x0000000006B80000-0x000000000780F000-memory.dmp

                                      Filesize

                                      12.6MB

                                    • memory/2916-1205-0x00000000002B0000-0x000000000077C000-memory.dmp

                                      Filesize

                                      4.8MB

                                    • memory/2916-613-0x00000000002B0000-0x000000000077C000-memory.dmp

                                      Filesize

                                      4.8MB

                                    • memory/2916-763-0x0000000006B80000-0x0000000007029000-memory.dmp

                                      Filesize

                                      4.7MB

                                    • memory/2948-77-0x0000000000400000-0x000000000045B000-memory.dmp

                                      Filesize

                                      364KB

                                    • memory/2948-81-0x0000000000400000-0x000000000045B000-memory.dmp

                                      Filesize

                                      364KB

                                    • memory/2948-79-0x0000000000400000-0x000000000045B000-memory.dmp

                                      Filesize

                                      364KB

                                    • memory/2948-84-0x0000000000400000-0x000000000045B000-memory.dmp

                                      Filesize

                                      364KB

                                    • memory/2948-85-0x0000000000400000-0x000000000045B000-memory.dmp

                                      Filesize

                                      364KB

                                    • memory/2948-87-0x0000000000400000-0x000000000045B000-memory.dmp

                                      Filesize

                                      364KB

                                    • memory/2948-89-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2948-90-0x0000000000400000-0x000000000045B000-memory.dmp

                                      Filesize

                                      364KB

                                    • memory/2948-92-0x0000000000400000-0x000000000045B000-memory.dmp

                                      Filesize

                                      364KB

                                    • memory/3212-1283-0x0000000000280000-0x0000000000524000-memory.dmp

                                      Filesize

                                      2.6MB

                                    • memory/3212-1104-0x0000000000280000-0x0000000000524000-memory.dmp

                                      Filesize

                                      2.6MB

                                    • memory/3212-1092-0x0000000000280000-0x0000000000524000-memory.dmp

                                      Filesize

                                      2.6MB

                                    • memory/3212-1114-0x0000000000280000-0x0000000000524000-memory.dmp

                                      Filesize

                                      2.6MB

                                    • memory/3212-1280-0x0000000000280000-0x0000000000524000-memory.dmp

                                      Filesize

                                      2.6MB

                                    • memory/3528-1130-0x0000000000400000-0x0000000000481000-memory.dmp

                                      Filesize

                                      516KB

                                    • memory/3528-1138-0x0000000000400000-0x0000000000481000-memory.dmp

                                      Filesize

                                      516KB

                                    • memory/3528-1136-0x0000000000400000-0x0000000000481000-memory.dmp

                                      Filesize

                                      516KB

                                    • memory/3528-1128-0x0000000000400000-0x0000000000481000-memory.dmp

                                      Filesize

                                      516KB

                                    • memory/3528-1140-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3528-1134-0x0000000000400000-0x0000000000481000-memory.dmp

                                      Filesize

                                      516KB

                                    • memory/3528-1132-0x0000000000400000-0x0000000000481000-memory.dmp

                                      Filesize

                                      516KB

                                    • memory/4000-1384-0x00000000010D0000-0x00000000010DC000-memory.dmp

                                      Filesize

                                      48KB