Overview

overview

10

Static

static

3

a1a647f34c...6c.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-12-2024 21:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a1a647f34c4a8583f720a1042e570cdca073f8303b9245765d49a809d017466c.exe

  • Size

    6.9MB

  • MD5

    e58c50d1d193f4f718e949fd72e60afa

  • SHA1

    6130753cb7e2fffba27e7079a0b44f603e37c611

  • SHA256

    a1a647f34c4a8583f720a1042e570cdca073f8303b9245765d49a809d017466c

  • SHA512

    b092c6230f7736d0f8308bc73bce8509e9dd029806901557a8a1ac56310fdc2e49a6a5d13c014ef105006ce0c6ec20d4bc2934216bf6fc9803d53feb19072cc5

  • SSDEEP

    98304:07u2bgZJJu5WEsXtf5NICKbdyljXB09t4ktMYydmMUFYcRvnoykBs6koSUMT6lMa:WsJJaBEf5KbFxGsFloyX6kvKM

Score
10/10
amadeylummastealc397a179c9aa5stokdiscoveryevasionpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://atten-supporse.biz/api

https://infect-crackle.cyou/api

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

amadey

Version

5.04

Botnet

397a17

C2

http://89.110.69.103

http://94.156.177.33
Attributes
  • install_dir

    0efeaab28d

  • install_file

    Gxtuum.exe

  • strings_key

    6dea7a0890c1d404d1b67c90aea6ece4

  • url_paths

    /Lv2D7fGdopb/index.php

    /b9kdj3s3C0/index.php

rc4.plain

Extracted

Family

lumma

C2

https://atten-supporse.biz/api

https://se-blurry.biz/api

https://zinc-sneark.biz/api

https://infect-crackle.cyou/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs
    evasion
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 22 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 25 IoCs
  • Identifies Wine through registry keys 2 TTPs 11 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 3 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\a1a647f34c4a8583f720a1042e570cdca073f8303b9245765d49a809d017466c.exe
    "C:\Users\Admin\AppData\Local\Temp\a1a647f34c4a8583f720a1042e570cdca073f8303b9245765d49a809d017466c.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3652
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\D1L61.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\D1L61.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2912
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\L0O43.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\L0O43.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2700
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Y45c5.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Y45c5.exe
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4636
          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
            "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1112
            • C:\Users\Admin\AppData\Local\Temp\1012982001\qtmPs7h.exe
              "C:\Users\Admin\AppData\Local\Temp\1012982001\qtmPs7h.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4408
              • C:\Windows\SysWOW64\cmd.exe
                "cmd" /c ping 127.0.0.1 -n 9 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "word" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\word.exe"
                7⤵
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                • Suspicious use of WriteProcessMemory
                PID:4256
                • C:\Windows\SysWOW64\PING.EXE
                  ping 127.0.0.1 -n 9
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:4308
                • C:\Windows\SysWOW64\reg.exe
                  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "word" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\word.exe"
                  8⤵
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  PID:4832
              • C:\Windows\SysWOW64\cmd.exe
                "cmd" /c ping 127.0.0.1 -n 8 > nul && copy "C:\Users\Admin\AppData\Local\Temp\1012982001\qtmPs7h.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\word.exe" && ping 127.0.0.1 -n 8 > nul && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\word.exe"
                7⤵
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                • Suspicious use of WriteProcessMemory
                PID:3776
                • C:\Windows\SysWOW64\PING.EXE
                  ping 127.0.0.1 -n 8
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:4032
                • C:\Windows\SysWOW64\PING.EXE
                  ping 127.0.0.1 -n 8
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:4664
                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\word.exe
                  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\word.exe"
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:2424
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                    9⤵
                    • System Location Discovery: System Language Discovery
                    PID:5116
                    • C:\Users\Admin\AppData\Local\Temp\10000760101\vector.exe
                      "C:\Users\Admin\AppData\Local\Temp\10000760101\vector.exe"
                      10⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1068
                      • C:\Users\Admin\AppData\Local\Temp\10000760101\vector.exe
                        "C:\Users\Admin\AppData\Local\Temp\10000760101\vector.exe"
                        11⤵
                        • Executes dropped EXE
                        PID:5940
                      • C:\Users\Admin\AppData\Local\Temp\10000760101\vector.exe
                        "C:\Users\Admin\AppData\Local\Temp\10000760101\vector.exe"
                        11⤵
                        • Executes dropped EXE
                        PID:5944
                      • C:\Users\Admin\AppData\Local\Temp\10000760101\vector.exe
                        "C:\Users\Admin\AppData\Local\Temp\10000760101\vector.exe"
                        11⤵
                        • Executes dropped EXE
                        PID:5952
                      • C:\Users\Admin\AppData\Local\Temp\10000760101\vector.exe
                        "C:\Users\Admin\AppData\Local\Temp\10000760101\vector.exe"
                        11⤵
                        • Executes dropped EXE
                        PID:5968
                      • C:\Users\Admin\AppData\Local\Temp\10000760101\vector.exe
                        "C:\Users\Admin\AppData\Local\Temp\10000760101\vector.exe"
                        11⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:5980
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 5980 -s 1376
                          12⤵
                          • Program crash
                          PID:6208
                  • C:\Users\Admin\AppData\Local\Temp\word.exe
                    "C:\Users\Admin\AppData\Local\Temp\word.exe"
                    9⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:2484
                    • C:\Users\Admin\AppData\Local\Temp\word.exe
                      "C:\Users\Admin\AppData\Local\Temp\word.exe"
                      10⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4368
            • C:\Users\Admin\AppData\Local\Temp\1012992001\7qg0CPF.exe
              "C:\Users\Admin\AppData\Local\Temp\1012992001\7qg0CPF.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Checks computer location settings
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Loads dropped DLL
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2340
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp7F6C.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp7F6C.tmp.bat
                7⤵
                • System Location Discovery: System Language Discovery
                PID:5052
            • C:\Users\Admin\AppData\Local\Temp\1013035001\XfpUz7y.exe
              "C:\Users\Admin\AppData\Local\Temp\1013035001\XfpUz7y.exe"
              6⤵
              • Executes dropped EXE
              PID:4544
            • C:\Users\Admin\AppData\Local\Temp\1013036001\6b707dcd32.exe
              "C:\Users\Admin\AppData\Local\Temp\1013036001\6b707dcd32.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              PID:4084
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 1608
                7⤵
                • Program crash
                PID:4144
            • C:\Users\Admin\AppData\Local\Temp\1013037001\e7b7ab29ab.exe
              "C:\Users\Admin\AppData\Local\Temp\1013037001\e7b7ab29ab.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              PID:4024
            • C:\Users\Admin\AppData\Local\Temp\1013038001\7a42576289.exe
              "C:\Users\Admin\AppData\Local\Temp\1013038001\7a42576289.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:1528
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM firefox.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2552
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM chrome.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3428
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM msedge.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4420
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM opera.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3556
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM brave.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2140
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                7⤵
                  PID:4392
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                    8⤵
                    • Checks processor information in registry
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of SetWindowsHookEx
                    PID:3596
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1952 -prefMapHandle 1944 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {39d3866c-05b9-4e59-b378-00fba20ff4c1} 3596 "\\.\pipe\gecko-crash-server-pipe.3596" gpu
                      9⤵
                        PID:3620
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2508 -parentBuildID 20240401114208 -prefsHandle 2484 -prefMapHandle 2472 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {393182f5-271e-4680-b9a7-28f8ae0c5c60} 3596 "\\.\pipe\gecko-crash-server-pipe.3596" socket
                        9⤵
                          PID:4516
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2804 -childID 1 -isForBrowser -prefsHandle 3232 -prefMapHandle 3108 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7e3941b1-6e55-4a20-a14c-82f1a0655488} 3596 "\\.\pipe\gecko-crash-server-pipe.3596" tab
                          9⤵
                            PID:4188
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4156 -childID 2 -isForBrowser -prefsHandle 3764 -prefMapHandle 3496 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c8e164e-aa19-4dac-bd5b-24e292b61ae5} 3596 "\\.\pipe\gecko-crash-server-pipe.3596" tab
                            9⤵
                              PID:3140
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4700 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4692 -prefMapHandle 4732 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c69e0548-6f15-456f-adda-029731f0b4ad} 3596 "\\.\pipe\gecko-crash-server-pipe.3596" utility
                              9⤵
                              • Checks processor information in registry
                              PID:5252
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5460 -childID 3 -isForBrowser -prefsHandle 5412 -prefMapHandle 5388 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c1f3e33-1155-493d-b25f-8b1083d99821} 3596 "\\.\pipe\gecko-crash-server-pipe.3596" tab
                              9⤵
                                PID:5264
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5600 -childID 4 -isForBrowser -prefsHandle 5680 -prefMapHandle 5676 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {312d9888-76bc-4d9b-9da8-de6f57133bc4} 3596 "\\.\pipe\gecko-crash-server-pipe.3596" tab
                                9⤵
                                  PID:5380
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5820 -childID 5 -isForBrowser -prefsHandle 5584 -prefMapHandle 5588 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ade963b8-e2a0-45ed-969a-7f2e68d10a09} 3596 "\\.\pipe\gecko-crash-server-pipe.3596" tab
                                  9⤵
                                    PID:5396
                            • C:\Users\Admin\AppData\Local\Temp\1013039001\e773cc7f4e.exe
                              "C:\Users\Admin\AppData\Local\Temp\1013039001\e773cc7f4e.exe"
                              6⤵
                              • Modifies Windows Defender Real-time Protection settings
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Windows security modification
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2924
                        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2c8286.exe
                          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2c8286.exe
                          4⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2172
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 1648
                            5⤵
                            • Program crash
                            PID:4696
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 1604
                            5⤵
                            • Program crash
                            PID:1052
                      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3t22M.exe
                        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3t22M.exe
                        3⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • System Location Discovery: System Language Discovery
                        PID:3772
                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4s029g.exe
                      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4s029g.exe
                      2⤵
                      • Modifies Windows Defender Real-time Protection settings
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Windows security modification
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:436
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2172 -ip 2172
                    1⤵
                      PID:3080
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2172 -ip 2172
                      1⤵
                        PID:1696
                      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                        C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4472
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4084 -ip 4084
                        1⤵
                          PID:3736
                        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          1⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:32
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5980 -ip 5980
                          1⤵
                            PID:6188

                          Network

                          MITRE ATT&CK Enterprise v15

                          Reconnaissance

                          Resource Development

                          Initial Access

                          Execution

                          Persistence

                          Boot or Logon Autostart Execution

                          1
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Create or Modify System Process

                          1
                          T1543

                          Windows Service

                          1
                          T1543.003

                          Privilege Escalation

                          Boot or Logon Autostart Execution

                          1
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Create or Modify System Process

                          1
                          T1543

                          Windows Service

                          1
                          T1543.003

                          Defense Evasion

                          Impair Defenses

                          2
                          T1562

                          Disable or Modify Tools

                          2
                          T1562.001

                          Modify Registry

                          3
                          T1112

                          Virtualization/Sandbox Evasion

                          2
                          T1497

                          Credential Access

                          Credentials from Password Stores

                          1
                          T1555

                          Credentials from Web Browsers

                          1
                          T1555.003

                          Unsecured Credentials

                          1
                          T1552

                          Credentials In Files

                          1
                          T1552.001

                          Discovery

                          Browser Information Discovery

                          1
                          T1217

                          Query Registry

                          6
                          T1012

                          Remote System Discovery

                          1
                          T1018

                          System Information Discovery

                          4
                          T1082

                          System Location Discovery

                          1
                          T1614

                          System Language Discovery

                          1
                          T1614.001

                          System Network Configuration Discovery

                          1
                          T1016

                          Internet Connection Discovery

                          1
                          T1016.001

                          Virtualization/Sandbox Evasion

                          2
                          T1497

                          Lateral Movement

                          Collection

                          Data from Local System

                          1
                          T1005

                          Command and Control

                          Web Service

                          1
                          T1102

                          Exfiltration

                          Impact

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\word.exe.log
                            Filesize

                            1KB

                            MD5

                            7dca233df92b3884663fa5a40db8d49c

                            SHA1

                            208b8f27b708c4e06ac37f974471cc7b29c29b60

                            SHA256

                            90c83311e35da0b5f8aa65aa2109745feb68ee9540e863f4ed909872e9c6a84c

                            SHA512

                            d134b96fd33c79c85407608f76afc5a9f937bff453b1c90727a3ed992006c7d4c8329be6a2b5ba6b11da1a32f7cd60e9bc380be388b586d6cd5c2e6b1f57bd07

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\activity-stream.discovery_stream.json
                            Filesize

                            19KB

                            MD5

                            15fc9a814747af206dd684127e31f316

                            SHA1

                            fed5ead2f11a67cdee32d2cb7b815163d5529994

                            SHA256

                            ba77936749042ba593803451e46ed9040262fb344d1ff8d2fc0dec1c4221e16b

                            SHA512

                            a785c3eb1b4a3aebbc8f95f29aa5a24ad980154289e12935e9d6b43e8397b5379f50ae77e7c25ec30dce107b9c42796e6b8d57f037588dad9d01ccf29c48f8d7

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
                            Filesize

                            13KB

                            MD5

                            955704868010a97b41ace6ccd4362211

                            SHA1

                            c3f97022ab61348a17b6e094f06d0d5672964d63

                            SHA256

                            9a901d9a4636ad4bd93bea8978136af7e017414127096a44cb3f6cf91e3bef06

                            SHA512

                            9d04d247b355369b7b13ae0942c2245ca0c15f6255ad2bdaba25505d9ad2d997075c936eb3b32f30b6f50bb6736b7102f2152e0a2c094272dca8f99aa03e304b

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                            Filesize

                            15KB

                            MD5

                            96c542dec016d9ec1ecc4dddfcbaac66

                            SHA1

                            6199f7648bb744efa58acf7b96fee85d938389e4

                            SHA256

                            7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                            SHA512

                            cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\10000760101\vector.exe
                            Filesize

                            5.0MB

                            MD5

                            b183e5ff29a1532a84e5a38983ab9e4e

                            SHA1

                            230c9cbd2e14598aaf73ae78c85c998a6b923a51

                            SHA256

                            81a45f430c102365b46c663203ae5708b6befe2848f01efc7b702aff7170c901

                            SHA512

                            31be2761821fb6bc81a010a3f68fa6901aa5e9768e9c57db53b52e0495c7340abccc9191500aa39540fef159578403e78d2af31ac364b89774d5f359b54c6c1e

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\10000760101\vector.exe
                            Filesize

                            2.5MB

                            MD5

                            d1e3f88d0caf949d5f1b4bf4efbb95a4

                            SHA1

                            61ffd2589a1965bf9cb874833c4c9b106b3e43e8

                            SHA256

                            c505f3b2f40b8a68e7cacfe2a9925498ab0f7ef29aa7023bb472597021066b2e

                            SHA512

                            5d4c43e858371f24ebafb56388a586c081d7b0289a3b039dbb2b011e9864e8e9f5dc7037fcb3e88f4bec4259a09ce5f3ccdae3161b43dff140e0e4ca7bff96c3

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1012982001\qtmPs7h.exe
                            Filesize

                            799KB

                            MD5

                            89bd66e4285cb7295300a941964af529

                            SHA1

                            232d9fee67a3c3652a80e1c1a258f0d789c6a6cf

                            SHA256

                            a46bf8412717f75bf098966cb1f5074836e78f5699bb5073dcc45d59ca790047

                            SHA512

                            72d1c8c4b74bacca619a58062441203c6cfea81d064dc1933af7a3cb9758d924b011a6935e8d255aad58159a4ecbb3677cc6a6e80f6daa8b135711195a5c8498

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1012992001\7qg0CPF.exe
                            Filesize

                            5.9MB

                            MD5

                            3297554944a2e2892096a8fb14c86164

                            SHA1

                            4b700666815448a1e0f4f389135fddb3612893ec

                            SHA256

                            e0a9fcd5805e66254aa20f8ddb3bdfca376a858b19222b178cc8893f914a6495

                            SHA512

                            499aa1679f019e29b4d871a472d24b89adddc68978317f85f095c7278f25f926cbf532c8520c2f468b3942a3e37e9be20aea9f83c68e8b5e0c9adbf69640ad25

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1013035001\XfpUz7y.exe
                            Filesize

                            13.3MB

                            MD5

                            5122e07da6c4389fbd0b811d41b18ae0

                            SHA1

                            fa33ca1356b54c8c2d2f564a49754ed6104e0fd5

                            SHA256

                            dc36cd245d0aa5750724ac2dc74d5368b9c06a6281b8082d682d3741185e18bf

                            SHA512

                            1d1bd90f9c1adcd326911f4956661a21e20453eda601c05b741cc4859b5c182290b2830451a387d737eaefd4d2eedcfbc9a84892bb38b604f2900e4bd7d66753

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1013038001\7a42576289.exe
                            Filesize

                            947KB

                            MD5

                            8ff64952a4b6ad604177055c0386a243

                            SHA1

                            1a51a318ee155add2edd493fb2197da18a54e548

                            SHA256

                            3cef996b5c18ab07c07b96325a43ef611f74a90124d11e1451e76678028cbabf

                            SHA512

                            9ceb86679fa29a761019efff8ae465a5c4ac311c998c6430cf2619204bd850bde73b1c29051db48d31af0411d9446f3205c03f0f8e1e7c5a0dc056a95b6a176a

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\Costura\A54E036D2DCD19384E8EA53862E0DD8F\32\sqlite.interop.dll
                            Filesize

                            1.4MB

                            MD5

                            6f2fdecc48e7d72ca1eb7f17a97e59ad

                            SHA1

                            fcbc8c4403e5c8194ee69158d7e70ee7dbd4c056

                            SHA256

                            70e48ef5c14766f3601c97451b47859fddcbe7f237e1c5200cea8e7a7609d809

                            SHA512

                            fea98a3d6fff1497551dc6583dd92798dcac764070a350fd381e856105a6411c94effd4b189b7a32608ff610422b8dbd6d93393c5da99ee66d4569d45191dc8b

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4s029g.exe
                            Filesize

                            2.7MB

                            MD5

                            daaa30f2dff00615a67ec640591df80d

                            SHA1

                            f21f0d0f4c0ce3ccbeabc21537c56968366314e3

                            SHA256

                            048ef18f5af0753f1703e5c6672728e70dfd0576a91d84abc5af1f0661e1ac61

                            SHA512

                            75a0243194020db5896a18c4eec2ea6074fd735e7166f05fe00a8e0eaf339328817775d585cbd31b6d9ced14edf5ab864e9a91cf80f84802a9bc378bc966e510

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\D1L61.exe
                            Filesize

                            5.3MB

                            MD5

                            845b8b792223088b1fd9f30f1c4f0998

                            SHA1

                            4343ec62d9c1d55b79f2b3e66fac1c7e4ae4276f

                            SHA256

                            f42f2641be45ca04eedabf2162f735f3e6dd7e506ba20e7472b001903ae61df7

                            SHA512

                            9ecb7b0afe7d20050fb858a32436b65ac4d698885aafd62dbec31cf95b4a3df8872c80b4b06e727a4eabf5dd73e396a1b41591f8b925ca02169f3d31b80ac417

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3t22M.exe
                            Filesize

                            1.7MB

                            MD5

                            23d4f0764b48e58b48fe9d219ad8644b

                            SHA1

                            490db0a630a6fa02179be21a40e8b9daf0b09a2a

                            SHA256

                            0bf27ed8c4e9a4d4fb5d91ef15604296d731cfd062aed351dc6cc5a0c246a698

                            SHA512

                            38643ef85d55edcdce0f46e5bf2f0f2dfa465bb648449968de394c14bce8b47266657aec252049102bcac43a4eee669dfe11448e9092ec54d5db0eba063dfbde

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\L0O43.exe
                            Filesize

                            3.5MB

                            MD5

                            b9c2a2af9fa6daa11fb3a832f26199e3

                            SHA1

                            5b17232245ff3b13e3cf5bf46ad59e0d076d0440

                            SHA256

                            f735dbbb3fd0ed7c73924f7661aff8eeb498b5cd6537b1b7a1954a1107e2719d

                            SHA512

                            14ba25d8b9789314d3605f83f88a1206b09c05a034e622a1ada36a9cbdf8361ed50fe9c91989fe0beb55d77db99b8b9553f73c6a58675240295e5841986622ed

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Y45c5.exe
                            Filesize

                            3.1MB

                            MD5

                            a6de850843679453111199938e2f063f

                            SHA1

                            d3d29b0b125f2c153f7705752d2e04840d859056

                            SHA256

                            4cbc26196d6f678797589a2277973ea4c3c5ef052c87170f613ed7d4698923ea

                            SHA512

                            1a74e9763181d44bf58b8f62b730a387da38c091613c4934388843572e5d61df0a0f3f6529bda7926b66fcaa6b066b9c219822a8a7122098566f84ac8f37915f

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2c8286.exe
                            Filesize

                            1.8MB

                            MD5

                            615e21148ab9f18a2cd5fc57a29d2f9d

                            SHA1

                            3d0ac153bf285fd266e38b60f4ead5ba9a06cd3f

                            SHA256

                            d20f28f876e0b6796e3f2d8b5c855eee43e6f9b20d2c9117a0d3179cd51b3d7e

                            SHA512

                            aefa69bc9174dda7d21c1cdc3afa0a66ba6c4522d947f07049e21ae17f61801b3a3858429ad50882c00228a37e43ce7278002377dc435c6f7f64dccc64edd48d

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\tmp7F6C.tmp.bat
                            Filesize

                            186B

                            MD5

                            790dd6f9aab53b59e358a126dc5d59fc

                            SHA1

                            ec6bf3eb0fa5d2e37c694bf71254e0ce0be1a5fc

                            SHA256

                            7ca8c160037742b7da30366775d7aae7882a98e1fbfdbbefb743c2a93d6b1c52

                            SHA512

                            a9d819b8d771febfa027de6f201d4effaf7bdd3334255707dddceb57b2b322649698903ee5d72f0e431780d29b01abedd5250d372100e6c66c0639965f86c7ef

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                            Filesize

                            479KB

                            MD5

                            09372174e83dbbf696ee732fd2e875bb

                            SHA1

                            ba360186ba650a769f9303f48b7200fb5eaccee1

                            SHA256

                            c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                            SHA512

                            b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                            Filesize

                            13.8MB

                            MD5

                            0a8747a2ac9ac08ae9508f36c6d75692

                            SHA1

                            b287a96fd6cc12433adb42193dfe06111c38eaf0

                            SHA256

                            32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                            SHA512

                            59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\word.exe
                            Filesize

                            76KB

                            MD5

                            0e362e7005823d0bec3719b902ed6d62

                            SHA1

                            590d860b909804349e0cdc2f1662b37bd62f7463

                            SHA256

                            2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad

                            SHA512

                            518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\word.txt
                            Filesize

                            91B

                            MD5

                            81784d19996473d2db79de737a1e00e5

                            SHA1

                            e354ed781ff2382de2d4133181e0b8cea586c89d

                            SHA256

                            eb91a81caf30243e8bcd125a6e20235fa5e10efa40108d93a5e75cfa77964214

                            SHA512

                            c11cb4b6f029a5427c2b438cf9e661b76b4c2436a1f677cefda77a7a51e8f9d96779372e0ba59e0f17fbcf3c0f557ae856b2ffa2abe70444678a65c7b7b6ae1d

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\word.txt
                            Filesize

                            91B

                            MD5

                            0e226c26d17d7e5fcbbe2d8f10f5e416

                            SHA1

                            9000259b7bdbc5f5baf62d8efd1ff871a4ce99ff

                            SHA256

                            b792ce3ec91fcec283a118806a9b2e216eb4da2ae7ef5934a46abc8bd7b1fbc3

                            SHA512

                            a75734dbdd5203acc2de0c89f40ebf32be879f3bebab3ad8d0720b29da0c1658dfb1f99f0b16aae32b8de2af20a23a9c50b0f5c3caf55f3deefb25a5e2f8649b

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\AdminUserCash\CREDIT~1
                            Filesize

                            116KB

                            MD5

                            f70aa3fa04f0536280f872ad17973c3d

                            SHA1

                            50a7b889329a92de1b272d0ecf5fce87395d3123

                            SHA256

                            8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

                            SHA512

                            30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin
                            Filesize

                            6KB

                            MD5

                            d5f0023a6be3725b6e9e8ec9492a2435

                            SHA1

                            886fed6bf1087c5efb50a00fdb709242075b12b3

                            SHA256

                            6252392f2828f3ae0fe540b1a9021c1aa340cf24c56df02fef8e14d4ba91c21d

                            SHA512

                            ddd655880c89407739c80759e483b17c58e07c6072e9575ef6fdfad32259e5868501dbef6c806dd31cd4e397b10772505e76715d68cd607a87983ed78f7acfdd

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin
                            Filesize

                            10KB

                            MD5

                            4e8619b47812eed2b8b5e8a9c218aa25

                            SHA1

                            806402b08e1d560c9313b76b5db6929eecf9a82a

                            SHA256

                            fb6697fb78545e54b5225e5c3affee5a424022ed271d58d895b8bc38dfc45590

                            SHA512

                            c79f2a08c49be02f4d3ea167f51f1db1d456af7a1c6e67b8354fc2fe4f62b9febc6cda001153d9dea72befb70b19a9f3c738aa3bc1f090efc78ffb0959dab9fe

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.bin
                            Filesize

                            23KB

                            MD5

                            b6bd66fe933fb20764cc5abbc04a0ff7

                            SHA1

                            2cc8b025ab759f6bfda6a0d63c6508f42ad8e939

                            SHA256

                            efbdf0a83892f711eeead5586a7273a0f220f5b285f026cbfd8646e20d4e853e

                            SHA512

                            bdf760c1bab9d2056653db50103f9582a142f11d6e7a570e406e3d9ad4782072b85abfb4747fde57c7850caf0cfaa13a3df6c621057b644d8e2fe50c979c80dc

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.bin
                            Filesize

                            5KB

                            MD5

                            6fe52765350ae0e56221e4d97228f66d

                            SHA1

                            6cb8a5d300ef72f254512c9fdda580ad52fab5ba

                            SHA256

                            2216bcac37bda287a66b7cdee45a102b36fd3687bbd764db29b3be696a44380e

                            SHA512

                            4eea6772582271a5528d481c5836ae4cb28a205ec04004ec186eddaef7cd1d0f95cf9a81afda4c8decc55137b61752b331a8c813a00e360c22818fb592c1de9f

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.bin
                            Filesize

                            6KB

                            MD5

                            0c970e3dafe12efbb5e793743e201084

                            SHA1

                            2daf217892849a091b49a7b84225f0743b0ac3a2

                            SHA256

                            aad3aadde8eed29b8efa615d0f34e83afaf9ba8a84d82331d949d02b74efa84c

                            SHA512

                            2e5af42af85a8fab7af38587381040a8c277cd195eaaa5b0918b750f4a100ce8ac228e29c6a9a608fd3f2bf4aa422d08dfcef0df31276c6c72ba37e41eecd01e

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.bin
                            Filesize

                            14KB

                            MD5

                            2a8f30dcb6d4b7e6d793fff1265b0416

                            SHA1

                            90678d8f9d2227d3798b22638c0ed1089e54260e

                            SHA256

                            340353981335a4c139ca319bbf347a937cf391bd4e8f247ed49791ebe839038d

                            SHA512

                            eb69e7d2eff6b873ea7a3bf0b6047d3169453bc1a809d697bf0406aba0276a98dbc445473358a44211e3c6b6b76e8c656561914d0432fe2970e297c99332e6f1

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.bin
                            Filesize

                            15KB

                            MD5

                            a5f49c0e43a980436829166281b4e022

                            SHA1

                            a7b4ae523ce9461f22cf67ead0b6adf47317ba7f

                            SHA256

                            76c42755af97a1007aeea7f31e38d3c42c0a28ed2cbd8755af8ddd3278c769d4

                            SHA512

                            441b482c84a00436f96c40d5b08487e831d8e3c51f41b0a9cf41056993be722c2b45a0b55e2c057321a238ae146ed6153ac40bf6ea5230f8b69da34b2a274dd5

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
                            Filesize

                            5KB

                            MD5

                            fa034ffa2f8aa7d640057b1cdc84d5f4

                            SHA1

                            169d64096f86d3c4fe32af6259586220c31b70f4

                            SHA256

                            a4b14762e6797c03c368a26452a91292c9a0f92bb424f8c76de33802b1c4f7f3

                            SHA512

                            4d1b18d53184f1f313da11d8f79d15bf675d331ff9d955f142c33846184aecef2239f066353ff1259db47fd0f12d0370e884b1ef7602702d41aa66d63d708ea6

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
                            Filesize

                            5KB

                            MD5

                            054cfb1cb7069f09d5606a5d36da9c01

                            SHA1

                            2a6f98038102acf8e4d41fe4fd8f84152b64142d

                            SHA256

                            f216fdbc81e7295e138d6a4420236253c7315fd78c18ed4959b319617e23794d

                            SHA512

                            cacaaa793b1d018b5c902021aff25eac135aee1ed2b797af1a51cc36f5f731fd81606e5986a1761c420e5a993404eb8d836b037fd94b85b49bbf1590ed02bd20

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
                            Filesize

                            6KB

                            MD5

                            6ec948336d9bfe0c58ed8ec652bb69fd

                            SHA1

                            0e5de781c4f3022441b5c26e8ad8f887c9bd82f6

                            SHA256

                            0f1dbf954bfaf0b77ad9446784822e3bd918c732a2971f2c70f1d54e879ed72f

                            SHA512

                            a02983da459a86668c7e0ca8f3aed6787c585bde19836d2b17accecf5f0a6a1adfb85dffd9584d6fa6e6aacd7ae8a644ed906f41a212a186b94a19961c1cd68b

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
                            Filesize

                            15KB

                            MD5

                            e209e7b95a473a0a015e1dc539af5ff2

                            SHA1

                            781b004d8e47233a54f824cb5fb0ea9f6eb70ccb

                            SHA256

                            fe09b7b6f2ff1e8c81ccea111e5faa4df134a281d83d4827120d4e06435f61a6

                            SHA512

                            f01cd5884b2059e7329a0a6e2396874fa461e718729bb6e4f05991c2dff30a16fd2efb9c8ecc2446fb65951af930adf71ddb0d3f7f4a9ddc0acc41cfc9707190

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
                            Filesize

                            6KB

                            MD5

                            6da949e1fa65eb7f1b3cc7ae040c72c0

                            SHA1

                            c8df896d3fa06e0e6433a976cb880029d2df588e

                            SHA256

                            250c85326a8804a68532160d82aeb7538adcf300c6653177c2eb36c2986f64be

                            SHA512

                            ef091be360cbfbb81ff175d706d08b7631c2fa89dc1b4571e2d7708ae3ad65273b6d264e500e784b14e992a4e815d97242934bdb846a5c83b0ee2c4ac8c33995

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\a4915d59-8bb0-43ad-b145-d3363c98519a
                            Filesize

                            671B

                            MD5

                            52d03149bf8ab6c2d4f58331e1ee1a70

                            SHA1

                            a6520fbcdd5f9b501e73d9eb050b372bb2a78a7c

                            SHA256

                            84612fc0ef1d359fc8f0fead969a05103bde7fe3e12d83d6bc46718abb1b5c72

                            SHA512

                            a09bc4bfbb7ee6951eac74fb4f97f4a1ad31c6892993e3e0e1ea9e0526a0770545e12081f1920240b51753ec0b9817f3bf7329efc90fa595344a17f37287b9a3

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\ae1e39d0-a241-4515-ad17-0264ac86a85c
                            Filesize

                            29KB

                            MD5

                            5d719bc84246297ce20a54c8d9e6cc92

                            SHA1

                            ccf89c6e1c1e9f68079c04674e88ef6abfffa4ee

                            SHA256

                            d691575ef8eda92c7a11740538e20a82cf441690c0db1de403be480979a363a8

                            SHA512

                            5fdd3b9c29ec734ef4a2eb989935a55627ef900bc74bde345f457936fccf856e3cd1835f2299103df28433ae29cd2c467296e17c0568ddda556ab6fe8d8876a2

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\bbb114ef-bd53-4375-9c48-32fc5f7ed8fc
                            Filesize

                            982B

                            MD5

                            1befb9b4ba4bb7c9b01472d69244c93e

                            SHA1

                            ff9d2b2eab509b9c748d0433724e9bc0b122e243

                            SHA256

                            aa948ef6e2670db313c40300fd71cb51fbe354f2c74520cac0c964e8d7e36726

                            SHA512

                            c180a9926d4f4c54a636c2802aed22414a00cf7e071a9bac779a3d203f02b7aad176f6998419462a5740e0868b3653c4d7def83082489003f973d8f884c1b1c8

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                            Filesize

                            1.1MB

                            MD5

                            842039753bf41fa5e11b3a1383061a87

                            SHA1

                            3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                            SHA256

                            d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                            SHA512

                            d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                            Filesize

                            116B

                            MD5

                            2a461e9eb87fd1955cea740a3444ee7a

                            SHA1

                            b10755914c713f5a4677494dbe8a686ed458c3c5

                            SHA256

                            4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                            SHA512

                            34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                            Filesize

                            372B

                            MD5

                            bf957ad58b55f64219ab3f793e374316

                            SHA1

                            a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                            SHA256

                            bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                            SHA512

                            79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                            Filesize

                            17.8MB

                            MD5

                            daf7ef3acccab478aaa7d6dc1c60f865

                            SHA1

                            f8246162b97ce4a945feced27b6ea114366ff2ad

                            SHA256

                            bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                            SHA512

                            5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js
                            Filesize

                            10KB

                            MD5

                            6a64f82879948286213a9803a5d0627d

                            SHA1

                            2941dc2ca5b4731579247d84bdd8ac1228e8d8e8

                            SHA256

                            0bec5a773101e8e1e3f7d8e29e859ea7994d057302c8d4127746351d6c2764e0

                            SHA512

                            07542a43c8a032a1abe7fb9cf8c999a16fe3e379478177586c36d19138caa7537433f06f9ce3178a63a62abd68a632d2dae7330368ec04225fd8326044a7f513

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js
                            Filesize

                            15KB

                            MD5

                            509316a76b1dc261f13c39fe5938001b

                            SHA1

                            53a9c68a92470f7e2beccdaae020fed242c9fe4c

                            SHA256

                            bb3f41cd64330b16468e3ee7b47bb3b8ec764d10c463bab50f52ebf1bb39b693

                            SHA512

                            bb0f3b2e2295c116a7f113774ccd30ba23fce40c33a6cc4dc1811fb97dee51f8fe3afaa383051209c5c7cf4ac88627262a92ad7cd040a84291204938094f80cf

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js
                            Filesize

                            11KB

                            MD5

                            4db8940468b05398e803aaab8521b094

                            SHA1

                            ab419d9cef80dcedd50a556463327b07296e0a42

                            SHA256

                            bc5d837cda1af5815368c02571eb5e0db1f00a69b538eb521bbe356468a6b415

                            SHA512

                            a913d6751f55cd5d1799aa8a64dba88bee0ac017ab30b1d8c3e96bd0e5761695f050da42a710896788acc510192f7592dee140b279abd0f023be1671dd7737e0

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs.js
                            Filesize

                            10KB

                            MD5

                            ed58a0ae2a8c3b8a0f284055084f81af

                            SHA1

                            5cc52c4ba761b5b1d98ad6a5983ad6ef522e8c86

                            SHA256

                            86bccd300c5f6acbb3b756268752dbb82ecd4bb4636d17ef5613a6fc226c8856

                            SHA512

                            91217dc8647a857d96daad5a2b99b56b07ae0bbf16a746c97c5d2fc0f8c91eeeb82ee53ab9c7549343f6b94d4715751d456307b69cdd6ac85aabc841b0c33ff2

                            Download Submit

                          • memory/32-354-0x00000000000B0000-0x00000000003CF000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/32-333-0x00000000000B0000-0x00000000003CF000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/436-93-0x00000000008F0000-0x0000000000BA2000-memory.dmp

                            Filesize

                            2.7MB

                            Download

                          • memory/436-79-0x00000000008F0000-0x0000000000BA2000-memory.dmp

                            Filesize

                            2.7MB

                            Download

                          • memory/436-90-0x00000000008F0000-0x0000000000BA2000-memory.dmp

                            Filesize

                            2.7MB

                            Download

                          • memory/436-80-0x00000000008F0000-0x0000000000BA2000-memory.dmp

                            Filesize

                            2.7MB

                            Download

                          • memory/436-81-0x00000000008F0000-0x0000000000BA2000-memory.dmp

                            Filesize

                            2.7MB

                            Download

                          • memory/1068-1124-0x00000000054C0000-0x0000000005650000-memory.dmp

                            Filesize

                            1.6MB

                            Download

                          • memory/1068-1125-0x00000000051C0000-0x00000000051E2000-memory.dmp

                            Filesize

                            136KB

                            Download

                          • memory/1068-254-0x00000000006B0000-0x0000000000932000-memory.dmp

                            Filesize

                            2.5MB

                            Download

                          • memory/1112-33-0x00000000000B0000-0x00000000003CF000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/1112-62-0x00000000000B0000-0x00000000003CF000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/1112-3770-0x00000000000B0000-0x00000000003CF000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/1112-84-0x00000000000B0000-0x00000000003CF000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/1112-1112-0x00000000000B0000-0x00000000003CF000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/1112-1147-0x00000000000B0000-0x00000000003CF000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/1112-273-0x00000000000B0000-0x00000000003CF000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/1112-102-0x00000000000B0000-0x00000000003CF000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/1112-1429-0x00000000000B0000-0x00000000003CF000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/1112-168-0x00000000000B0000-0x00000000003CF000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/1112-327-0x00000000000B0000-0x00000000003CF000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/1112-97-0x00000000000B0000-0x00000000003CF000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/1112-232-0x00000000000B0000-0x00000000003CF000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/1112-233-0x00000000000B0000-0x00000000003CF000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/1112-65-0x00000000000B0000-0x00000000003CF000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/1112-96-0x00000000000B0000-0x00000000003CF000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/2172-67-0x0000000000F50000-0x00000000013E4000-memory.dmp

                            Filesize

                            4.6MB

                            Download

                          • memory/2172-69-0x0000000000F50000-0x00000000013E4000-memory.dmp

                            Filesize

                            4.6MB

                            Download

                          • memory/2172-39-0x0000000000F50000-0x00000000013E4000-memory.dmp

                            Filesize

                            4.6MB

                            Download

                          • memory/2340-143-0x000000000A440000-0x000000000A76E000-memory.dmp

                            Filesize

                            3.2MB

                            Download

                          • memory/2340-132-0x0000000008F50000-0x0000000008F6E000-memory.dmp

                            Filesize

                            120KB

                            Download

                          • memory/2340-121-0x0000000000A90000-0x000000000146C000-memory.dmp

                            Filesize

                            9.9MB

                            Download

                          • memory/2340-122-0x0000000000A90000-0x000000000146C000-memory.dmp

                            Filesize

                            9.9MB

                            Download

                          • memory/2340-123-0x0000000000A90000-0x000000000146C000-memory.dmp

                            Filesize

                            9.9MB

                            Download

                          • memory/2340-129-0x0000000007E30000-0x0000000007E3A000-memory.dmp

                            Filesize

                            40KB

                            Download

                          • memory/2340-130-0x0000000008240000-0x00000000082B6000-memory.dmp

                            Filesize

                            472KB

                            Download

                          • memory/2340-131-0x0000000008AF0000-0x0000000008B56000-memory.dmp

                            Filesize

                            408KB

                            Download

                          • memory/2340-133-0x0000000009020000-0x000000000908A000-memory.dmp

                            Filesize

                            424KB

                            Download

                          • memory/2340-222-0x0000000000A90000-0x000000000146C000-memory.dmp

                            Filesize

                            9.9MB

                            Download

                          • memory/2340-134-0x0000000009090000-0x00000000093E4000-memory.dmp

                            Filesize

                            3.3MB

                            Download

                          • memory/2340-135-0x0000000009430000-0x000000000947C000-memory.dmp

                            Filesize

                            304KB

                            Download

                          • memory/2340-137-0x00000000095D0000-0x0000000009682000-memory.dmp

                            Filesize

                            712KB

                            Download

                          • memory/2340-138-0x00000000096E0000-0x0000000009730000-memory.dmp

                            Filesize

                            320KB

                            Download

                          • memory/2340-178-0x000000000AA20000-0x000000000AA32000-memory.dmp

                            Filesize

                            72KB

                            Download

                          • memory/2340-139-0x0000000009760000-0x0000000009782000-memory.dmp

                            Filesize

                            136KB

                            Download

                          • memory/2340-141-0x000000000A400000-0x000000000A43C000-memory.dmp

                            Filesize

                            240KB

                            Download

                          • memory/2340-142-0x00000000097B0000-0x00000000097D1000-memory.dmp

                            Filesize

                            132KB

                            Download

                          • memory/2424-94-0x0000000007050000-0x000000000706A000-memory.dmp

                            Filesize

                            104KB

                            Download

                          • memory/2424-95-0x0000000007070000-0x0000000007076000-memory.dmp

                            Filesize

                            24KB

                            Download

                          • memory/2424-88-0x0000000000AC0000-0x0000000000B8E000-memory.dmp

                            Filesize

                            824KB

                            Download

                          • memory/2484-199-0x0000000000390000-0x00000000003AA000-memory.dmp

                            Filesize

                            104KB

                            Download

                          • memory/2924-1137-0x0000000000D80000-0x0000000001032000-memory.dmp

                            Filesize

                            2.7MB

                            Download

                          • memory/2924-1146-0x0000000000D80000-0x0000000001032000-memory.dmp

                            Filesize

                            2.7MB

                            Download

                          • memory/2924-358-0x0000000000D80000-0x0000000001032000-memory.dmp

                            Filesize

                            2.7MB

                            Download

                          • memory/2924-916-0x0000000000D80000-0x0000000001032000-memory.dmp

                            Filesize

                            2.7MB

                            Download

                          • memory/2924-915-0x0000000000D80000-0x0000000001032000-memory.dmp

                            Filesize

                            2.7MB

                            Download

                          • memory/3772-73-0x00000000000E0000-0x0000000000767000-memory.dmp

                            Filesize

                            6.5MB

                            Download

                          • memory/3772-72-0x00000000000E0000-0x0000000000767000-memory.dmp

                            Filesize

                            6.5MB

                            Download

                          • memory/4024-306-0x0000000000120000-0x00000000007A7000-memory.dmp

                            Filesize

                            6.5MB

                            Download

                          • memory/4024-305-0x0000000000120000-0x00000000007A7000-memory.dmp

                            Filesize

                            6.5MB

                            Download

                          • memory/4084-289-0x0000000000250000-0x00000000006E4000-memory.dmp

                            Filesize

                            4.6MB

                            Download

                          • memory/4084-308-0x0000000000250000-0x00000000006E4000-memory.dmp

                            Filesize

                            4.6MB

                            Download

                          • memory/4408-63-0x0000000004F50000-0x0000000004F76000-memory.dmp

                            Filesize

                            152KB

                            Download

                          • memory/4408-60-0x0000000005620000-0x0000000005BC4000-memory.dmp

                            Filesize

                            5.6MB

                            Download

                          • memory/4408-61-0x0000000005110000-0x00000000051A2000-memory.dmp

                            Filesize

                            584KB

                            Download

                          • memory/4408-58-0x0000000000E70000-0x0000000000F3E000-memory.dmp

                            Filesize

                            824KB

                            Download

                          • memory/4408-64-0x0000000005300000-0x000000000530A000-memory.dmp

                            Filesize

                            40KB

                            Download

                          • memory/4408-59-0x0000000004FA0000-0x000000000503C000-memory.dmp

                            Filesize

                            624KB

                            Download

                          • memory/4472-99-0x00000000000B0000-0x00000000003CF000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/4472-101-0x00000000000B0000-0x00000000003CF000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/4636-35-0x00000000003C0000-0x00000000006DF000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/4636-20-0x00000000003C0000-0x00000000006DF000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/5116-252-0x0000000000400000-0x0000000000473000-memory.dmp

                            Filesize

                            460KB

                            Download

                          • memory/5116-165-0x0000000000400000-0x0000000000473000-memory.dmp

                            Filesize

                            460KB

                            Download

                          • memory/5116-162-0x0000000000400000-0x0000000000473000-memory.dmp

                            Filesize

                            460KB

                            Download

                          • memory/5116-242-0x0000000000400000-0x0000000000473000-memory.dmp

                            Filesize

                            460KB

                            Download

                          • memory/5116-169-0x0000000000400000-0x0000000000473000-memory.dmp

                            Filesize

                            460KB

                            Download

                          • memory/5116-167-0x0000000000400000-0x0000000000473000-memory.dmp

                            Filesize

                            460KB

                            Download

                          • memory/5980-1130-0x0000000000400000-0x0000000000456000-memory.dmp

                            Filesize

                            344KB

                            Download

                          • memory/5980-1133-0x0000000000400000-0x0000000000456000-memory.dmp

                            Filesize

                            344KB

                            Download

                          • memory/5980-1135-0x0000000000400000-0x0000000000456000-memory.dmp

                            Filesize

                            344KB

                            Download