Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    12-12-2024 11:35

General

  • Target

    fb9ca04eb63973f5badd7bae3dd967f942ac21eb7b3853b76b00e480e32c6ef3.exe

  • Size

    3.2MB

  • MD5

    5e1f79c85746f02bba8f07ddf1d40582

  • SHA1

    e5121c356beeda93810ce5298cace9fb22ef8367

  • SHA256

    fb9ca04eb63973f5badd7bae3dd967f942ac21eb7b3853b76b00e480e32c6ef3

  • SHA512

    defbdd6351fc7bcc070894fa6d88939884163161cb5700c839a80a47c1e225456b25c372a1af7852417a22dc38ec7bd825e154ee589bca678b46fb6695ac513e

  • SSDEEP

    98304:27iO49oaaHxetDYRA7/f2ws67CZYUErr8ozh:23XK2RYUCr8ozh

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://drive-connect.cyou/api

Extracted

Family

lumma

C2

https://drive-connect.cyou/api

https://covery-mover.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

  • Gcleaner family
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 10 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 17 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Kills process with taskkill 5 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 43 IoCs
  • Suspicious use of SendNotifyMessage 41 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\fb9ca04eb63973f5badd7bae3dd967f942ac21eb7b3853b76b00e480e32c6ef3.exe
    "C:\Users\Admin\AppData\Local\Temp\fb9ca04eb63973f5badd7bae3dd967f942ac21eb7b3853b76b00e480e32c6ef3.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2188
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2228
      • C:\Users\Admin\AppData\Local\Temp\1014365001\W4KLQf7.exe
        "C:\Users\Admin\AppData\Local\Temp\1014365001\W4KLQf7.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2340
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\hyper-v.exe"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2864
        • C:\Windows\SysWOW64\systeminfo.exe
          systeminfo
          4⤵
          • System Location Discovery: System Language Discovery
          • Gathers system information
          PID:3228
      • C:\Users\Admin\AppData\Local\Temp\1014373001\53ab41ef12.exe
        "C:\Users\Admin\AppData\Local\Temp\1014373001\53ab41ef12.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1956
      • C:\Users\Admin\AppData\Local\Temp\1014374001\76b038065c.exe
        "C:\Users\Admin\AppData\Local\Temp\1014374001\76b038065c.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2016
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM firefox.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1816
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM chrome.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2620
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM msedge.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2116
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM opera.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1880
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM brave.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3028
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
          4⤵
            PID:1552
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
              5⤵
              • Checks processor information in registry
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:1612
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1612.0.404991663\425742110" -parentBuildID 20221007134813 -prefsHandle 1268 -prefMapHandle 1260 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {42793583-7037-447e-a82e-a5f0553b1285} 1612 "\\.\pipe\gecko-crash-server-pipe.1612" 1368 102efb58 gpu
                6⤵
                  PID:640
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1612.1.55761472\341985915" -parentBuildID 20221007134813 -prefsHandle 1520 -prefMapHandle 1516 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {41f25a34-23bf-45be-9628-9db0a4a2f907} 1612 "\\.\pipe\gecko-crash-server-pipe.1612" 1532 f4eee58 socket
                  6⤵
                    PID:2432
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1612.2.1472971530\1913017258" -childID 1 -isForBrowser -prefsHandle 2008 -prefMapHandle 2004 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 584 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {18d11198-33d8-47dc-95bf-07012d4e947d} 1612 "\\.\pipe\gecko-crash-server-pipe.1612" 2020 182bba58 tab
                    6⤵
                      PID:2948
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1612.3.1027455391\1617428730" -childID 2 -isForBrowser -prefsHandle 2892 -prefMapHandle 2888 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 584 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a5dc5ef-e2df-4096-bfd5-d8e0c90ac4b5} 1612 "\\.\pipe\gecko-crash-server-pipe.1612" 2904 e5e458 tab
                      6⤵
                        PID:1772
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1612.4.44512805\933412459" -childID 3 -isForBrowser -prefsHandle 3816 -prefMapHandle 3812 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 584 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {daca1cce-142c-4d28-a5d6-337849199d93} 1612 "\\.\pipe\gecko-crash-server-pipe.1612" 3828 e62d58 tab
                        6⤵
                          PID:1972
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1612.5.318340931\1049423398" -childID 4 -isForBrowser -prefsHandle 3840 -prefMapHandle 3836 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 584 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {33ce4735-4daf-4367-b301-5334ba1993f3} 1612 "\\.\pipe\gecko-crash-server-pipe.1612" 3660 1ebc3958 tab
                          6⤵
                            PID:1604
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1612.6.1661346227\131014624" -childID 5 -isForBrowser -prefsHandle 4056 -prefMapHandle 4068 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 584 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0490a229-7b35-4516-8225-a3bf89b75503} 1612 "\\.\pipe\gecko-crash-server-pipe.1612" 3816 1edd3258 tab
                            6⤵
                              PID:2752
                      • C:\Users\Admin\AppData\Local\Temp\1014375001\ffcb45d026.exe
                        "C:\Users\Admin\AppData\Local\Temp\1014375001\ffcb45d026.exe"
                        3⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        PID:612
                      • C:\Users\Admin\AppData\Local\Temp\1014376001\ed087f6069.exe
                        "C:\Users\Admin\AppData\Local\Temp\1014376001\ed087f6069.exe"
                        3⤵
                        • Modifies Windows Defender Real-time Protection settings
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Windows security modification
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1884
                      • C:\Users\Admin\AppData\Local\Temp\1014377001\614334195c.exe
                        "C:\Users\Admin\AppData\Local\Temp\1014377001\614334195c.exe"
                        3⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Loads dropped DLL
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2612
                      • C:\Users\Admin\AppData\Local\Temp\1014378001\a087d46760.exe
                        "C:\Users\Admin\AppData\Local\Temp\1014378001\a087d46760.exe"
                        3⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:3040
                        • C:\Users\Admin\AppData\Local\Temp\1014378001\a087d46760.exe
                          "C:\Users\Admin\AppData\Local\Temp\1014378001\a087d46760.exe"
                          4⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Modifies system certificate store
                          PID:2944
                      • C:\Users\Admin\AppData\Local\Temp\1014379001\fa6c79db64.exe
                        "C:\Users\Admin\AppData\Local\Temp\1014379001\fa6c79db64.exe"
                        3⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Checks processor information in registry
                        • Modifies system certificate store
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2376
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1014379001\fa6c79db64.exe" & rd /s /q "C:\ProgramData\GLXT00RQQ9RI" & exit
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:3352
                          • C:\Windows\SysWOW64\timeout.exe
                            timeout /t 10
                            5⤵
                            • System Location Discovery: System Language Discovery
                            • Delays execution with timeout.exe
                            PID:3384
                  • C:\Windows\system32\DllHost.exe
                    C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
                    1⤵
                      PID:3028

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8P9TO0C6\download[1].htm

                      Filesize

                      1B

                      MD5

                      cfcd208495d565ef66e7dff9f98764da

                      SHA1

                      b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                      SHA256

                      5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                      SHA512

                      31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bhzluvd5.default-release\activity-stream.discovery_stream.json.tmp

                      Filesize

                      23KB

                      MD5

                      388f9e40d60671fcc4fae3cc03df9877

                      SHA1

                      e149c2fa2deb8f7ee305e6e17c9c8937c9f0aa78

                      SHA256

                      d85132f75f07fbc42b08e8a3fb7c8c5567ae3142bb83e21c4e3672067acf0128

                      SHA512

                      b99bc8c7abbc7d5757b0513832ad22c2323dbfc68c6949f3286b04255da8e9d467b74f939cfc3303f5e43442ed1802b9e2f388a3714a5642af1b1df18f27e094

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bhzluvd5.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

                      Filesize

                      15KB

                      MD5

                      96c542dec016d9ec1ecc4dddfcbaac66

                      SHA1

                      6199f7648bb744efa58acf7b96fee85d938389e4

                      SHA256

                      7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                      SHA512

                      cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                    • C:\Users\Admin\AppData\Local\Temp\1014365001\W4KLQf7.exe

                      Filesize

                      3.7MB

                      MD5

                      12c766cab30c7a0ef110f0199beda18b

                      SHA1

                      efdc8eb63df5aae563c7153c3bd607812debeba4

                      SHA256

                      7b2070ca45ec370acba43623fb52931ee52bee6f0ce74e6230179b058fa2c316

                      SHA512

                      32cad9086d9c7a8d88c3bfcb0806f350f0df9624637439f1e34ab2efffa0c273faef0c226c388ed28f07381aef0655af9e3eb3e9557cbfd2d8c915b556b1cf10

                    • C:\Users\Admin\AppData\Local\Temp\1014373001\53ab41ef12.exe

                      Filesize

                      2.5MB

                      MD5

                      2a78ce9f3872f5e591d643459cabe476

                      SHA1

                      9ac947dfc71a868bc9c2eb2bd78dfb433067682e

                      SHA256

                      21a2ac44acd7a640735870eebfd04b8dc57bc66877cb5be3b929299e86a43dae

                      SHA512

                      03e2cd8161a1394ee535a2ea7d197791ab715d69a02ffab98121ec5ac8150d2b17a9a32a59307042c4bbeffad7425b55efa047651de6ed39277dba80711454f9

                    • C:\Users\Admin\AppData\Local\Temp\1014374001\76b038065c.exe

                      Filesize

                      947KB

                      MD5

                      82371c46d624ba7ee9047f7008ba2e3c

                      SHA1

                      f9855774f6db73dce92e733a0cfb2d4fd70e5422

                      SHA256

                      bd7497cac83a386d4b21f84fe94e9df74603230d46507582f7de4c6a2fe760d4

                      SHA512

                      d8f8e060de3c39f28bf2269273e26d2f9101d0b05de18ffa2c535ad628775321d696aa3ee82f9a546c44e8b74bec72938a6a40faaecfcda60324f3cceb68d402

                    • C:\Users\Admin\AppData\Local\Temp\1014375001\ffcb45d026.exe

                      Filesize

                      1.7MB

                      MD5

                      656562cca191b9d58ce38dd8b98b7879

                      SHA1

                      29133dce961cadbfa01da2581dc43cd6b2c2a745

                      SHA256

                      61b227734b42abc0b52830af310f124bf668f033aaeec5cf5c58b001261a2ca3

                      SHA512

                      e7675dad6a82442ff43347de725fb0d223fc264205951494e35144e9c9ecea77042cc5e25fbc9bc5191897a126adbb6abc88c233f88a067a01efea6a0c10ce03

                    • C:\Users\Admin\AppData\Local\Temp\1014376001\ed087f6069.exe

                      Filesize

                      2.7MB

                      MD5

                      a64f923cacadf2e7020d0e9b7383276c

                      SHA1

                      59146faef7928db615b58a1eb9757ff8b2ad0337

                      SHA256

                      2f7d1a912f1c224867bffc00e2ce664df0b131abdf1128d7f50cfd373f9196f5

                      SHA512

                      a8f9f8ad1bc2aa54a0092e4dcc77e020151a0137bc9b28dcc494f27c0c45fd124801b064400b813c7aee76d4337c1239a5da96bf99e9ffbbe47231b0597f5bef

                    • C:\Users\Admin\AppData\Local\Temp\1014377001\614334195c.exe

                      Filesize

                      1.9MB

                      MD5

                      6b388916c9f72353cbd4799ed242d4f4

                      SHA1

                      64b382ca1909b0ae89f26d49652f19fceaf33a48

                      SHA256

                      83cc25a9b6c72190cd8886758cc9afa6625be19579a7532faa97f3feb5e6a7fd

                      SHA512

                      90e42d22d3c2f87daa6703312dab91c00f6026f17325434f75520852d96d31969c4ebca0f94947626c372b18b57cc7e8af11d637cda68c2526d3971d44f7e85a

                    • C:\Users\Admin\AppData\Local\Temp\1014378001\a087d46760.exe

                      Filesize

                      710KB

                      MD5

                      28e568616a7b792cac1726deb77d9039

                      SHA1

                      39890a418fb391b823ed5084533e2e24dff021e1

                      SHA256

                      9597798f7789adc29fbe97707b1bd8ca913c4d5861b0ad4fdd6b913af7c7a8e2

                      SHA512

                      85048799e6d2756f1d6af77f34e6a1f454c48f2f43042927845931b7ecff2e5de45f864627a3d4aa061252401225bbb6c2caa8532320ccbe401e97c9c79ac8e5

                    • C:\Users\Admin\AppData\Local\Temp\1014379001\fa6c79db64.exe

                      Filesize

                      384KB

                      MD5

                      dfd5f78a711fa92337010ecc028470b4

                      SHA1

                      1a389091178f2be8ce486cd860de16263f8e902e

                      SHA256

                      da96f2eb74e60de791961ef3800c36a5e12202fe97ae5d2fcfc1fe404bc13c0d

                      SHA512

                      a3673074919039a2dc854b0f91d1e1a69724056594e33559741f53594e0f6e61e3d99ec664d541b17f09ffdebc2de1b042eec19ca8477fac86359c703f8c9656

                    • C:\Users\Admin\AppData\Local\Temp\CabC13F.tmp

                      Filesize

                      70KB

                      MD5

                      49aebf8cbd62d92ac215b2923fb1b9f5

                      SHA1

                      1723be06719828dda65ad804298d0431f6aff976

                      SHA256

                      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                      SHA512

                      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                    • C:\Users\Admin\AppData\Local\Temp\TarC19F.tmp

                      Filesize

                      181KB

                      MD5

                      4ea6026cf93ec6338144661bf1202cd1

                      SHA1

                      a1dec9044f750ad887935a01430bf49322fbdcb7

                      SHA256

                      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                      SHA512

                      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                      Filesize

                      442KB

                      MD5

                      85430baed3398695717b0263807cf97c

                      SHA1

                      fffbee923cea216f50fce5d54219a188a5100f41

                      SHA256

                      a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                      SHA512

                      06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                      Filesize

                      8.0MB

                      MD5

                      a01c5ecd6108350ae23d2cddf0e77c17

                      SHA1

                      c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                      SHA256

                      345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                      SHA512

                      b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\datareporting\glean\db\data.safe.bin

                      Filesize

                      2KB

                      MD5

                      1ef0753854f8059458f5377740e0fbcf

                      SHA1

                      e78c980d41e8b82d6d8f7184ef158601616c080d

                      SHA256

                      876f571aec6e996403e74581da7ed3320cc335a722556fc8dca6e4523ee426ca

                      SHA512

                      7b19045c1b78bd93cf35795a5aa77c53ef011b69c6a33dd9fe060f42cbfa3c688428894be8ec7800d87a7e9c6d84f7af2aeb2c03989d540edb09855e4228d5f4

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\datareporting\glean\pending_pings\955c35dc-ad36-4abf-89a0-ba3fb9403c25

                      Filesize

                      12KB

                      MD5

                      32de63916978ae21396c05204fab00bc

                      SHA1

                      482667bc4cdd6baf54500043ff74e825f4e6088c

                      SHA256

                      217d52b44a737a6bc68205a4f78ad309564cc12a7a93e02812869bb62eb6e52f

                      SHA512

                      b2bdb1d7126911069dfe0de5c56496d69106b7cabc2dd67f8034eb802b1fd0a3718867065eaff342fbfba50710f6a624eb879044379e554258c38104eb57b93f

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\datareporting\glean\pending_pings\d9e2f514-ecde-4d3c-aed7-21e6b85d8b62

                      Filesize

                      745B

                      MD5

                      18ad9c5008e1989a89e42caf052e79ea

                      SHA1

                      245f8576dba608e3a2ad77b3ba416ab34b2039d5

                      SHA256

                      27b8e48e5b03305ddef4022a71041233c2f929e11e9c6e9f500c2f9be91520a5

                      SHA512

                      839ce887a7df1c85ec595c64dc31f0630a2d01c80072d0a0d3800a31627e7bbee003f0fdec2370718fdc6f8a53ef29f2cc8d32a2dc62fc37f2b3789a4b671c39

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                      Filesize

                      997KB

                      MD5

                      fe3355639648c417e8307c6d051e3e37

                      SHA1

                      f54602d4b4778da21bc97c7238fc66aa68c8ee34

                      SHA256

                      1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                      SHA512

                      8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                      Filesize

                      116B

                      MD5

                      3d33cdc0b3d281e67dd52e14435dd04f

                      SHA1

                      4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                      SHA256

                      f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                      SHA512

                      a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                      Filesize

                      479B

                      MD5

                      49ddb419d96dceb9069018535fb2e2fc

                      SHA1

                      62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                      SHA256

                      2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                      SHA512

                      48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                      Filesize

                      372B

                      MD5

                      8be33af717bb1b67fbd61c3f4b807e9e

                      SHA1

                      7cf17656d174d951957ff36810e874a134dd49e0

                      SHA256

                      e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                      SHA512

                      6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                      Filesize

                      11.8MB

                      MD5

                      33bf7b0439480effb9fb212efce87b13

                      SHA1

                      cee50f2745edc6dc291887b6075ca64d716f495a

                      SHA256

                      8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                      SHA512

                      d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                      Filesize

                      1KB

                      MD5

                      688bed3676d2104e7f17ae1cd2c59404

                      SHA1

                      952b2cdf783ac72fcb98338723e9afd38d47ad8e

                      SHA256

                      33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                      SHA512

                      7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                      Filesize

                      1KB

                      MD5

                      937326fead5fd401f6cca9118bd9ade9

                      SHA1

                      4526a57d4ae14ed29b37632c72aef3c408189d91

                      SHA256

                      68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                      SHA512

                      b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\prefs-1.js

                      Filesize

                      6KB

                      MD5

                      1def40d6a4acb4df8132cab93f3ff3a0

                      SHA1

                      8e2a7853f12c082255f8a7389c13dc9b5b235d51

                      SHA256

                      b76455bd40a9f3917aff77d0850a8b9afe579716777272d6b3110ad4b31f84c9

                      SHA512

                      ce2cb41a29d27383b1fe4054e6da6043916d9ffcf67aa583663ccf600aa0a16c12f604d06ec7791f0ce304785d94d0c922fb61aba3394eae6470eaa50601e21f

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\prefs-1.js

                      Filesize

                      7KB

                      MD5

                      8e75b34dff5e627ce456bbb6aca2fd48

                      SHA1

                      48f4fed34e442c853151ae7a7effdcf31d0cbb63

                      SHA256

                      6be03d6cb10b98e15650e400d19f8b245e2101e5d05b5d9df69c300046806afd

                      SHA512

                      01bd23b5a2c87283e55eb0935462e55488e73513686120fdd6285e588eebc0ea8e500c725b42479335f2d529832920192ec9a0b6ac920567fc1e09c75968127f

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\prefs-1.js

                      Filesize

                      6KB

                      MD5

                      e8ab5280ea409c69113e747a05ae4e92

                      SHA1

                      d4f769e6e56d91514762fd1a7329276cf108f321

                      SHA256

                      3c257acddf504bb94591e47bd759ee87c7738af4901a53b3e4dd3f52b383e344

                      SHA512

                      d9225dd2d8c8f7081265197e5d05daff519b988915f116e2318317fe2f2d4e4dee4c56132f85b8ffef4d6ee304560dc0fd29d97368f52d2cdb3f834c613e915c

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\prefs.js

                      Filesize

                      6KB

                      MD5

                      364f47ddf9286d8192a5ed9249076050

                      SHA1

                      425dce155b4059c797df8ab322a912fa27d9d5b7

                      SHA256

                      997bf51d0a21446d70ef914e2cef7103ff5eb858432999bb9700f2c878bc7245

                      SHA512

                      dfb1d9e29d115a09c0c1531af73a2af02ee03b8cb4c01c53828de6444f0061b16418f6a6b7be9da26db1db4d45869947c1810a62dbad123aafde0d6389199be1

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\sessionstore-backups\recovery.jsonlz4

                      Filesize

                      4KB

                      MD5

                      d2de1a115674d435252e7d29df0f9e01

                      SHA1

                      9a995eeb2a3eeaeb738f7e35810055df9b0d1571

                      SHA256

                      71fee1c7b539764ab34407cef2be12eea06593d3cd10f2f4a9e8e0197f2e3609

                      SHA512

                      742289bee6c763f85dc2b84fb44c936545ae6414ce3736d17adf6f6e0b39348316e4bda445eb3e13b148ebc9992a9231125656e97a0bee808e361280c69279ae

                    • \Users\Admin\AppData\Local\Temp\WvsKY31EurZe4zG6F1R\Y-Cleaner.exe

                      Filesize

                      1.4MB

                      MD5

                      a8cf5621811f7fac55cfe8cb3fa6b9f6

                      SHA1

                      121356839e8138a03141f5f5856936a85bd2a474

                      SHA256

                      614a0362ab87cee48d0935b5bb957d539be1d94c6fdeb3fe42fac4fbe182c10c

                      SHA512

                      4479d951435f222ca7306774002f030972c9f1715d6aaf512fca9420dd79cb6d08240f80129f213851773290254be34f0ff63c7b1f4d554a7db5f84b69e84bdd

                    • \Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

                      Filesize

                      3.2MB

                      MD5

                      5e1f79c85746f02bba8f07ddf1d40582

                      SHA1

                      e5121c356beeda93810ce5298cace9fb22ef8367

                      SHA256

                      fb9ca04eb63973f5badd7bae3dd967f942ac21eb7b3853b76b00e480e32c6ef3

                      SHA512

                      defbdd6351fc7bcc070894fa6d88939884163161cb5700c839a80a47c1e225456b25c372a1af7852417a22dc38ec7bd825e154ee589bca678b46fb6695ac513e

                    • memory/612-94-0x00000000013B0000-0x0000000001A4C000-memory.dmp

                      Filesize

                      6.6MB

                    • memory/612-105-0x00000000013B0000-0x0000000001A4C000-memory.dmp

                      Filesize

                      6.6MB

                    • memory/1884-115-0x0000000000080000-0x0000000000334000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/1884-117-0x0000000000080000-0x0000000000334000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/1884-120-0x0000000000080000-0x0000000000334000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/1884-243-0x0000000000080000-0x0000000000334000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/1956-202-0x0000000000400000-0x0000000000457000-memory.dmp

                      Filesize

                      348KB

                    • memory/2188-3-0x0000000000DB0000-0x00000000010DF000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/2188-4-0x0000000000DB0000-0x00000000010DF000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/2188-19-0x0000000000DB1000-0x0000000000E19000-memory.dmp

                      Filesize

                      416KB

                    • memory/2188-18-0x0000000000DB0000-0x00000000010DF000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/2188-2-0x0000000000DB1000-0x0000000000E19000-memory.dmp

                      Filesize

                      416KB

                    • memory/2188-20-0x00000000065C0000-0x00000000068EF000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/2188-0-0x0000000000DB0000-0x00000000010DF000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/2188-1-0x0000000077990000-0x0000000077992000-memory.dmp

                      Filesize

                      8KB

                    • memory/2228-138-0x0000000005FC0000-0x000000000684D000-memory.dmp

                      Filesize

                      8.6MB

                    • memory/2228-740-0x0000000000C80000-0x0000000000FAF000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/2228-181-0x0000000005FC0000-0x000000000684D000-memory.dmp

                      Filesize

                      8.6MB

                    • memory/2228-723-0x0000000000C80000-0x0000000000FAF000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/2228-178-0x0000000000C80000-0x0000000000FAF000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/2228-179-0x0000000005FC0000-0x000000000684D000-memory.dmp

                      Filesize

                      8.6MB

                    • memory/2228-710-0x0000000000C80000-0x0000000000FAF000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/2228-30-0x0000000000C80000-0x0000000000FAF000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/2228-28-0x0000000000C80000-0x0000000000FAF000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/2228-29-0x0000000000C80000-0x0000000000FAF000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/2228-27-0x0000000000C80000-0x0000000000FAF000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/2228-26-0x0000000000C80000-0x0000000000FAF000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/2228-24-0x0000000000C80000-0x0000000000FAF000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/2228-44-0x0000000000C80000-0x0000000000FAF000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/2228-150-0x0000000005FC0000-0x0000000006274000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/2228-23-0x0000000000C80000-0x0000000000FAF000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/2228-22-0x0000000000C80000-0x0000000000FAF000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/2228-725-0x0000000000C80000-0x0000000000FAF000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/2228-21-0x0000000000C80000-0x0000000000FAF000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/2228-258-0x0000000000C80000-0x0000000000FAF000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/2228-141-0x0000000005FC0000-0x0000000006274000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/2228-734-0x0000000000C80000-0x0000000000FAF000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/2228-139-0x0000000005FC0000-0x000000000684D000-memory.dmp

                      Filesize

                      8.6MB

                    • memory/2228-91-0x0000000005FC0000-0x000000000665C000-memory.dmp

                      Filesize

                      6.6MB

                    • memory/2228-130-0x0000000000C80000-0x0000000000FAF000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/2228-92-0x0000000000C80000-0x0000000000FAF000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/2228-119-0x0000000005FC0000-0x000000000665C000-memory.dmp

                      Filesize

                      6.6MB

                    • memory/2228-118-0x0000000005FC0000-0x000000000665C000-memory.dmp

                      Filesize

                      6.6MB

                    • memory/2228-113-0x0000000005FC0000-0x0000000006274000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/2228-114-0x0000000005FC0000-0x0000000006274000-memory.dmp

                      Filesize

                      2.7MB

                    • memory/2228-619-0x0000000000C80000-0x0000000000FAF000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/2228-592-0x0000000000C80000-0x0000000000FAF000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/2228-93-0x0000000005FC0000-0x000000000665C000-memory.dmp

                      Filesize

                      6.6MB

                    • memory/2340-564-0x0000000010000000-0x0000000010731000-memory.dmp

                      Filesize

                      7.2MB

                    • memory/2340-74-0x0000000000400000-0x00000000007BD000-memory.dmp

                      Filesize

                      3.7MB

                    • memory/2340-199-0x0000000000230000-0x00000000002A9000-memory.dmp

                      Filesize

                      484KB

                    • memory/2340-208-0x0000000000230000-0x00000000002A9000-memory.dmp

                      Filesize

                      484KB

                    • memory/2376-259-0x0000000000400000-0x000000000064B000-memory.dmp

                      Filesize

                      2.3MB

                    • memory/2376-591-0x0000000000400000-0x000000000064B000-memory.dmp

                      Filesize

                      2.3MB

                    • memory/2612-445-0x0000000010000000-0x000000001001C000-memory.dmp

                      Filesize

                      112KB

                    • memory/2612-345-0x0000000000400000-0x0000000000C8D000-memory.dmp

                      Filesize

                      8.6MB

                    • memory/2612-711-0x0000000000400000-0x0000000000C8D000-memory.dmp

                      Filesize

                      8.6MB

                    • memory/2612-621-0x0000000000400000-0x0000000000C8D000-memory.dmp

                      Filesize

                      8.6MB

                    • memory/2612-140-0x0000000000400000-0x0000000000C8D000-memory.dmp

                      Filesize

                      8.6MB

                    • memory/2612-600-0x0000000000400000-0x0000000000C8D000-memory.dmp

                      Filesize

                      8.6MB

                    • memory/2612-180-0x0000000000400000-0x0000000000C8D000-memory.dmp

                      Filesize

                      8.6MB

                    • memory/2612-716-0x0000000000400000-0x0000000000C8D000-memory.dmp

                      Filesize

                      8.6MB

                    • memory/2944-196-0x0000000000400000-0x0000000000457000-memory.dmp

                      Filesize

                      348KB

                    • memory/2944-189-0x0000000000400000-0x0000000000457000-memory.dmp

                      Filesize

                      348KB

                    • memory/2944-187-0x0000000000400000-0x0000000000457000-memory.dmp

                      Filesize

                      348KB

                    • memory/2944-191-0x0000000000400000-0x0000000000457000-memory.dmp

                      Filesize

                      348KB

                    • memory/2944-185-0x0000000000400000-0x0000000000457000-memory.dmp

                      Filesize

                      348KB

                    • memory/2944-183-0x0000000000400000-0x0000000000457000-memory.dmp

                      Filesize

                      348KB

                    • memory/2944-193-0x0000000000400000-0x0000000000457000-memory.dmp

                      Filesize

                      348KB

                    • memory/2944-195-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                      Filesize

                      4KB

                    • memory/2944-198-0x0000000000400000-0x0000000000457000-memory.dmp

                      Filesize

                      348KB