Overview

overview

10

Static

static

3

69f12161bd...9b.exe

windows7-x64

10

69f12161bd...9b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-12-2024 23:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    69f12161bd960117baf9728942be8ae7d34aeac22ffeff912dc8ab227a44229b.exe

  • Size

    3.1MB

  • MD5

    4f2646500156298bd82c572e6c8e4062

  • SHA1

    44c4da3bd22fc6ac172a3847c3fbe9b88659c1ff

  • SHA256

    69f12161bd960117baf9728942be8ae7d34aeac22ffeff912dc8ab227a44229b

  • SHA512

    50235199c1e446fcc1a1bd93bbadf4c048ac363a472297e522cd32290f0c81318f8434120b5ee77c82bbd85f01af7eb962e71e4de54ccd59f5ff214208b9de39

  • SSDEEP

    49152:icm/mmZYj4ofA2jiwMLgUg6UfV0yRVgH1oiZnus6:GHi4ofA2jieDVdRVK1Dnus

Score
10/10
amadeygcleanerlummastealcstormkittyxworm9c9aa5stokcredential_accessdiscoveryevasionloaderpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:8080

101.99.92.189:8080
Mutex

d5gQ6Zf7Tzih1Pi1

Attributes
  • install_file

    USB.exe

aes.plain

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://atten-supporse.biz/api

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

lumma

C2

https://atten-supporse.biz/api

https://covery-mover.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload 3 IoCs
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 1 IoCs
  • Stormkitty family
    stormkitty
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs
    evasion
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 9 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks BIOS information in registry 2 TTPs 20 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Identifies Wine through registry keys 2 TTPs 10 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 13 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 33 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\69f12161bd960117baf9728942be8ae7d34aeac22ffeff912dc8ab227a44229b.exe
    "C:\Users\Admin\AppData\Local\Temp\69f12161bd960117baf9728942be8ae7d34aeac22ffeff912dc8ab227a44229b.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2256
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1580
      • C:\Users\Admin\AppData\Local\Temp\1013829001\9feskIx.exe
        "C:\Users\Admin\AppData\Local\Temp\1013829001\9feskIx.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1812
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 3216
          4⤵
          • Program crash
          PID:1492
      • C:\Users\Admin\AppData\Local\Temp\1013845001\6ec0fb99e0.exe
        "C:\Users\Admin\AppData\Local\Temp\1013845001\6ec0fb99e0.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:408
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 1460
          4⤵
          • Program crash
          PID:224
      • C:\Users\Admin\AppData\Local\Temp\1013846001\405c294750.exe
        "C:\Users\Admin\AppData\Local\Temp\1013846001\405c294750.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4804
      • C:\Users\Admin\AppData\Local\Temp\1013847001\c4c0e5cc7e.exe
        "C:\Users\Admin\AppData\Local\Temp\1013847001\c4c0e5cc7e.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3700
      • C:\Users\Admin\AppData\Local\Temp\1013848001\6164c924e8.exe
        "C:\Users\Admin\AppData\Local\Temp\1013848001\6164c924e8.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3980
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
          4⤵
          • Uses browser remote debugging
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1988
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb2506cc40,0x7ffb2506cc4c,0x7ffb2506cc58
            5⤵
              PID:2428
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1928,i,1075673234102473516,5305979341219202064,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1924 /prefetch:2
              5⤵
                PID:4468
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2132,i,1075673234102473516,5305979341219202064,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2156 /prefetch:3
                5⤵
                  PID:4472
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2240,i,1075673234102473516,5305979341219202064,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2248 /prefetch:8
                  5⤵
                    PID:3484
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3144,i,1075673234102473516,5305979341219202064,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3180 /prefetch:1
                    5⤵
                    • Uses browser remote debugging
                    PID:2576
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3152,i,1075673234102473516,5305979341219202064,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3216 /prefetch:1
                    5⤵
                    • Uses browser remote debugging
                    PID:1440
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4404,i,1075673234102473516,5305979341219202064,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4564 /prefetch:1
                    5⤵
                    • Uses browser remote debugging
                    PID:3916
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
                  4⤵
                  • Uses browser remote debugging
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of FindShellTrayWindow
                  PID:5968
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb24d446f8,0x7ffb24d44708,0x7ffb24d44718
                    5⤵
                    • Checks processor information in registry
                    • Enumerates system info in registry
                    • Suspicious behavior: EnumeratesProcesses
                    PID:6000
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,17644368167442975015,18301458443324805023,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
                    5⤵
                      PID:5304
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,17644368167442975015,18301458443324805023,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
                      5⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5260
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,17644368167442975015,18301458443324805023,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2968 /prefetch:8
                      5⤵
                        PID:1664
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2124,17644368167442975015,18301458443324805023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
                        5⤵
                        • Uses browser remote debugging
                        PID:1256
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2124,17644368167442975015,18301458443324805023,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
                        5⤵
                        • Uses browser remote debugging
                        PID:1012
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2124,17644368167442975015,18301458443324805023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
                        5⤵
                        • Uses browser remote debugging
                        PID:1916
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2124,17644368167442975015,18301458443324805023,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2964 /prefetch:1
                        5⤵
                        • Uses browser remote debugging
                        PID:3644
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,17644368167442975015,18301458443324805023,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
                        5⤵
                          PID:4400
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,17644368167442975015,18301458443324805023,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
                          5⤵
                            PID:5504
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\Documents\JKKEHJDHJK.exe"
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:3868
                          • C:\Users\Admin\Documents\JKKEHJDHJK.exe
                            "C:\Users\Admin\Documents\JKKEHJDHJK.exe"
                            5⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5560
                      • C:\Users\Admin\AppData\Local\Temp\1013849001\6943013064.exe
                        "C:\Users\Admin\AppData\Local\Temp\1013849001\6943013064.exe"
                        3⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:3580
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /F /IM firefox.exe /T
                          4⤵
                          • System Location Discovery: System Language Discovery
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1820
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /F /IM chrome.exe /T
                          4⤵
                          • System Location Discovery: System Language Discovery
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4912
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /F /IM msedge.exe /T
                          4⤵
                          • System Location Discovery: System Language Discovery
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4220
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /F /IM opera.exe /T
                          4⤵
                          • System Location Discovery: System Language Discovery
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3048
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /F /IM brave.exe /T
                          4⤵
                          • System Location Discovery: System Language Discovery
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4296
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                          4⤵
                            PID:5008
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                              5⤵
                              • Checks processor information in registry
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              • Suspicious use of SetWindowsHookEx
                              PID:4744
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf42499f-f1bb-4587-bc76-f1acca5cfdf2} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" gpu
                                6⤵
                                  PID:4460
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2444 -parentBuildID 20240401114208 -prefsHandle 2436 -prefMapHandle 2424 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4d72f20-6b6b-4d8d-8e90-09a110105d95} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" socket
                                  6⤵
                                    PID:4800
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3032 -childID 1 -isForBrowser -prefsHandle 3028 -prefMapHandle 3024 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6fff87e1-f8da-4f0f-9989-503e3a044dc7} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" tab
                                    6⤵
                                      PID:3460
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3924 -childID 2 -isForBrowser -prefsHandle 3916 -prefMapHandle 3912 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc257840-8697-4708-a1de-c351851cf8ca} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" tab
                                      6⤵
                                        PID:4528
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4536 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4580 -prefMapHandle 4576 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed201c80-27d3-4c0a-a68d-db2b1501f0fb} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" utility
                                        6⤵
                                        • Checks processor information in registry
                                        PID:5624
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5184 -childID 3 -isForBrowser -prefsHandle 5180 -prefMapHandle 5176 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b5916435-5b9e-48f6-9736-715e4946b08b} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" tab
                                        6⤵
                                          PID:1660
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5184 -childID 4 -isForBrowser -prefsHandle 5208 -prefMapHandle 5308 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e184cf4d-8292-45a8-acc8-4c11caced528} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" tab
                                          6⤵
                                            PID:2576
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5632 -childID 5 -isForBrowser -prefsHandle 5624 -prefMapHandle 5620 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9d882fc3-23ef-4f4b-a279-1636a58555eb} 4744 "\\.\pipe\gecko-crash-server-pipe.4744" tab
                                            6⤵
                                              PID:4172
                                      • C:\Users\Admin\AppData\Local\Temp\1013850001\e6c14193eb.exe
                                        "C:\Users\Admin\AppData\Local\Temp\1013850001\e6c14193eb.exe"
                                        3⤵
                                        • Modifies Windows Defender Real-time Protection settings
                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                        • Checks BIOS information in registry
                                        • Executes dropped EXE
                                        • Identifies Wine through registry keys
                                        • Windows security modification
                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4228
                                  • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                    C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                    1⤵
                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                    • Checks BIOS information in registry
                                    • Executes dropped EXE
                                    • Identifies Wine through registry keys
                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:620
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1812 -ip 1812
                                    1⤵
                                      PID:4176
                                    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                      1⤵
                                        PID:1072
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 408 -ip 408
                                        1⤵
                                          PID:3712
                                        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                          C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                          1⤵
                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                          • Checks BIOS information in registry
                                          • Executes dropped EXE
                                          • Identifies Wine through registry keys
                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:2348
                                        • C:\Windows\system32\DllHost.exe
                                          C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                          1⤵
                                            PID:5304

                                          Network

                                          MITRE ATT&CK Enterprise v15

                                          Reconnaissance

                                          Resource Development

                                          Initial Access

                                          Execution

                                          Persistence

                                          Boot or Logon Autostart Execution

                                          1
                                          T1547

                                          Registry Run Keys / Startup Folder

                                          1
                                          T1547.001

                                          Create or Modify System Process

                                          1
                                          T1543

                                          Windows Service

                                          1
                                          T1543.003

                                          Modify Authentication Process

                                          1
                                          T1556

                                          Privilege Escalation

                                          Boot or Logon Autostart Execution

                                          1
                                          T1547

                                          Registry Run Keys / Startup Folder

                                          1
                                          T1547.001

                                          Create or Modify System Process

                                          1
                                          T1543

                                          Windows Service

                                          1
                                          T1543.003

                                          Defense Evasion

                                          Impair Defenses

                                          2
                                          T1562

                                          Disable or Modify Tools

                                          2
                                          T1562.001

                                          Modify Authentication Process

                                          1
                                          T1556

                                          Modify Registry

                                          3
                                          T1112

                                          Virtualization/Sandbox Evasion

                                          2
                                          T1497

                                          Credential Access

                                          Credentials from Password Stores

                                          1
                                          T1555

                                          Credentials from Web Browsers

                                          1
                                          T1555.003

                                          Modify Authentication Process

                                          1
                                          T1556

                                          Steal Web Session Cookie

                                          1
                                          T1539

                                          Unsecured Credentials

                                          4
                                          T1552

                                          Credentials In Files

                                          4
                                          T1552.001

                                          Discovery

                                          Browser Information Discovery

                                          1
                                          T1217

                                          Query Registry

                                          8
                                          T1012

                                          System Information Discovery

                                          5
                                          T1082

                                          System Location Discovery

                                          1
                                          T1614

                                          System Language Discovery

                                          1
                                          T1614.001

                                          Virtualization/Sandbox Evasion

                                          2
                                          T1497

                                          Lateral Movement

                                          Collection

                                          Data from Local System

                                          3
                                          T1005

                                          Command and Control

                                          Exfiltration

                                          Impact

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\ProgramData\AEHIJDAF
                                            Filesize

                                            116KB

                                            MD5

                                            f70aa3fa04f0536280f872ad17973c3d

                                            SHA1

                                            50a7b889329a92de1b272d0ecf5fce87395d3123

                                            SHA256

                                            8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

                                            SHA512

                                            30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

                                            Download Submit

                                          • C:\ProgramData\GIEBAECAKKFCBFIEGCBKEGCFCB
                                            Filesize

                                            5.0MB

                                            MD5

                                            c6a299c43a23b40943e8e141b6dcb4bd

                                            SHA1

                                            8b3418e6177c4ca7907cd5441307d9bd803bd716

                                            SHA256

                                            4de8964d8122c955b77607aefbbbea2afc704d2122755fc29e4fa566141ac11d

                                            SHA512

                                            7d1bdd1f064cc55f351d0130bdb5e4e050b29ebb8c2c0228c2954c2ffaa8b6ad1c44b643aa0c38ae60324154186b5890891503d69fad7ab2113d96fb3ab42ee0

                                            Download Submit

                                          • C:\ProgramData\KJEBKJDA
                                            Filesize

                                            114KB

                                            MD5

                                            9a3be5cb8635e4df5189c9aaa9c1b3c0

                                            SHA1

                                            9a7ce80c8b4362b7c10294bb1551a6172e656f47

                                            SHA256

                                            958f70959a70caf02c0063fe80f12c4d4d3f822a9fd640a6685c345d98708c26

                                            SHA512

                                            5c538513eba7ebaf7028b924d992b4c32ca323ad44f7a31e21970ed6852ea8b54cf71b2f811e8bf97f2744ee151e001ea52ba43b61cd032cc5a4c886292aac65

                                            Download Submit

                                          • C:\ProgramData\mozglue.dll
                                            Filesize

                                            593KB

                                            MD5

                                            c8fd9be83bc728cc04beffafc2907fe9

                                            SHA1

                                            95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                            SHA256

                                            ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                            SHA512

                                            fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                            Download Submit

                                          • C:\ProgramData\nss3.dll
                                            Filesize

                                            2.0MB

                                            MD5

                                            1cc453cdf74f31e4d913ff9c10acdde2

                                            SHA1

                                            6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                            SHA256

                                            ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                            SHA512

                                            dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                            Filesize

                                            2B

                                            MD5

                                            d751713988987e9331980363e24189ce

                                            SHA1

                                            97d170e1550eee4afc0af065b78cda302a97674c

                                            SHA256

                                            4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                            SHA512

                                            b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
                                            Filesize

                                            150B

                                            MD5

                                            d594cc5e36b60284908342acac8a4f50

                                            SHA1

                                            b6105b0f7cabf4f592ebb0439cd1a018f42bc2b4

                                            SHA256

                                            b70d184975b6bf16a0904b7aa34fd7e2e8bf176fdffa69014c81eee3633b8ae7

                                            SHA512

                                            a784fa648bb901611595e050c75789b2c1fcbb97d0a52e47ec1a2299487e7678271a19c2bd1b53edaa9fedd85c51c143ef6de3b242c9654ad5fc1a775eddebfd

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
                                            Filesize

                                            284B

                                            MD5

                                            ea2e88c3d32713e3ebf96d0b8f63c25b

                                            SHA1

                                            53d438470dc3d9a33546dfd6c644ff7ffcf36389

                                            SHA256

                                            fde75c9a01240eb7c00bd43e008b35ac880358f90da6ef3b40ffd5a9583cd32e

                                            SHA512

                                            d17c6088ed3fec926bd38546bdaa4af4c16469bd9380da716f4fa613d81c115808a8e11f8b4f1c0c989d7a097c8cfb7967cc2348cc51ff46cd5417376000e283

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\3528e643-cdbd-485c-9af3-92366546a8e4.dmp
                                            Filesize

                                            826KB

                                            MD5

                                            29831cba12c145fae0f29ed9744d1d46

                                            SHA1

                                            8b442de5a393e9267802651864f80305927543e4

                                            SHA256

                                            36490b59cc994ee69d4be87d3d11e323d7e73092652753fd31b06ef5a07418d6

                                            SHA512

                                            5cd3f38b1b83edc981ef9e043ffcd05b6382faf21995a5fbec7c9ad0279c89be330af7d7faa50f3da2880fbc27cc35379125e44704da15c2c3a69144409eac51

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\f69bd2dc-dfe4-4212-ab24-5ebf59488bf0.dmp
                                            Filesize

                                            826KB

                                            MD5

                                            0fbb076843d3ab92f4b8ffc05014bd71

                                            SHA1

                                            505079f4d17bf594f018ce734b2c67f7f6c2ad9c

                                            SHA256

                                            7d269171f42b53a099b837c020e06f6dd23fea3803f5c3b4f184f4016b8c2ee4

                                            SHA512

                                            5a0084d31c08b46e786000abdf9a61fe1d8bcdcb7566bf912ef6bb9c7f13fc6b13623b16a3a91a4b5c17bbf7e870291b45d2f2707359b629b7588c332d9ef4ab

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                            Filesize

                                            152B

                                            MD5

                                            443a627d539ca4eab732bad0cbe7332b

                                            SHA1

                                            86b18b906a1acd2a22f4b2c78ac3564c394a9569

                                            SHA256

                                            1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

                                            SHA512

                                            923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                            Filesize

                                            152B

                                            MD5

                                            99afa4934d1e3c56bbce114b356e8a99

                                            SHA1

                                            3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

                                            SHA256

                                            08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

                                            SHA512

                                            76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                            Filesize

                                            152B

                                            MD5

                                            4d080dda9c2a5541b6ffe3773f2f641c

                                            SHA1

                                            733fd381751dc3b6f8ac28b09f0f0ac7bcd0dc3e

                                            SHA256

                                            6224eaebc9495149b394e88c328d507aff36e85d3d6688130ad086a1e21579b8

                                            SHA512

                                            7d03f2fea2448224f4a9833311a1bb50e7649c7ceaef90a0c05fde04b16e7066b126769c11cfa1450aa6232f91ed2a7192270f02a560908d48d871c7c35a5b2c

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                            Filesize

                                            152B

                                            MD5

                                            6765bdb27e13acfba74b48768a5ec60f

                                            SHA1

                                            e637b21874071ebf48ad196fcb698cea7727ef38

                                            SHA256

                                            566a4c6cc71f861e501e57b8b7963ac94840abe4f1ef0437fd393734f4e3d630

                                            SHA512

                                            59403fa32c822e4ed2b5c113600c92b2fc4d86aa100c87c5e7e4b56f5460d217826d964911cec2fae602643938e4f82d8e40f510bc907949e28fbebf4be08fec

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                            Filesize

                                            5KB

                                            MD5

                                            4c29e3ef4e9e54085b85d632d355afb1

                                            SHA1

                                            d4a609dc74c416b8e1a0da31eed163260816a62f

                                            SHA256

                                            4f77783491eda648d6b8b88814676f42951302b26fd2b787bcbe82caca3c2a7e

                                            SHA512

                                            a8456b0911cc4e1c1c7e59b333f1c85c6199f78fcc500dc1c6d426f92c12321dde606e6bbaf584eed01cbee1ec6f49eff11cb62b6c8bf33dddc78c7e9f5a6a3c

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6IJLDY7V\download[1].htm
                                            Filesize

                                            1B

                                            MD5

                                            cfcd208495d565ef66e7dff9f98764da

                                            SHA1

                                            b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                                            SHA256

                                            5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                                            SHA512

                                            31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\activity-stream.discovery_stream.json
                                            Filesize

                                            19KB

                                            MD5

                                            d9957c5c884c20d5ffc46a125d99d91d

                                            SHA1

                                            b31985f416c47502743a0096a8343e3b0dc4f0ff

                                            SHA256

                                            c7db7495acd24fa5a987cbb67a18877f3d0b7c6deef95408e16ad88e4f7cb7ba

                                            SHA512

                                            ce7f753161d6c867b84ff487cb4b16ca7e84f3af1132f6fc191f239286ed2662de9a065462cc769a011eac149dd8beeff223212d3d99db350dae4c9faa48018e

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
                                            Filesize

                                            13KB

                                            MD5

                                            def2eeaacf9f63820851bc44877d418f

                                            SHA1

                                            9dc06c136d660a277e2ce4ada8d10d7fb1d3e15e

                                            SHA256

                                            0168e2a9386228e241bea62527cb2d1bf07d638f74b4260bc46bd5bcf7faa243

                                            SHA512

                                            1d21c823816d7bf47c352ff16be9ce4dc906f4b20bba21bf93c680b031a7eb5a716a4db092cd2aac1b8f99610656cc473d49b6f70fff6831204c15dfd0595075

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                                            Filesize

                                            15KB

                                            MD5

                                            96c542dec016d9ec1ecc4dddfcbaac66

                                            SHA1

                                            6199f7648bb744efa58acf7b96fee85d938389e4

                                            SHA256

                                            7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                                            SHA512

                                            cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\1013829001\9feskIx.exe
                                            Filesize

                                            1.8MB

                                            MD5

                                            58f824a8f6a71da8e9a1acc97fc26d52

                                            SHA1

                                            b0e199e6f85626edebbecd13609a011cf953df69

                                            SHA256

                                            5e5b808ed64c4f40e07a4894e1da294e364383f0a51adb7ec8c7568afba3eb17

                                            SHA512

                                            7d6c752369ea83bad34873d8603c413e9372ff66adcaad11e7f23d3ce85827e057444b30eadf927329191825aef4dc37a1e68c30b71fae4ce6f53708102fb461

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\1013845001\6ec0fb99e0.exe
                                            Filesize

                                            1.9MB

                                            MD5

                                            2920e7cc2d1445dac674e5a361acdf93

                                            SHA1

                                            ae68904f35149434cb772fa55be52a94bb91c39a

                                            SHA256

                                            3dadaab5000b3129bc9844fff329754a7e3c20fa364dfd4dcd9ccbf531fce2a9

                                            SHA512

                                            e5ba86de23497ebf4d0204bf5db9e04c9f4999e0bc3741c730c2f237ad12dc49bf9a1a8f8186c42be3338e0fbbcb20d363c87c2f8954ae712aed9bfbe90582ef

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\1013846001\405c294750.exe
                                            Filesize

                                            2.5MB

                                            MD5

                                            2a78ce9f3872f5e591d643459cabe476

                                            SHA1

                                            9ac947dfc71a868bc9c2eb2bd78dfb433067682e

                                            SHA256

                                            21a2ac44acd7a640735870eebfd04b8dc57bc66877cb5be3b929299e86a43dae

                                            SHA512

                                            03e2cd8161a1394ee535a2ea7d197791ab715d69a02ffab98121ec5ac8150d2b17a9a32a59307042c4bbeffad7425b55efa047651de6ed39277dba80711454f9

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\1013847001\c4c0e5cc7e.exe
                                            Filesize

                                            1.8MB

                                            MD5

                                            0cefe9dfd3024abb0a90de7d3903deea

                                            SHA1

                                            11b1d1b803f45df9685826d6a2616219fd49c852

                                            SHA256

                                            fd864cb4c1cb656bf68153177fc4997132d00ae5bd2df2e181756295186804da

                                            SHA512

                                            fc8818b82f0ef2dce4755a872ab556ba3608ccb5d383747cf65a015e5a6bbe1f7804bc4c5d8d3fa68e05bb02481458f593d437a28929ef01ae933b50b1c8ee49

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\1013848001\6164c924e8.exe
                                            Filesize

                                            1.7MB

                                            MD5

                                            05ccde04770ed7266dc36ebb4523974d

                                            SHA1

                                            6de6f18a48fd56d6c65ea510b91fe6d868e0b7e3

                                            SHA256

                                            69c4775e400b5ee547f81fc67a0b9b5f6319b2adb4c482a9a79e716a56dc8e3b

                                            SHA512

                                            1c9dd7e3d4babd0d1ce0e812e57f982bb9bfe0c7e1e5d9fffe5757634921f65981c29abb3a856b7ad4bb0954b29dcd163096a5e2fe6aa227f51eb002ee945721

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\1013849001\6943013064.exe
                                            Filesize

                                            949KB

                                            MD5

                                            01f739d5437a9f2a00f374bc77074319

                                            SHA1

                                            7c6be727db3896a5e8080534d3a5a07eabc10019

                                            SHA256

                                            5c899e7bd1466b7d8a8fca178bb73e99aedc6d50951c4d226d3dde24dee3a97e

                                            SHA512

                                            bf7c8af17d7742062b59233cb628f792e97514c80e02c0533c9c8d5c925fea347892ac606507c18f7e66a466f2bf8a1e06763352bdb4fc7b92c40b993aa79947

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\1013850001\e6c14193eb.exe
                                            Filesize

                                            2.7MB

                                            MD5

                                            fa2c83f3c3dc8a2a7054b1ec4f47c41c

                                            SHA1

                                            502ddba5890ec40fcd927f7b2c6c5089943b9051

                                            SHA256

                                            6d2e322f70170af5b520ccfc7ffb1abfaa611e0252e5d2ccde4c416ab32770cc

                                            SHA512

                                            95028f7091bd2cd067c2636d6387052f33c1e6450f31733b9aeee54967725d61562edc6712abc59cdebff5db2124deabe73642593b412a5e5786345ef96796cc

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xctwqc5d.xrl.ps1
                                            Filesize

                                            60B

                                            MD5

                                            d17fe0a3f47be24a6453e9ef58c94641

                                            SHA1

                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                            SHA256

                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                            SHA512

                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                            Filesize

                                            3.1MB

                                            MD5

                                            4f2646500156298bd82c572e6c8e4062

                                            SHA1

                                            44c4da3bd22fc6ac172a3847c3fbe9b88659c1ff

                                            SHA256

                                            69f12161bd960117baf9728942be8ae7d34aeac22ffeff912dc8ab227a44229b

                                            SHA512

                                            50235199c1e446fcc1a1bd93bbadf4c048ac363a472297e522cd32290f0c81318f8434120b5ee77c82bbd85f01af7eb962e71e4de54ccd59f5ff214208b9de39

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                            Filesize

                                            479KB

                                            MD5

                                            09372174e83dbbf696ee732fd2e875bb

                                            SHA1

                                            ba360186ba650a769f9303f48b7200fb5eaccee1

                                            SHA256

                                            c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                            SHA512

                                            b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                                            Filesize

                                            13.8MB

                                            MD5

                                            0a8747a2ac9ac08ae9508f36c6d75692

                                            SHA1

                                            b287a96fd6cc12433adb42193dfe06111c38eaf0

                                            SHA256

                                            32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                            SHA512

                                            59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                            Download Submit

                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin
                                            Filesize

                                            6KB

                                            MD5

                                            773711782fb1744d4fd4347a1a6f30c2

                                            SHA1

                                            ceb836bd35f4f83dcf81eaaaeb6ba8be64e69bae

                                            SHA256

                                            b3725c78e6f2e6c93c76b4dd528c49f93ebec7af2f77ee05e530e72f7578710d

                                            SHA512

                                            aba30aa55f361ecd8d3eb82cec4a56aac4bdf0a9df008b670a4bf01082e76c318ae07cfbf986d84705f4029505b78010876685946bc399d2940329392ec9d37e

                                            Download Submit

                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin
                                            Filesize

                                            8KB

                                            MD5

                                            785c1843d413059a4aecee5ebaefef30

                                            SHA1

                                            ba738b76ce5f01ca1ddb2e77e00c46789178a75c

                                            SHA256

                                            519c713ec158b0b487730b5a9e7df4ce2e0f9f4a2089ae9cc747622dc0ed1424

                                            SHA512

                                            5ae984c0d92dd3b325bebf4143e8112f42578ed3f7e9486b863469ce41edd541fafc9374993512dd17d60728e6c04c33edc36466624e7be09f0cb09319abe001

                                            Download Submit

                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\cookies.sqlite-wal
                                            Filesize

                                            256KB

                                            MD5

                                            eb25a3ab5ae090eb72019cf18f44c9ec

                                            SHA1

                                            c916d437aca89879715debb6f8480c21a0d3a292

                                            SHA256

                                            047b4b4e0d0fd37f991aa93f9288cdaae39b5f157dd6143feddf51b87d72d5bc

                                            SHA512

                                            a8cc3c9dae3162a137de7c88dee3a53eca38daab79ca6ea705f5f2f19b599f17af9744a915765f8166e8afc820e92da284bee018a73111e247f31c0f123d1d4f

                                            Download Submit

                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
                                            Filesize

                                            5KB

                                            MD5

                                            2d296882b3022b0e5012b90dfb950f07

                                            SHA1

                                            37fc0e0708459f6f727614d38b33356731abd2d3

                                            SHA256

                                            f5c604194329e7ebc1bf4edb51cfd4cc38b2082fadfe251daf4548fe53306628

                                            SHA512

                                            29a6f822781d0342f3fbebfa763c9fcf18328de0f644a5bd62d8451fa1598f20a41dbbda61d683d670a2ce2fc5f1cf2048f3823cbc696f78599e7a0ab15f5ce1

                                            Download Submit

                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
                                            Filesize

                                            15KB

                                            MD5

                                            9130e63cce50b52bdf11b578fc6d7e8d

                                            SHA1

                                            2b5de2527d381fa7d18de3d926d8fc4db988cd6f

                                            SHA256

                                            cb00708ec549f322e878dafb4cd3da563fe421fe637d9c4e4609bac04b37a3c3

                                            SHA512

                                            75f7c4ded2a8a7bbc049ccd96b47f1aeeca675e76c6e74af0e806280451f84244bc563da36b70afceb634d194397cac31429d511fcdb272d1340175a49cad7f7

                                            Download Submit

                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
                                            Filesize

                                            15KB

                                            MD5

                                            5beb7314595d0bf4c9f4ac460a22f229

                                            SHA1

                                            24c318c6527d515445db85268bcc120c3c3d163f

                                            SHA256

                                            22145b54337d6a6a328ffdabb033f0831c48167d0ee04b5a3bc44524b77c6da7

                                            SHA512

                                            737dd04ac7b0dd059be1f4e893385463622e5bf568868a58273cd55330e3d185ee49f0c8f2aea2e29570e9fdf29e92052cc2b4e5481eb134d2f0492289ceff5b

                                            Download Submit

                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\1021d902-7e91-4df2-b73b-4a37dd973b31
                                            Filesize

                                            671B

                                            MD5

                                            4f87b44eca42d8405db698f749715571

                                            SHA1

                                            7868831b63bdb364bbb85f665d669c41d59f9f1e

                                            SHA256

                                            9d409affb861d4e07a905f3d506c518d4dafef8e5149f09041041cc2a17368b4

                                            SHA512

                                            e2aceb7996d9656e77e8cb5ed31eee83d090f67ced6e30d87e516a3fa6689fbf597293ebc7ef97251c89e2b5f3992935e9ec0b101e784ff4bcff7fef00413904

                                            Download Submit

                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\61e55c8e-a352-4e80-a908-0d32ff3c80a4
                                            Filesize

                                            26KB

                                            MD5

                                            88f40f1ce4a4c01f6c0fe312ebbd9537

                                            SHA1

                                            18e748d526e7fe4b81dbf8a50dc8d569ab5e91f8

                                            SHA256

                                            1acf460819ed9e7e3f77cc5ef525ccc47821a4b8fbfacb7157114867e90f47ae

                                            SHA512

                                            efcbdd858fe2dd5f14ffdaa3f247a9210912c908a39ef1fe4dccd2c98841cef917e60a7557566d946401f57170bb709eac4e19f2b4e6c324684c7cd93ab5ead5

                                            Download Submit

                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\bb48dcb1-e11f-4b77-9b21-79c2d88877cc
                                            Filesize

                                            982B

                                            MD5

                                            e2eed872f7a70fa172845585bfab5ca9

                                            SHA1

                                            6aa95ffdc6e045c77d1a810cb7770b1bc120d7a1

                                            SHA256

                                            4e5e69b3d09cfcec91526f85a0874c51ca2d8502127e357bc82389f60a2cfdf8

                                            SHA512

                                            926f07ee9a70ae923c3462430b97fedf5d3a34dbd3b4c958d90deff3bc46a29c071d92cfb2056102efd0531d470aeb89b3a2bc10a34fd9604c2af322f29e4960

                                            Download Submit

                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                                            Filesize

                                            1.1MB

                                            MD5

                                            842039753bf41fa5e11b3a1383061a87

                                            SHA1

                                            3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                            SHA256

                                            d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                            SHA512

                                            d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                            Download Submit

                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                                            Filesize

                                            116B

                                            MD5

                                            2a461e9eb87fd1955cea740a3444ee7a

                                            SHA1

                                            b10755914c713f5a4677494dbe8a686ed458c3c5

                                            SHA256

                                            4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                            SHA512

                                            34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                            Download Submit

                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                                            Filesize

                                            372B

                                            MD5

                                            bf957ad58b55f64219ab3f793e374316

                                            SHA1

                                            a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                            SHA256

                                            bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                            SHA512

                                            79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                            Download Submit

                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                                            Filesize

                                            17.8MB

                                            MD5

                                            daf7ef3acccab478aaa7d6dc1c60f865

                                            SHA1

                                            f8246162b97ce4a945feced27b6ea114366ff2ad

                                            SHA256

                                            bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                            SHA512

                                            5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                            Download Submit

                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\places.sqlite-wal
                                            Filesize

                                            1.4MB

                                            MD5

                                            ebba3ad3f34e4f785fe38f7abf713c8b

                                            SHA1

                                            138ebbc63a1bd74e0ffeaf651c98f85f5b02df94

                                            SHA256

                                            14c3033d899b085dae4c97a60365d56753b8064de135cf56f668651158293774

                                            SHA512

                                            bd7a1549e4d92ed087830c1b7127d1e1242eb11c1b626eb3b7169b54edf5c8542a2dc0d7b0a79afc48391d9f94bdebfb8d0bd0e049e41298fac3adff712ec3b9

                                            Download Submit

                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js
                                            Filesize

                                            12KB

                                            MD5

                                            304a69f52c577903494b5158e4169aed

                                            SHA1

                                            8afc7b143f825130bee0728fe939da247faccc08

                                            SHA256

                                            1f1d47f4905326c3e2c174442ac0ff370212f08c703212676d691041c6379079

                                            SHA512

                                            173f3c7388b8d3d35943cd284943576e732a710db5e3d941475ca24fab0e1104ede0482bcced2158e78b63baaa4ff190e539cd99d16451f08fcd8a917ee68f63

                                            Download Submit

                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js
                                            Filesize

                                            10KB

                                            MD5

                                            a3a91458bbd9d4cc1ac9d39c74b7e0e7

                                            SHA1

                                            125cc32425fb7bcb21cac201eb75b0d16c63d7ac

                                            SHA256

                                            3f27ce071356162a9a1d4b096a47df48359def825dc0d23db1c5b61998d207f6

                                            SHA512

                                            0b7b2410f9b71b02e54513a996ef80cc6532082dedf386f97d8192ffb9d6082abb2dc1d6e5813d59542e58bd485d21e836c1ef967c1132e44b6a8130dfbf681a

                                            Download Submit

                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js
                                            Filesize

                                            15KB

                                            MD5

                                            956543d960ae6e99acb9194b270e553b

                                            SHA1

                                            4ef38c7911ac7262d2f730c2aaaa1df6140a1f97

                                            SHA256

                                            a8508f6cdf426c761b3a90ec8067aa4a50a284277b28ad10308528893d50b379

                                            SHA512

                                            f50446bf4ec220d8d9669a6e7d6de7ad4e0c3e7d737a67b8a0c5be219fd9c853f8148a1c44c1c0b55dc9ade7cba1f6c45c71f1fb2414307f28c00ce30c98df13

                                            Download Submit

                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                            Filesize

                                            960KB

                                            MD5

                                            ba87d89c8a03f083818e3d9589d41555

                                            SHA1

                                            43f3a1dcabf7f177507a98547aae8cf28152de9a

                                            SHA256

                                            8424f04af94ffe64b12c1f04677ea04d4c4386e781dea486825e8675d68c07c2

                                            SHA512

                                            beed20ff587e349e49548f92751f271bb69d956d38fd06c6ccf2d7f4226472dd9759f85dfe97fd13af6552ce3beef20c9c50f3c18748f625f35cc74fb9a1cd85

                                            Download Submit

                                          • C:\Users\Admin\Documents\JKKEHJDHJK.exe
                                            Filesize

                                            3.1MB

                                            MD5

                                            ea67026317674d166594bf5450ba5783

                                            SHA1

                                            e6f843343265c038a7b340d412795ab31176ef39

                                            SHA256

                                            f3b4123a66aacafe980321a2da2a3631367ae898269d629efc134149a02d05df

                                            SHA512

                                            0376dddb29eb71037c4be3aa8690d7e57f546d63d8d9c58aa68c0d769054ff4a2f91f746ef44cdcaf29e3230054cfd7a0ea462a4a91e06708db0da4ff905e654

                                            Download Submit

                                          • memory/408-207-0x0000000000400000-0x0000000000C6A000-memory.dmp

                                            Filesize

                                            8.4MB

                                            Download

                                          • memory/408-814-0x0000000000400000-0x0000000000C6A000-memory.dmp

                                            Filesize

                                            8.4MB

                                            Download

                                          • memory/408-507-0x0000000000400000-0x0000000000C6A000-memory.dmp

                                            Filesize

                                            8.4MB

                                            Download

                                          • memory/408-761-0x0000000000400000-0x0000000000C6A000-memory.dmp

                                            Filesize

                                            8.4MB

                                            Download

                                          • memory/408-158-0x0000000000400000-0x0000000000C6A000-memory.dmp

                                            Filesize

                                            8.4MB

                                            Download

                                          • memory/408-206-0x0000000000400000-0x0000000000C6A000-memory.dmp

                                            Filesize

                                            8.4MB

                                            Download

                                          • memory/408-164-0x0000000010000000-0x000000001001C000-memory.dmp

                                            Filesize

                                            112KB

                                            Download

                                          • memory/620-54-0x0000000000600000-0x0000000000928000-memory.dmp

                                            Filesize

                                            3.2MB

                                            Download

                                          • memory/620-53-0x0000000000600000-0x0000000000928000-memory.dmp

                                            Filesize

                                            3.2MB

                                            Download

                                          • memory/1580-1026-0x0000000000600000-0x0000000000928000-memory.dmp

                                            Filesize

                                            3.2MB

                                            Download

                                          • memory/1580-23-0x0000000000600000-0x0000000000928000-memory.dmp

                                            Filesize

                                            3.2MB

                                            Download

                                          • memory/1580-162-0x0000000000600000-0x0000000000928000-memory.dmp

                                            Filesize

                                            3.2MB

                                            Download

                                          • memory/1580-55-0x0000000000600000-0x0000000000928000-memory.dmp

                                            Filesize

                                            3.2MB

                                            Download

                                          • memory/1580-49-0x0000000000600000-0x0000000000928000-memory.dmp

                                            Filesize

                                            3.2MB

                                            Download

                                          • memory/1580-60-0x0000000000600000-0x0000000000928000-memory.dmp

                                            Filesize

                                            3.2MB

                                            Download

                                          • memory/1580-26-0x0000000000600000-0x0000000000928000-memory.dmp

                                            Filesize

                                            3.2MB

                                            Download

                                          • memory/1580-25-0x0000000000600000-0x0000000000928000-memory.dmp

                                            Filesize

                                            3.2MB

                                            Download

                                          • memory/1580-24-0x0000000000600000-0x0000000000928000-memory.dmp

                                            Filesize

                                            3.2MB

                                            Download

                                          • memory/1580-260-0x0000000000600000-0x0000000000928000-memory.dmp

                                            Filesize

                                            3.2MB

                                            Download

                                          • memory/1580-63-0x0000000000600000-0x0000000000928000-memory.dmp

                                            Filesize

                                            3.2MB

                                            Download

                                          • memory/1580-690-0x0000000000600000-0x0000000000928000-memory.dmp

                                            Filesize

                                            3.2MB

                                            Download

                                          • memory/1580-22-0x0000000000600000-0x0000000000928000-memory.dmp

                                            Filesize

                                            3.2MB

                                            Download

                                          • memory/1580-21-0x0000000000600000-0x0000000000928000-memory.dmp

                                            Filesize

                                            3.2MB

                                            Download

                                          • memory/1580-20-0x0000000000600000-0x0000000000928000-memory.dmp

                                            Filesize

                                            3.2MB

                                            Download

                                          • memory/1580-19-0x0000000000600000-0x0000000000928000-memory.dmp

                                            Filesize

                                            3.2MB

                                            Download

                                          • memory/1580-827-0x0000000000600000-0x0000000000928000-memory.dmp

                                            Filesize

                                            3.2MB

                                            Download

                                          • memory/1580-18-0x0000000000600000-0x0000000000928000-memory.dmp

                                            Filesize

                                            3.2MB

                                            Download

                                          • memory/1580-2117-0x0000000000600000-0x0000000000928000-memory.dmp

                                            Filesize

                                            3.2MB

                                            Download

                                          • memory/1580-3155-0x0000000000600000-0x0000000000928000-memory.dmp

                                            Filesize

                                            3.2MB

                                            Download

                                          • memory/1580-3278-0x0000000000600000-0x0000000000928000-memory.dmp

                                            Filesize

                                            3.2MB

                                            Download

                                          • memory/1812-64-0x0000000008C50000-0x0000000008C5E000-memory.dmp

                                            Filesize

                                            56KB

                                            Download

                                          • memory/1812-85-0x000000000A960000-0x000000000A9AC000-memory.dmp

                                            Filesize

                                            304KB

                                            Download

                                          • memory/1812-57-0x00000000079A0000-0x0000000007F44000-memory.dmp

                                            Filesize

                                            5.6MB

                                            Download

                                          • memory/1812-58-0x0000000007750000-0x00000000077E2000-memory.dmp

                                            Filesize

                                            584KB

                                            Download

                                          • memory/1812-59-0x0000000007740000-0x000000000774A000-memory.dmp

                                            Filesize

                                            40KB

                                            Download

                                          • memory/1812-61-0x0000000008C60000-0x0000000008CC6000-memory.dmp

                                            Filesize

                                            408KB

                                            Download

                                          • memory/1812-65-0x0000000009DC0000-0x000000000A3E8000-memory.dmp

                                            Filesize

                                            6.2MB

                                            Download

                                          • memory/1812-75-0x0000000009B40000-0x0000000009B5A000-memory.dmp

                                            Filesize

                                            104KB

                                            Download

                                          • memory/1812-76-0x0000000009BA0000-0x0000000009BD6000-memory.dmp

                                            Filesize

                                            216KB

                                            Download

                                          • memory/1812-77-0x000000000AA70000-0x000000000B0EA000-memory.dmp

                                            Filesize

                                            6.5MB

                                            Download

                                          • memory/1812-139-0x0000000000770000-0x0000000000BE6000-memory.dmp

                                            Filesize

                                            4.5MB

                                            Download

                                          • memory/1812-137-0x000000000CD40000-0x000000000CD51000-memory.dmp

                                            Filesize

                                            68KB

                                            Download

                                          • memory/1812-45-0x0000000000770000-0x0000000000BE6000-memory.dmp

                                            Filesize

                                            4.5MB

                                            Download

                                          • memory/1812-46-0x0000000000770000-0x0000000000BE6000-memory.dmp

                                            Filesize

                                            4.5MB

                                            Download

                                          • memory/1812-47-0x0000000000770000-0x0000000000BE6000-memory.dmp

                                            Filesize

                                            4.5MB

                                            Download

                                          • memory/1812-136-0x000000000CBD0000-0x000000000CBDA000-memory.dmp

                                            Filesize

                                            40KB

                                            Download

                                          • memory/1812-135-0x000000000C7D0000-0x000000000C873000-memory.dmp

                                            Filesize

                                            652KB

                                            Download

                                          • memory/1812-134-0x000000000C7B0000-0x000000000C7CE000-memory.dmp

                                            Filesize

                                            120KB

                                            Download

                                          • memory/1812-86-0x000000000A420000-0x000000000A442000-memory.dmp

                                            Filesize

                                            136KB

                                            Download

                                          • memory/1812-51-0x0000000000770000-0x0000000000BE6000-memory.dmp

                                            Filesize

                                            4.5MB

                                            Download

                                          • memory/1812-84-0x000000000A9B0000-0x000000000AA16000-memory.dmp

                                            Filesize

                                            408KB

                                            Download

                                          • memory/1812-78-0x0000000009C80000-0x0000000009D16000-memory.dmp

                                            Filesize

                                            600KB

                                            Download

                                          • memory/1812-83-0x000000000B0F0000-0x000000000B444000-memory.dmp

                                            Filesize

                                            3.3MB

                                            Download

                                          • memory/1812-79-0x0000000009C10000-0x0000000009C32000-memory.dmp

                                            Filesize

                                            136KB

                                            Download

                                          • memory/1812-82-0x000000000A780000-0x000000000A8A0000-memory.dmp

                                            Filesize

                                            1.1MB

                                            Download

                                          • memory/1812-48-0x0000000006F80000-0x000000000701C000-memory.dmp

                                            Filesize

                                            624KB

                                            Download

                                          • memory/1812-81-0x0000000009D70000-0x0000000009DBA000-memory.dmp

                                            Filesize

                                            296KB

                                            Download

                                          • memory/1812-80-0x0000000009C60000-0x0000000009C7E000-memory.dmp

                                            Filesize

                                            120KB

                                            Download

                                          • memory/2256-17-0x00000000006B1000-0x0000000000719000-memory.dmp

                                            Filesize

                                            416KB

                                            Download

                                          • memory/2256-16-0x00000000006B0000-0x00000000009D8000-memory.dmp

                                            Filesize

                                            3.2MB

                                            Download

                                          • memory/2256-0-0x00000000006B0000-0x00000000009D8000-memory.dmp

                                            Filesize

                                            3.2MB

                                            Download

                                          • memory/2256-4-0x00000000006B0000-0x00000000009D8000-memory.dmp

                                            Filesize

                                            3.2MB

                                            Download

                                          • memory/2256-3-0x00000000006B0000-0x00000000009D8000-memory.dmp

                                            Filesize

                                            3.2MB

                                            Download

                                          • memory/2256-2-0x00000000006B1000-0x0000000000719000-memory.dmp

                                            Filesize

                                            416KB

                                            Download

                                          • memory/2256-1-0x0000000077E14000-0x0000000077E16000-memory.dmp

                                            Filesize

                                            8KB

                                            Download

                                          • memory/2348-812-0x0000000000600000-0x0000000000928000-memory.dmp

                                            Filesize

                                            3.2MB

                                            Download

                                          • memory/2348-806-0x0000000000600000-0x0000000000928000-memory.dmp

                                            Filesize

                                            3.2MB

                                            Download

                                          • memory/3700-204-0x00000000001A0000-0x0000000000642000-memory.dmp

                                            Filesize

                                            4.6MB

                                            Download

                                          • memory/3700-227-0x00000000001A0000-0x0000000000642000-memory.dmp

                                            Filesize

                                            4.6MB

                                            Download

                                          • memory/3980-949-0x00000000003A0000-0x0000000000A40000-memory.dmp

                                            Filesize

                                            6.6MB

                                            Download

                                          • memory/3980-224-0x00000000003A0000-0x0000000000A40000-memory.dmp

                                            Filesize

                                            6.6MB

                                            Download

                                          • memory/3980-511-0x00000000003A0000-0x0000000000A40000-memory.dmp

                                            Filesize

                                            6.6MB

                                            Download

                                          • memory/3980-816-0x00000000003A0000-0x0000000000A40000-memory.dmp

                                            Filesize

                                            6.6MB

                                            Download

                                          • memory/3980-594-0x00000000003A0000-0x0000000000A40000-memory.dmp

                                            Filesize

                                            6.6MB

                                            Download

                                          • memory/3980-986-0x00000000003A0000-0x0000000000A40000-memory.dmp

                                            Filesize

                                            6.6MB

                                            Download

                                          • memory/3980-236-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                            Filesize

                                            972KB

                                            Download

                                          • memory/4228-726-0x0000000000E70000-0x000000000112C000-memory.dmp

                                            Filesize

                                            2.7MB

                                            Download

                                          • memory/4228-729-0x0000000000E70000-0x000000000112C000-memory.dmp

                                            Filesize

                                            2.7MB

                                            Download

                                          • memory/4228-303-0x0000000000E70000-0x000000000112C000-memory.dmp

                                            Filesize

                                            2.7MB

                                            Download

                                          • memory/4228-305-0x0000000000E70000-0x000000000112C000-memory.dmp

                                            Filesize

                                            2.7MB

                                            Download

                                          • memory/4228-304-0x0000000000E70000-0x000000000112C000-memory.dmp

                                            Filesize

                                            2.7MB

                                            Download

                                          • memory/4804-714-0x0000000001330000-0x0000000001387000-memory.dmp

                                            Filesize

                                            348KB

                                            Download

                                          • memory/5560-951-0x0000000000340000-0x000000000065D000-memory.dmp

                                            Filesize

                                            3.1MB

                                            Download

                                          • memory/5560-985-0x0000000000340000-0x000000000065D000-memory.dmp

                                            Filesize

                                            3.1MB

                                            Download