Overview

overview

10

Static

static

3

766cc2b1f9...44.exe

windows7-x64

10

766cc2b1f9...44.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-11-2024 10:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    766cc2b1f9e6dcc1f07a870fb0817f600252d758c09b5ad18466ca9b2a2a3644.exe

  • Size

    1.8MB

  • MD5

    ad432846853d57476d7b1b1063114709

  • SHA1

    ead985339d84415064720ac088cb12ff0ef0fe69

  • SHA256

    766cc2b1f9e6dcc1f07a870fb0817f600252d758c09b5ad18466ca9b2a2a3644

  • SHA512

    b73504caad497f34b9023f605c6f10bd1c81d779464f98bf624c1db48e73265cb6ac538f7ef5a8ee1e87f85c8c45a440da7ed77cf52e2c3078e1b31ccf9285e1

  • SSDEEP

    49152:fbf1+D8s1ITM7ZzPqEdb9fyu7TwzLX8rkuDif4BTsUn:fbsD8s1Waqw97TwXMrkuOf4B1n

Score
10/10
amadeylummastealcxmrig9c9aa5drumdiscoveryevasionexecutionminerpersistencestealertrojanupx

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Language
ps1
Source
URLs
exe.dropper

http://encrypthub.net:8080
exe.dropper

https://encrypthub.net/Main/antivm.ps1

Extracted

Family

lumma

Extracted

Family

stealc

Botnet

drum

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Xmrig family
    xmrig
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 12 IoCs
    evasion
  • XMRig Miner payload 12 IoCs
    miner
  • Blocklisted process makes network request 9 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 24 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 17 IoCs
  • Identifies Wine through registry keys 2 TTPs 12 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 3 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\766cc2b1f9e6dcc1f07a870fb0817f600252d758c09b5ad18466ca9b2a2a3644.exe
    "C:\Users\Admin\AppData\Local\Temp\766cc2b1f9e6dcc1f07a870fb0817f600252d758c09b5ad18466ca9b2a2a3644.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1696
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1404
      • C:\Users\Admin\AppData\Local\Temp\1010306001\XXM5y4g.exe
        "C:\Users\Admin\AppData\Local\Temp\1010306001\XXM5y4g.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4708
      • C:\Users\Admin\AppData\Local\Temp\1010410001\lnwtLq4.exe
        "C:\Users\Admin\AppData\Local\Temp\1010410001\lnwtLq4.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1540
      • C:\Users\Admin\AppData\Local\Temp\1010425001\XW5qFPl.exe
        "C:\Users\Admin\AppData\Local\Temp\1010425001\XW5qFPl.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2364
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\Local\Temp\ps72F.tmp.ps1"
          4⤵
          • Blocklisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:808
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ys0zpqra\ys0zpqra.cmdline"
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4564
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2304.tmp" "c:\Users\Admin\AppData\Local\Temp\ys0zpqra\CSC36F6CF407A1B4D10A070258EFA515628.TMP"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4432
      • C:\Users\Admin\AppData\Local\Temp\1010433001\gU8ND0g.exe
        "C:\Users\Admin\AppData\Local\Temp\1010433001\gU8ND0g.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:664
        • C:\Windows\SYSTEM32\attrib.exe
          attrib +H +S C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe
          4⤵
          • Views/modifies file attributes
          PID:2612
        • C:\Windows\SYSTEM32\attrib.exe
          attrib +H C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe
          4⤵
          • Views/modifies file attributes
          PID:2644
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /f /CREATE /TN "MicrosoftEdgeUpdateTaskMachineCoreSC" /TR "C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe" /SC MINUTE
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:3320
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell ping 127.0.0.1; del gU8ND0g.exe
          4⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4796
          • C:\Windows\system32\PING.EXE
            "C:\Windows\system32\PING.EXE" 127.0.0.1
            5⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:1980
      • C:\Users\Admin\AppData\Local\Temp\1010592001\1d6130a212.exe
        "C:\Users\Admin\AppData\Local\Temp\1010592001\1d6130a212.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2428
      • C:\Users\Admin\AppData\Local\Temp\1010593001\ca3c31fd94.exe
        "C:\Users\Admin\AppData\Local\Temp\1010593001\ca3c31fd94.exe"
        3⤵
        • Enumerates VirtualBox registry keys
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:224
      • C:\Users\Admin\AppData\Local\Temp\1010594001\19e719e1a8.exe
        "C:\Users\Admin\AppData\Local\Temp\1010594001\19e719e1a8.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • System Location Discovery: System Language Discovery
        PID:4252
      • C:\Users\Admin\AppData\Local\Temp\1010595001\137367a1ec.exe
        "C:\Users\Admin\AppData\Local\Temp\1010595001\137367a1ec.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1716
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 1648
          4⤵
          • Program crash
          PID:5640
      • C:\Users\Admin\AppData\Local\Temp\1010596001\9436bd2ae0.exe
        "C:\Users\Admin\AppData\Local\Temp\1010596001\9436bd2ae0.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2584
      • C:\Users\Admin\AppData\Local\Temp\1010597001\396c679d98.exe
        "C:\Users\Admin\AppData\Local\Temp\1010597001\396c679d98.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:3932
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM firefox.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:1056
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM chrome.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:3140
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM msedge.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:1600
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM opera.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:3180
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM brave.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:4764
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
          4⤵
            PID:3320
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
              5⤵
              • Checks processor information in registry
              • Modifies registry class
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              PID:4636
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2024 -parentBuildID 20240401114208 -prefsHandle 1948 -prefMapHandle 1940 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c1f5c7d-0610-4c0a-b461-ab9151343452} 4636 "\\.\pipe\gecko-crash-server-pipe.4636" gpu
                6⤵
                  PID:3996
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2448 -parentBuildID 20240401114208 -prefsHandle 2444 -prefMapHandle 2440 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a49ed14d-0ac4-40a6-bc95-7243d9fdbc3a} 4636 "\\.\pipe\gecko-crash-server-pipe.4636" socket
                  6⤵
                    PID:4420
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3208 -childID 1 -isForBrowser -prefsHandle 2968 -prefMapHandle 2944 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cfb6f5fa-6faa-4eff-b87d-f92fadb77e77} 4636 "\\.\pipe\gecko-crash-server-pipe.4636" tab
                    6⤵
                      PID:3692
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4052 -childID 2 -isForBrowser -prefsHandle 4216 -prefMapHandle 4064 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b43bcb1f-1998-43ac-839e-184f983209e4} 4636 "\\.\pipe\gecko-crash-server-pipe.4636" tab
                      6⤵
                        PID:5316
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4348 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4756 -prefMapHandle 4752 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9dd5264f-b63a-49c1-9245-f12199759f49} 4636 "\\.\pipe\gecko-crash-server-pipe.4636" utility
                        6⤵
                        • Checks processor information in registry
                        PID:6104
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5072 -childID 3 -isForBrowser -prefsHandle 5064 -prefMapHandle 5060 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {774a27ec-cb67-4156-9c6f-06b001cc4657} 4636 "\\.\pipe\gecko-crash-server-pipe.4636" tab
                        6⤵
                          PID:6412
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5128 -childID 4 -isForBrowser -prefsHandle 5336 -prefMapHandle 5332 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d20928a0-4a0c-48fc-92ce-c0fd100520e6} 4636 "\\.\pipe\gecko-crash-server-pipe.4636" tab
                          6⤵
                            PID:6428
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5536 -childID 5 -isForBrowser -prefsHandle 5456 -prefMapHandle 5460 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e4d82fc9-fa0b-45d1-b68b-6aeaedd00782} 4636 "\\.\pipe\gecko-crash-server-pipe.4636" tab
                            6⤵
                              PID:6440
                      • C:\Users\Admin\AppData\Local\Temp\1010598001\0efa46b852.exe
                        "C:\Users\Admin\AppData\Local\Temp\1010598001\0efa46b852.exe"
                        3⤵
                        • Modifies Windows Defender Real-time Protection settings
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Windows security modification
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2868
                  • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                    C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4020
                  • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                    C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1056
                  • C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe
                    C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:4916
                    • C:\Windows\explorer.exe
                      explorer.exe
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of FindShellTrayWindow
                      PID:4212
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell ping 127.1.0.1; del MicrosoftEdgeUpdateTaskMachineCoreSC.exe
                      2⤵
                      • System Network Configuration Discovery: Internet Connection Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:4604
                      • C:\Windows\system32\PING.EXE
                        "C:\Windows\system32\PING.EXE" 127.1.0.1
                        3⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Runs ping.exe
                        PID:1576
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1716 -ip 1716
                    1⤵
                      PID:5616
                    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:6288
                    • C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe
                      C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe
                      1⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:6100
                      • C:\Windows\explorer.exe
                        explorer.exe
                        2⤵
                          PID:6788
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell ping 127.1.0.1; del MicrosoftEdgeUpdateTaskMachineCoreSC.exe
                          2⤵
                          • System Network Configuration Discovery: Internet Connection Discovery
                          PID:6796
                          • C:\Windows\system32\PING.EXE
                            "C:\Windows\system32\PING.EXE" 127.1.0.1
                            3⤵
                            • System Network Configuration Discovery: Internet Connection Discovery
                            • Runs ping.exe
                            PID:5384

                      Network

                      MITRE ATT&CK Enterprise v15

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Command and Scripting Interpreter

                      1
                      T1059

                      PowerShell

                      1
                      T1059.001

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Create or Modify System Process

                      1
                      T1543

                      Windows Service

                      1
                      T1543.003

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Create or Modify System Process

                      1
                      T1543

                      Windows Service

                      1
                      T1543.003

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Defense Evasion

                      Hide Artifacts

                      1
                      T1564

                      Hidden Files and Directories

                      1
                      T1564.001

                      Impair Defenses

                      2
                      T1562

                      Disable or Modify Tools

                      2
                      T1562.001

                      Modify Registry

                      3
                      T1112

                      Virtualization/Sandbox Evasion

                      3
                      T1497

                      Credential Access

                      Discovery

                      Query Registry

                      8
                      T1012

                      Remote System Discovery

                      1
                      T1018

                      System Information Discovery

                      4
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      System Network Configuration Discovery

                      1
                      T1016

                      Internet Connection Discovery

                      1
                      T1016.001

                      Virtualization/Sandbox Evasion

                      3
                      T1497

                      Lateral Movement

                      Collection

                      Command and Control

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                        Filesize

                        2KB

                        MD5

                        6cf293cb4d80be23433eecf74ddb5503

                        SHA1

                        24fe4752df102c2ef492954d6b046cb5512ad408

                        SHA256

                        b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                        SHA512

                        0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                        Filesize

                        53KB

                        MD5

                        3341c22b37e2d64da556fdb016b45690

                        SHA1

                        bfc7a93c96ad4ad7b503b7d67a30dd05cefc12c5

                        SHA256

                        fbbb944a979c6fb8b4050e39977a8778dcd4662c09755ead816a75bb95fb8647

                        SHA512

                        ded7f8add1236a634ac7aa12f402250a0ba38922db8879823088720fbaef617552e0ebdd427472078db3fe12fa0ce3594b9cf54e6a917c5f35534c28dc91e7e0

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                        Filesize

                        53KB

                        MD5

                        124edf3ad57549a6e475f3bc4e6cfe51

                        SHA1

                        80f5187eeebb4a304e9caa0ce66fcd78c113d634

                        SHA256

                        638c51e173ca6b3469494a7e2e0b656021a761f77b4a83f3e430e82e7b9af675

                        SHA512

                        b6c1a9051feeffad54ba1092fd799d34a9578368d7e66b31780fe478c1def0eb4094dce2879003f7389f2f9d86b94a3ef3975e78092a604597841c9b8db120ee

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        Filesize

                        1KB

                        MD5

                        b0a78e60bfb279d18fd3d6e7a67411f5

                        SHA1

                        9344fe3654a14bc66afb9dc6ea215fabfbe5c906

                        SHA256

                        a28890c82033d3deaf5770ecd1b0239c77321acc93704b1d4b1e167b91e30aeb

                        SHA512

                        9548be23bec645cd705482f78d43b63659e38cf879c34f7071f42fd86ee02039379a5e92fbe0f1c74c12aaebabdd8002f57eba111d3e855cbd0c89a110e346f2

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        Filesize

                        1KB

                        MD5

                        bb4769e4102fb9d0744e63c2499344bf

                        SHA1

                        6edd5dd2b4841718827439413a176af7e5a48a18

                        SHA256

                        ce9d24bf86a4319180a6182c5462792c527716794251fb6926eb622557b015ee

                        SHA512

                        5b1e99f37ee1d352b7e48af3671d6a6b81402daaa85829899dcbe1308fe5db55d57d674521bc6652aa09293c95fba76395f98be055c7f826a2520bd6f434c20e

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\activity-stream.discovery_stream.json
                        Filesize

                        22KB

                        MD5

                        710e7006ea8b5e58775432bcb3a09466

                        SHA1

                        0ed3be7e2cab57dc898385e984b975a3b4b6c6fd

                        SHA256

                        7cf3108df1aa52f4e7f48d47feb7d7aa44859e6dc2b577d477c7c97ad341ad99

                        SHA512

                        5593ad249b083304aad3f9598e8bcce80dfdff09c08de6ffcdf55fcd05abacd62daa037b0b31ec3368a1e52ab749b6ed312693d359a7129bc43965d15d13e732

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878
                        Filesize

                        13KB

                        MD5

                        c8c4e2277c29c2d82d17ccdd5e87f41b

                        SHA1

                        a28e8789eb23c86df1cd79ddde1a8f42b69b1304

                        SHA256

                        f1fcdc8bee3fc79a4f86e7a0da8ff580867125ef5ca136c69c61b03383e67c05

                        SHA512

                        1e5fb7d19e5fda1882fce5ede47cc81098b985ce9bbb226293eab08ddb49de1084542179fc7966a8a45a9b87011d07880ef589e4dc684696bb54929e433c7f78

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
                        Filesize

                        13KB

                        MD5

                        085752b7fa5c1aa2d057785c40b67d36

                        SHA1

                        61af193a0150b8e2a4285ada4124f825b3a6a916

                        SHA256

                        d94d3c098b8bfcb801d63b78ecaa87415dc72f09e587744be9f9a58c1ceda13d

                        SHA512

                        a7ebac8cda3b6b90d66e655ac73c3e8314861189901ba4f3ceae152ea8ba711b9b0e974839b3737f6891f22011d335846a1e674f583a9fde6a7ff773d9820c80

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1010306001\XXM5y4g.exe
                        Filesize

                        4.0MB

                        MD5

                        14f4f9bee0a9b56c8993f1a65b520391

                        SHA1

                        ba5a2f0cb27a753dbc33cd0b4eaa4f042aa01949

                        SHA256

                        151c86eb2ad872cee3ccddc569c1ae99d93df55d2cf601070fb682da65894f93

                        SHA512

                        8a73a00816a101fdaca29d57a2b76da46c3cbcdbc995d1f44b8f02bc0949b72a707b5dd92b96396e0b3c1de7ba65b22cf62eda24c8bc157fda4c6d938fee749c

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1010410001\lnwtLq4.exe
                        Filesize

                        14.1MB

                        MD5

                        3475c7d37c7995451275305684114989

                        SHA1

                        648098615ca3a981ff8154063ee78f95359a7769

                        SHA256

                        7b029d45fdab9e8feee93e443b9b179c6d4010810ba2dde3f2611bf24a7f09a4

                        SHA512

                        5154d0b550b5df31ea070e8000a50c970bf13020dd2a133e5648aac60c9958ed4f3a2ea8d6ad0e1f513e94b6352dda269fd27044aba33bb6ce88f6fe17f547af

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1010425001\XW5qFPl.exe
                        Filesize

                        224KB

                        MD5

                        dd15cf2bfc32f80e24ca203869cdf7a0

                        SHA1

                        d65e41d3e892c26d31d64bd129d0de29b4729df2

                        SHA256

                        3373ad6983c5f596d6c022403fabc1642b957de64b3d5ea7360a11d2c862c040

                        SHA512

                        28f2ced84d162d86aea6dd508869292c484cd0907f338b9185500a1301144191e32eeb596833d4333c3ef819102887044007952ed93ba04dddbd8b23fd3b650b

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1010433001\gU8ND0g.exe
                        Filesize

                        2.2MB

                        MD5

                        4c64aec6c5d6a5c50d80decb119b3c78

                        SHA1

                        bc97a13e661537be68863667480829e12187a1d7

                        SHA256

                        75c7692c0f989e63e14c27b4fb7d25f93760068a4ca4e90fa636715432915253

                        SHA512

                        9054e3c8306999fe851b563a826ca7a87c4ba78c900cd3b445f436e8406f581e5c3437971a1f1dea3f5132c16a1b36c2dd09f2c97800d28e7157bd7dc3ac3e76

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1010592001\1d6130a212.exe
                        Filesize

                        1.9MB

                        MD5

                        ac44247e8835b336845ad56b84583656

                        SHA1

                        ff499dadf0fd0f90d3e156ba2d521367678be35e

                        SHA256

                        e1a6fe984f3ffc681defb85678e20fb0fa1c4afe1a8e99dc974dc3253a04b371

                        SHA512

                        0a9476d193084f2232301734cb558b2e5bf56e59d73c2e6f418c51c0592e4b350e19855c3b4a7ca95c19fe071baf3ff097ee0b68077d9976f68600a0266f15d5

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1010593001\ca3c31fd94.exe
                        Filesize

                        4.2MB

                        MD5

                        904bbdf992562f081562d83ac2966973

                        SHA1

                        bb2426df996af31757a32714d9cac9be302b18c6

                        SHA256

                        db2f5c5f62b4da09b2766a8602ae6ca44ca104210147e7281322afb0f2735b39

                        SHA512

                        e5ccf425fada85f53238db5a0539f5c8a3843aa1e39c7178c82430628456c37accf96fd0861a05a3a2a67742d28b6e315765126f039fdf3fdce6f963b3ce5d8e

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1010594001\19e719e1a8.exe
                        Filesize

                        4.3MB

                        MD5

                        d3a6b0fc90aa053987d7565f37e8e5fa

                        SHA1

                        d04d066334694263685695bfd279b0f0db819e0b

                        SHA256

                        45c2c4a4fea92e3f445fda74024cd2de21817fb29c476ba00d3f892b5c3afcb9

                        SHA512

                        61fadc664f1de30c9e477f8e16c4fdf6ca8af317b851e042b25de7ece3f3285ada45ee77cdbc9523d541c67285ea1aae084ada21f457ca359faaf8bb9dfafdd1

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1010595001\137367a1ec.exe
                        Filesize

                        1.8MB

                        MD5

                        c95e16fa85212d7cc42cc9f60bf9aff0

                        SHA1

                        fb4b7cba8662fa25801a9391897b89003b5db01a

                        SHA256

                        1de83d3da10d2ad6b08aeb687648d4ee5dd7226b69900e665668979f4157d3c1

                        SHA512

                        ac099074dbe2563705bc501e4111330d65b4e50cde790f6f9926d2f31aa4a6f68ac9965f5dcce4ff9dfa4c5f87f173e3710cdc0e1e964f45e65c217fe07bcdab

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1010596001\9436bd2ae0.exe
                        Filesize

                        1.8MB

                        MD5

                        920221b4876c778fad4ec6aad2d12c1e

                        SHA1

                        a7996f976af7a68a7277f86e829bda7f8794ed15

                        SHA256

                        916e3c38f646207dd403fb1a6d3d147b1c28073a8f4c6a2b246e9fa3d9b1c205

                        SHA512

                        1011872e25ab03edc5423abd069eaa44e1501e2095bd5b54d4891c8e71614b6d1275e0b1fd691f91edabb340ca704f344c20efee03f863042f8421e162a93755

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1010597001\396c679d98.exe
                        Filesize

                        901KB

                        MD5

                        925eef0676269737c20b2059405b5d13

                        SHA1

                        31610b248537727b1311be39a1d8d1809b4af95a

                        SHA256

                        15ee7f1968d130f455f69e5ce8c30a89097e02f589fd160993c7d9957208c777

                        SHA512

                        3b5433270d63a5379039d72cee0edecd0c4e5c7b23ede97181b19543eadc9f9c25dc3dc7416d2f90ba37c8483818fd35f90f2405b834830d7fa49f6377de3a13

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1010598001\0efa46b852.exe
                        Filesize

                        2.6MB

                        MD5

                        20d566a1116bc4c2fc3ab0e1ec71a486

                        SHA1

                        b5f26b08f112a496d83a700d97905a1e3136913c

                        SHA256

                        6de56e6d486aa66998da88665456086a2c159b54db96cbab2fd600c4c5f6cf79

                        SHA512

                        a896e317e46f3ec45c9f4a36a1128fca8d71075174665d9609d0e265009baad1f4450e7c904aee650aaf9b41eb44bec93e2bd13af7bc243e77dd6a514c6ad527

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\RES2304.tmp
                        Filesize

                        1KB

                        MD5

                        7cefe55f289bc082efbad32629909492

                        SHA1

                        eae06a27f23daa5a94c459ced48b39687e22327c

                        SHA256

                        e1021a015c1e515233398fe986fecd2136fdaf9039784e85b5b26b6ab1c8f99d

                        SHA512

                        c76e49fbfee965da303671560a44bbdc1c435613e471a5ee51d9036b7c95fd0bb62535c0a44cb1a2dadbb2ab1d3f55c4593e7c48591ca8a8925c97a1c719f502

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cnjur0s5.guu.ps1
                        Filesize

                        60B

                        MD5

                        d17fe0a3f47be24a6453e9ef58c94641

                        SHA1

                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                        SHA256

                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                        SHA512

                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                        Filesize

                        1.8MB

                        MD5

                        ad432846853d57476d7b1b1063114709

                        SHA1

                        ead985339d84415064720ac088cb12ff0ef0fe69

                        SHA256

                        766cc2b1f9e6dcc1f07a870fb0817f600252d758c09b5ad18466ca9b2a2a3644

                        SHA512

                        b73504caad497f34b9023f605c6f10bd1c81d779464f98bf624c1db48e73265cb6ac538f7ef5a8ee1e87f85c8c45a440da7ed77cf52e2c3078e1b31ccf9285e1

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\ps72F.tmp.ps1
                        Filesize

                        4KB

                        MD5

                        6a67d58617fb9923f8b51746dab46333

                        SHA1

                        51d6afa54aa92c82f755511d3c9029e73b17ac9e

                        SHA256

                        679d28798cf9618b7be8f7d6bd669c2f4501cec6e780d9f59510021742162a47

                        SHA512

                        31a9915591bcce34cb0a139e93d29d56b740295eb6e1a7d5254f591fbf77bb007d6a28737f79959d86c0392486aa4f84a6f6ff64bb151d8dcb36ed5e177d8dfe

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                        Filesize

                        479KB

                        MD5

                        09372174e83dbbf696ee732fd2e875bb

                        SHA1

                        ba360186ba650a769f9303f48b7200fb5eaccee1

                        SHA256

                        c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                        SHA512

                        b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                        Filesize

                        13.8MB

                        MD5

                        0a8747a2ac9ac08ae9508f36c6d75692

                        SHA1

                        b287a96fd6cc12433adb42193dfe06111c38eaf0

                        SHA256

                        32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                        SHA512

                        59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\ys0zpqra\ys0zpqra.dll
                        Filesize

                        3KB

                        MD5

                        07aabbf7650b2de0cd88d440f05b61b6

                        SHA1

                        a87964a77aec61502ba228fa83f5ec0faaa5f604

                        SHA256

                        6b0f1fb0ecafa786f2a66b11cc534fe45af3cdab39479f660b4ed1a3ff445160

                        SHA512

                        275c31579abb50ade9bc8b96aafb231d6ad97589764526657dc52bad05f7e8b117b6ae616030a4d8a57697fb519a2b02c9b59f067b32a5c79e006e15c3c80bb8

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin
                        Filesize

                        13KB

                        MD5

                        c4922b3098f7e3a01c07674bbf18bf1b

                        SHA1

                        cff3639142ce9fb6ecff4d1da528bfb81e15ba1b

                        SHA256

                        f2ec2fce016e7f76eca556f2487d7859f0a060f48a80ff23379a2244de420851

                        SHA512

                        fa8da9c630f2471a5d21476fd26f7063cd44f8a1387ee24dec7188d6d55ceb0aac8bfd8de5d89c9e263bef6e7b152f43485dcac8e9426d3a6cc3e4fa29a5645b

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
                        Filesize

                        5KB

                        MD5

                        69a91e008a223ae9598bfbf9e8c167a4

                        SHA1

                        c598a672c308ead115c82c61f154325c35ccc854

                        SHA256

                        14ce68f483c8a5d2f9ccc000f3a7d813ea3ebeacd78ce486ee0b0fa6d693f420

                        SHA512

                        550e9e09e99863aa0cae4fdbf281a95ad914e39b43e1de90209969555780aab17f6f017f2ce586c0c17b3275007064c9d5daece0ccc71e29ff7f3a265e8cc846

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
                        Filesize

                        15KB

                        MD5

                        addc2b5c077a9c3f7b324eb849b9d6e7

                        SHA1

                        b23a0b7167090d32beb2f2b9700452d08f2c16fe

                        SHA256

                        5d8e0e7288c8758b7d8cbc1baec19ffa03ccde994ba2c5443a02017bef814fa8

                        SHA512

                        c0cf0b11d8731fec9abc6084babdfa2b3d3ffb73f9d238aec51372323bc7cdef166ca7dbf23ab1d7e3865522b6f5b6bedfdc27774056ce2717a82b18e45e3f5b

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
                        Filesize

                        15KB

                        MD5

                        39ce0dbb2e66f932af7e1cc1fa3f86b9

                        SHA1

                        6239c20c1bf884b44b2d250c21d0cfa043bab5ea

                        SHA256

                        2f469cea84c4f4c196d56dd7d23dd044362f64be9cba59eb5d79dcbe60d4e202

                        SHA512

                        fd3f0504c1c2242d337aaef1cc094062f643559e844dbe58527441993ec2a4a0ef68f583bf415c68d3f71b75762b9b53f630d53d2465f9bf9c81058e722afcc9

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
                        Filesize

                        6KB

                        MD5

                        eda7d35df8f4c1d0b26506cd5b05546f

                        SHA1

                        6f912f08edf7b33634b6135c4fc509925debd305

                        SHA256

                        63b43823d726ee8f4835c07b9a463a38d7b4d974e439191c9c3d7afce6b9acb1

                        SHA512

                        72f25c89df645df43343a66c95c81371a4bf878147cc73e37adee98b9da6356de637421a6c6bf3879459fd821d333588c0fcc07d00d86d2627be51615c6fee30

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\89e4f11d-5d48-45e5-b5e4-60840f13089b
                        Filesize

                        982B

                        MD5

                        574fa46b7ca664913523caabac335066

                        SHA1

                        74c8600d81714946af6ae7be3c6e938bb3fdffa3

                        SHA256

                        7fd22dce52eb44e2a48da5f4c00f110b5e8bc818d2dffbd6eea6b489b6dd64c3

                        SHA512

                        9bbce62271873909baf079a72ab1d9a49d2b815be88bd98320524da54d0394149d2a7b6f4fe83812a0d5069faa3dad807281daafb90ebbae6fcdef458d61e95b

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\c03597b1-c6b5-415b-a800-62fd1904dbc0
                        Filesize

                        28KB

                        MD5

                        c68a1f9597f375e8ddfc7cf5a35dbd63

                        SHA1

                        be7a719ef29ddbcec425ab0c79dfde955fb6e689

                        SHA256

                        08c519db96057fb1b876ac95ecbe07f7f89414523119dde51a4008c48fc5f898

                        SHA512

                        cb7ba1d5260cbbec34666b10b837d32c9e55777929f4b12f942aa2268bb7f0b79dd9e9afe4591c2d4eef0fe45f10fd236a22e9a1e9007765d057abdae03f8275

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\f9cfecaf-6df5-4e33-8c2d-b20f8c241632
                        Filesize

                        671B

                        MD5

                        2f45b2fc23dae99c05945a77fce2cf78

                        SHA1

                        3b1418776f6f89942f34b0a4990475fa663a9a3e

                        SHA256

                        7badf6c76fd484002be53f0df621adb254e136de0e54166b7847fe2645df737f

                        SHA512

                        22db363cf74892b18b52c99740c6acb49709ef9db40bab827a8f9df44ed5829705c9d65e1cb95317b0b4ae9d1f027478158c6def7114337d3b4c318039e28b43

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                        Filesize

                        1.1MB

                        MD5

                        842039753bf41fa5e11b3a1383061a87

                        SHA1

                        3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                        SHA256

                        d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                        SHA512

                        d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                        Filesize

                        116B

                        MD5

                        2a461e9eb87fd1955cea740a3444ee7a

                        SHA1

                        b10755914c713f5a4677494dbe8a686ed458c3c5

                        SHA256

                        4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                        SHA512

                        34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                        Filesize

                        372B

                        MD5

                        bf957ad58b55f64219ab3f793e374316

                        SHA1

                        a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                        SHA256

                        bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                        SHA512

                        79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                        Filesize

                        17.8MB

                        MD5

                        daf7ef3acccab478aaa7d6dc1c60f865

                        SHA1

                        f8246162b97ce4a945feced27b6ea114366ff2ad

                        SHA256

                        bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                        SHA512

                        5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js
                        Filesize

                        15KB

                        MD5

                        5fb4826b04b41de23f935e6f4d85bfc6

                        SHA1

                        4cf105eb4b13d2913b1537f93230db6460495dc5

                        SHA256

                        47144e60d44e47f51a0bb269241d1003f0becb9576bbcf66139368b6ea7edc59

                        SHA512

                        2a3026a40cb31e39745f81edef0fe48741b6f26ab44d64f65477c2912b809e32cf00489a41cfae91da14722bc833a3754fac1731ac8486f2fb4f8d6fb770ef93

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs.js
                        Filesize

                        10KB

                        MD5

                        cb625cba421d6277f5f109d0692f0f26

                        SHA1

                        4e765c8f80dc273c2c189842ca1b6317eb3de225

                        SHA256

                        288d4ac1bac9eacf28d22255520d5269374b31e257fda093e2e5d8cb34690282

                        SHA512

                        c802e58a2049b0e01ced6ad7b1932823e685861eee1bddae2486a807030d3534bbc3204522f12c115c6e70c06d00e9a8e0b3f2bedd93a165852a867a7ca9e0fb

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs.js
                        Filesize

                        10KB

                        MD5

                        5f032acb5a528c0e5c03233f1e839f74

                        SHA1

                        b6980ecdf20f6b0f90b142f7288f7161fded80c4

                        SHA256

                        4bb7f54daac362f2247b9f1fecb7ff5ac2c16c0ee21d0d58b3efc5ad3b0ddb28

                        SHA512

                        ad227f0e6fa7dfd6b4f3c385273e2aa58fcacce2d326a7da4f12ceb6da666b7fbf74e82dfcb1b3f6601443b58cee818a5d2a75f6c62b4f597386178fa576bf6b

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs.js
                        Filesize

                        12KB

                        MD5

                        27eac4410204e0be353e0625f9926603

                        SHA1

                        4f2da2bae876244fcc1fa1c473911f58f889a8c7

                        SHA256

                        67d77453cec70f135334487c8e4e2742979385f67938066f233ebdb0d87ee6a1

                        SHA512

                        a3149485ae19834659ecc9040718d26fb64779e0445329ff623bc0899771fe237517dfeb9b3654356c3b387b90815b6430fceae54f1ae72239e6231318453ae8

                        Download Submit

                      • \??\c:\Users\Admin\AppData\Local\Temp\ys0zpqra\CSC36F6CF407A1B4D10A070258EFA515628.TMP
                        Filesize

                        652B

                        MD5

                        a95cbe73dda45479e05b9e028a0589f7

                        SHA1

                        8d47188b0f6cbfd3f07a72104761b5bc9ff5687e

                        SHA256

                        b090481d73ed01dfc6fa05339da9612e4aaed652d9598aad1d5c96de51773a40

                        SHA512

                        68d2a0643c98a72269fcec4ef65b35ce16ddca089927d0de2f9eb8482b1b018cece26459343c9372f33e79cd7812c524b0d8eb548487bfa010aafa24e29ed429

                        Download Submit

                      • \??\c:\Users\Admin\AppData\Local\Temp\ys0zpqra\ys0zpqra.0.cs
                        Filesize

                        512B

                        MD5

                        a36c5dbd22147371b4ea6ffacb560fb6

                        SHA1

                        e7248cd6a49d3aae9439efdffaceeacad6a7c523

                        SHA256

                        fc874c6cbd59c24e83702e0cd6f301c4a929865687d8e0d041090a2bcd801a60

                        SHA512

                        256b2e0beea6305f21024d60acdb0dcc84c2da46824d1c0610a9a22fa0e8c1753271140db278baf26e260c381f13001be1e8c651b01a178ca0922a2ab1bf4361

                        Download Submit

                      • \??\c:\Users\Admin\AppData\Local\Temp\ys0zpqra\ys0zpqra.cmdline
                        Filesize

                        369B

                        MD5

                        186e265cf2b1c24f3817f8b134807ed5

                        SHA1

                        a166f542522e63852961d4cd0e6d7a201b56972e

                        SHA256

                        182da3daf20557fe0f1379de46051d238270b7c9b8ef51562351052afcfc59db

                        SHA512

                        e9856165b221597af746b9fb66ecb69ea014cfb4007b747d24a9a3caf3ab412810bd50a5f826611a4971fdd4412de6835393ac53bfb4a0637695ac385de445a4

                        Download Submit

                      • memory/224-242-0x00000000008B0000-0x0000000001547000-memory.dmp

                        Filesize

                        12.6MB

                        Download

                      • memory/224-219-0x00000000008B0000-0x0000000001547000-memory.dmp

                        Filesize

                        12.6MB

                        Download

                      • memory/808-122-0x0000000007730000-0x0000000007DAA000-memory.dmp

                        Filesize

                        6.5MB

                        Download

                      • memory/808-125-0x0000000007360000-0x00000000073F6000-memory.dmp

                        Filesize

                        600KB

                        Download

                      • memory/808-141-0x0000000007F80000-0x0000000008142000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/808-145-0x0000000008680000-0x0000000008BAC000-memory.dmp

                        Filesize

                        5.2MB

                        Download

                      • memory/808-130-0x0000000007350000-0x0000000007358000-memory.dmp

                        Filesize

                        32KB

                        Download

                      • memory/808-157-0x0000000007DD0000-0x0000000007DFA000-memory.dmp

                        Filesize

                        168KB

                        Download

                      • memory/808-161-0x0000000007E00000-0x0000000007E24000-memory.dmp

                        Filesize

                        144KB

                        Download

                      • memory/808-162-0x0000000009160000-0x0000000009704000-memory.dmp

                        Filesize

                        5.6MB

                        Download

                      • memory/808-163-0x00000000081F0000-0x0000000008282000-memory.dmp

                        Filesize

                        584KB

                        Download

                      • memory/808-129-0x0000000007400000-0x000000000741A000-memory.dmp

                        Filesize

                        104KB

                        Download

                      • memory/808-128-0x0000000007310000-0x0000000007324000-memory.dmp

                        Filesize

                        80KB

                        Download

                      • memory/808-91-0x00000000047C0000-0x00000000047F6000-memory.dmp

                        Filesize

                        216KB

                        Download

                      • memory/808-127-0x0000000007300000-0x000000000730E000-memory.dmp

                        Filesize

                        56KB

                        Download

                      • memory/808-126-0x00000000072C0000-0x00000000072D1000-memory.dmp

                        Filesize

                        68KB

                        Download

                      • memory/808-177-0x0000000004AD0000-0x0000000004AD8000-memory.dmp

                        Filesize

                        32KB

                        Download

                      • memory/808-109-0x0000000006F80000-0x0000000006FB2000-memory.dmp

                        Filesize

                        200KB

                        Download

                      • memory/808-124-0x0000000007150000-0x000000000715A000-memory.dmp

                        Filesize

                        40KB

                        Download

                      • memory/808-92-0x0000000004F30000-0x0000000005558000-memory.dmp

                        Filesize

                        6.2MB

                        Download

                      • memory/808-195-0x0000000008340000-0x0000000008362000-memory.dmp

                        Filesize

                        136KB

                        Download

                      • memory/808-123-0x00000000070F0000-0x000000000710A000-memory.dmp

                        Filesize

                        104KB

                        Download

                      • memory/808-93-0x0000000004E00000-0x0000000004E22000-memory.dmp

                        Filesize

                        136KB

                        Download

                      • memory/808-94-0x00000000056D0000-0x0000000005736000-memory.dmp

                        Filesize

                        408KB

                        Download

                      • memory/808-95-0x0000000005740000-0x00000000057A6000-memory.dmp

                        Filesize

                        408KB

                        Download

                      • memory/808-105-0x00000000057B0000-0x0000000005B04000-memory.dmp

                        Filesize

                        3.3MB

                        Download

                      • memory/808-121-0x0000000006FC0000-0x0000000007063000-memory.dmp

                        Filesize

                        652KB

                        Download

                      • memory/808-107-0x0000000005DC0000-0x0000000005E0C000-memory.dmp

                        Filesize

                        304KB

                        Download

                      • memory/808-106-0x0000000005D80000-0x0000000005D9E000-memory.dmp

                        Filesize

                        120KB

                        Download

                      • memory/808-120-0x00000000063C0000-0x00000000063DE000-memory.dmp

                        Filesize

                        120KB

                        Download

                      • memory/808-110-0x000000006FC20000-0x000000006FC6C000-memory.dmp

                        Filesize

                        304KB

                        Download

                      • memory/1056-261-0x00000000004A0000-0x000000000094A000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1056-263-0x00000000004A0000-0x000000000094A000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1404-41-0x00000000004A0000-0x000000000094A000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1404-21-0x00000000004A0000-0x000000000094A000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1404-48-0x00000000004A0000-0x000000000094A000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1404-3220-0x00000000004A0000-0x000000000094A000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1404-47-0x00000000004A0000-0x000000000094A000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1404-725-0x00000000004A0000-0x000000000094A000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1404-45-0x00000000004A0000-0x000000000094A000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1404-3212-0x00000000004A0000-0x000000000094A000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1404-171-0x00000000004A0000-0x000000000094A000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1404-332-0x00000000004A0000-0x000000000094A000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1404-3139-0x00000000004A0000-0x000000000094A000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1404-737-0x00000000004A0000-0x000000000094A000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1404-2016-0x00000000004A0000-0x000000000094A000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1404-67-0x00000000004A0000-0x000000000094A000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1404-51-0x00000000004A0000-0x000000000094A000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1404-973-0x00000000004A0000-0x000000000094A000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1404-22-0x00000000004A0000-0x000000000094A000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1404-220-0x00000000004A0000-0x000000000094A000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1404-16-0x00000000004A0000-0x000000000094A000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1404-259-0x00000000004A0000-0x000000000094A000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1696-18-0x0000000000530000-0x00000000009DA000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1696-4-0x0000000000530000-0x00000000009DA000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1696-3-0x0000000000530000-0x00000000009DA000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1696-2-0x0000000000531000-0x000000000055F000-memory.dmp

                        Filesize

                        184KB

                        Download

                      • memory/1696-0-0x0000000000530000-0x00000000009DA000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1696-1-0x0000000077804000-0x0000000077806000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/1716-297-0x00000000000A0000-0x0000000000547000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1716-258-0x00000000000A0000-0x0000000000547000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1716-312-0x00000000000A0000-0x0000000000547000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1716-729-0x00000000000A0000-0x0000000000547000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1716-718-0x00000000000A0000-0x0000000000547000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/2428-2349-0x0000000000400000-0x00000000008C2000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/2428-747-0x0000000000400000-0x00000000008C2000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/2428-222-0x0000000000400000-0x00000000008C2000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/2428-194-0x0000000000400000-0x00000000008C2000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/2428-333-0x0000000000400000-0x00000000008C2000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/2428-223-0x0000000000400000-0x00000000008C2000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/2428-1148-0x0000000000400000-0x00000000008C2000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/2428-727-0x0000000000400000-0x00000000008C2000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/2428-3200-0x0000000000400000-0x00000000008C2000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/2428-268-0x0000000000400000-0x00000000008C2000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/2428-3213-0x0000000000400000-0x00000000008C2000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/2428-3222-0x0000000000400000-0x00000000008C2000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/2584-299-0x0000000000200000-0x00000000008B7000-memory.dmp

                        Filesize

                        6.7MB

                        Download

                      • memory/2584-295-0x0000000000200000-0x00000000008B7000-memory.dmp

                        Filesize

                        6.7MB

                        Download

                      • memory/2868-731-0x0000000000E40000-0x00000000010E0000-memory.dmp

                        Filesize

                        2.6MB

                        Download

                      • memory/2868-734-0x0000000000E40000-0x00000000010E0000-memory.dmp

                        Filesize

                        2.6MB

                        Download

                      • memory/2868-363-0x0000000000E40000-0x00000000010E0000-memory.dmp

                        Filesize

                        2.6MB

                        Download

                      • memory/2868-362-0x0000000000E40000-0x00000000010E0000-memory.dmp

                        Filesize

                        2.6MB

                        Download

                      • memory/2868-358-0x0000000000E40000-0x00000000010E0000-memory.dmp

                        Filesize

                        2.6MB

                        Download

                      • memory/4020-25-0x00000000004A1000-0x00000000004CF000-memory.dmp

                        Filesize

                        184KB

                        Download

                      • memory/4020-20-0x00000000004A0000-0x000000000094A000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/4020-49-0x00000000004A0000-0x000000000094A000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/4020-24-0x00000000004A0000-0x000000000094A000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/4212-3224-0x0000000140000000-0x00000001408F6000-memory.dmp

                        Filesize

                        9.0MB

                        Download

                      • memory/4212-272-0x0000000140000000-0x00000001408F6000-memory.dmp

                        Filesize

                        9.0MB

                        Download

                      • memory/4212-279-0x0000000140000000-0x00000001408F6000-memory.dmp

                        Filesize

                        9.0MB

                        Download

                      • memory/4212-280-0x0000000140000000-0x00000001408F6000-memory.dmp

                        Filesize

                        9.0MB

                        Download

                      • memory/4212-265-0x0000000140000000-0x00000001408F6000-memory.dmp

                        Filesize

                        9.0MB

                        Download

                      • memory/4212-266-0x0000000140000000-0x00000001408F6000-memory.dmp

                        Filesize

                        9.0MB

                        Download

                      • memory/4212-267-0x0000000140000000-0x00000001408F6000-memory.dmp

                        Filesize

                        9.0MB

                        Download

                      • memory/4212-269-0x0000000140000000-0x00000001408F6000-memory.dmp

                        Filesize

                        9.0MB

                        Download

                      • memory/4212-278-0x0000000140000000-0x00000001408F6000-memory.dmp

                        Filesize

                        9.0MB

                        Download

                      • memory/4212-277-0x0000000140000000-0x00000001408F6000-memory.dmp

                        Filesize

                        9.0MB

                        Download

                      • memory/4212-276-0x0000000140000000-0x00000001408F6000-memory.dmp

                        Filesize

                        9.0MB

                        Download

                      • memory/4212-274-0x0000000140000000-0x00000001408F6000-memory.dmp

                        Filesize

                        9.0MB

                        Download

                      • memory/4212-273-0x00000000028F0000-0x0000000002910000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/4212-3225-0x0000000140000000-0x00000001408F6000-memory.dmp

                        Filesize

                        9.0MB

                        Download

                      • memory/4212-3223-0x0000000140000000-0x00000001408F6000-memory.dmp

                        Filesize

                        9.0MB

                        Download

                      • memory/4212-271-0x0000000140000000-0x00000001408F6000-memory.dmp

                        Filesize

                        9.0MB

                        Download

                      • memory/4212-311-0x0000000140000000-0x00000001408F6000-memory.dmp

                        Filesize

                        9.0MB

                        Download

                      • memory/4212-270-0x0000000140000000-0x00000001408F6000-memory.dmp

                        Filesize

                        9.0MB

                        Download

                      • memory/4252-238-0x0000000000E80000-0x0000000001B0D000-memory.dmp

                        Filesize

                        12.6MB

                        Download

                      • memory/4252-240-0x0000000000E80000-0x0000000001B0D000-memory.dmp

                        Filesize

                        12.6MB

                        Download

                      • memory/4708-46-0x0000000000250000-0x0000000000BC8000-memory.dmp

                        Filesize

                        9.5MB

                        Download

                      • memory/4708-50-0x0000000000250000-0x0000000000BC8000-memory.dmp

                        Filesize

                        9.5MB

                        Download

                      • memory/4796-150-0x000002AD4AF10000-0x000002AD4AF32000-memory.dmp

                        Filesize

                        136KB

                        Download

                      • memory/6288-3175-0x00000000004A0000-0x000000000094A000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/6288-3149-0x00000000004A0000-0x000000000094A000-memory.dmp

                        Filesize

                        4.7MB

                        Download