Overview

overview

10

Static

static

3

4ec31f4077...22.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-12-2024 14:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4ec31f4077dd5c4c9ffb76cda98e3527df934080c5262dc0c6438ff70c379d22.exe

  • Size

    7.0MB

  • MD5

    03b53b8340e4d290aefbfa57f23357a3

  • SHA1

    3b0fae3655b40e474f97da515fc629e060b8d6d3

  • SHA256

    4ec31f4077dd5c4c9ffb76cda98e3527df934080c5262dc0c6438ff70c379d22

  • SHA512

    390655ce74e5174a7e5c7d1e7b417300d000b15312a6c88ad9652298b74ccc949aa68b551756638c17f3f82fa409fb1bf2b18fdc72e19c6dfe0ff6327f01d778

  • SSDEEP

    196608:suz6aSTHE0Yco0WRtaUeqPTstlWy+G3ZWHrf5H:qpHE0Bo0ktaEYlt3gHrf5

Score
10/10
amadeylummastealc9c9aa5stokdiscoveryevasionpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://sordid-snaked.cyou/api

https://awake-weaves.cyou/api

https://wrathful-jammy.cyou/api

https://debonairnukk.xyz/api

https://diffuculttan.xyz/api

https://effecterectz.xyz/api

https://deafeninggeh.biz/api

https://immureprech.biz/api

https://tacitglibbr.biz/api

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

lumma

C2

https://tacitglibbr.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 21 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 14 IoCs
    evasion
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 28 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 17 IoCs
  • Identifies Wine through registry keys 2 TTPs 14 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 5 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\4ec31f4077dd5c4c9ffb76cda98e3527df934080c5262dc0c6438ff70c379d22.exe
    "C:\Users\Admin\AppData\Local\Temp\4ec31f4077dd5c4c9ffb76cda98e3527df934080c5262dc0c6438ff70c379d22.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1224
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\G1R20.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\G1R20.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2780
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\V1J61.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\V1J61.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1356
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1n77l6.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1n77l6.exe
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4104
          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
            "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4940
            • C:\Users\Admin\AppData\Local\Temp\1016138001\613bf1a02d.exe
              "C:\Users\Admin\AppData\Local\Temp\1016138001\613bf1a02d.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2040
              • C:\Users\Admin\AppData\Local\Temp\OKZRWI31G6EQH74RW.exe
                "C:\Users\Admin\AppData\Local\Temp\OKZRWI31G6EQH74RW.exe"
                7⤵
                • Modifies Windows Defender Real-time Protection settings
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Windows security modification
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4004
              • C:\Users\Admin\AppData\Local\Temp\SH7EESW5JE77314UWHCL83.exe
                "C:\Users\Admin\AppData\Local\Temp\SH7EESW5JE77314UWHCL83.exe"
                7⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:1440
            • C:\Users\Admin\AppData\Local\Temp\1016139001\f8c7cf47cb.exe
              "C:\Users\Admin\AppData\Local\Temp\1016139001\f8c7cf47cb.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4168
            • C:\Users\Admin\AppData\Local\Temp\1016140001\85033985df.exe
              "C:\Users\Admin\AppData\Local\Temp\1016140001\85033985df.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:4700
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM firefox.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:5072
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM chrome.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4836
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM msedge.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1416
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM opera.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4244
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM brave.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3452
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:1016
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                  8⤵
                  • Checks processor information in registry
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of SetWindowsHookEx
                  PID:3668
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2076 -parentBuildID 20240401114208 -prefsHandle 2004 -prefMapHandle 1996 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f274f238-53dc-4139-92bc-cd55e59b657a} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" gpu
                    9⤵
                      PID:2224
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2508 -parentBuildID 20240401114208 -prefsHandle 2500 -prefMapHandle 2496 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e61e11a2-dece-4329-ab04-040ab254145f} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" socket
                      9⤵
                        PID:600
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3048 -childID 1 -isForBrowser -prefsHandle 3092 -prefMapHandle 3100 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a185f690-35e3-48e4-8be3-ec5c91269f1f} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" tab
                        9⤵
                          PID:2628
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3952 -childID 2 -isForBrowser -prefsHandle 3916 -prefMapHandle 3912 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e8e4c2e-3722-46a7-96b0-96b6183bd8cf} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" tab
                          9⤵
                            PID:3616
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4692 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4720 -prefMapHandle 4716 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e6f927d1-f337-4487-9b7b-1136fdc6000c} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" utility
                            9⤵
                            • Checks processor information in registry
                            PID:6104
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5580 -childID 3 -isForBrowser -prefsHandle 5576 -prefMapHandle 5572 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {774b8b81-6d14-41c1-820c-4ad67c377665} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" tab
                            9⤵
                              PID:2152
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5728 -childID 4 -isForBrowser -prefsHandle 5808 -prefMapHandle 5804 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5215ee6a-5cbc-477c-972f-caed759e8e91} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" tab
                              9⤵
                                PID:4560
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5896 -childID 5 -isForBrowser -prefsHandle 5940 -prefMapHandle 5948 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ae7019fb-2249-4153-91e9-173e3773e466} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" tab
                                9⤵
                                  PID:2912
                          • C:\Users\Admin\AppData\Local\Temp\1016141001\f7679648ae.exe
                            "C:\Users\Admin\AppData\Local\Temp\1016141001\f7679648ae.exe"
                            6⤵
                            • Modifies Windows Defender Real-time Protection settings
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Windows security modification
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5372
                      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2j0874.exe
                        C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2j0874.exe
                        4⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:3636
                        • C:\Users\Admin\AppData\Local\Temp\GGFQQXH0L3E2BVXY1MS6XHFG3H2CL0.exe
                          "C:\Users\Admin\AppData\Local\Temp\GGFQQXH0L3E2BVXY1MS6XHFG3H2CL0.exe"
                          5⤵
                          • Modifies Windows Defender Real-time Protection settings
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Windows security modification
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:972
                        • C:\Users\Admin\AppData\Local\Temp\IKMJ5HLFPCEMBRM7LYI.exe
                          "C:\Users\Admin\AppData\Local\Temp\IKMJ5HLFPCEMBRM7LYI.exe"
                          5⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4576
                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3C41r.exe
                      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3C41r.exe
                      3⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      PID:440
                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4p138X.exe
                    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4p138X.exe
                    2⤵
                    • Modifies Windows Defender Real-time Protection settings
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Windows security modification
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4056
                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                  C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                  1⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5940
                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                  C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                  1⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious behavior: EnumeratesProcesses
                  PID:6592

                Network

                MITRE ATT&CK Enterprise v15

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Privilege Escalation

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Defense Evasion

                Impair Defenses

                2
                T1562

                Disable or Modify Tools

                2
                T1562.001

                Modify Registry

                3
                T1112

                Virtualization/Sandbox Evasion

                2
                T1497

                Credential Access

                Credentials from Password Stores

                1
                T1555

                Credentials from Web Browsers

                1
                T1555.003

                Unsecured Credentials

                3
                T1552

                Credentials In Files

                3
                T1552.001

                Discovery

                Browser Information Discovery

                1
                T1217

                Query Registry

                7
                T1012

                System Information Discovery

                4
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                Virtualization/Sandbox Evasion

                2
                T1497

                Lateral Movement

                Collection

                Data from Local System

                3
                T1005

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\activity-stream.discovery_stream.json
                  Filesize

                  19KB

                  MD5

                  1f42e97cdcb919673301a535b8181048

                  SHA1

                  fe515bc12f092d1ddc2ec9316a8cfb8c5687f49d

                  SHA256

                  50326c4c5cb54fee05182cc5c891912463001053925715ad5b58bed4b7bc2a93

                  SHA512

                  a1a91486976d723c4ab676de7ee3bf71e9387bc3858e15c35db6aac2899d9873665c41475bc000f36b9c04ba5f567a053b61a715ab32641e93f9cc7fb586dfc7

                  Download Submit

                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
                  Filesize

                  13KB

                  MD5

                  a72561a315f4a6d988bf1586276ba7a0

                  SHA1

                  ebada379e448fbb06d92e7e63e940c02d5952ef2

                  SHA256

                  edcb1628a33de0e0f7b348acf65bfa8289bac1f428a487f54d6e6f09a263ba04

                  SHA512

                  98edfdcac63414ec77583510d84802df3e47269c40f37217bc44442ce0c8888b5f3b402e82ea712997096184ecb78a33d8bbea18f726eee701747d417e76cbcf

                  Download Submit

                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                  Filesize

                  15KB

                  MD5

                  96c542dec016d9ec1ecc4dddfcbaac66

                  SHA1

                  6199f7648bb744efa58acf7b96fee85d938389e4

                  SHA256

                  7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                  SHA512

                  cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\1016138001\613bf1a02d.exe
                  Filesize

                  1.8MB

                  MD5

                  9b88afc4511d0fe8aca6080d34f2dd66

                  SHA1

                  4d0abcc2f053e2b17d3064f65dffc171f873b043

                  SHA256

                  5d2b5f0d8b9fbfb231b99678bb332bee9cfef9aa6c2ed7e994dbabbb83639004

                  SHA512

                  f4e9c5bbbb27eb07c192226390833714b82b94cfa4a9fb6b0e0a75ece7b51eb009b9c2bdc3b70c2ee77a56b7496c1251c50888471cddf32a2f307eaf134b1490

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\1016139001\f8c7cf47cb.exe
                  Filesize

                  1.7MB

                  MD5

                  e33dc32f04e77bc26482baccb87b9795

                  SHA1

                  e4a57ead636bd006cecb7d9ec5e9aa36432e1372

                  SHA256

                  b2ecbacaf99db2c41066c1914b8b3116b5e25683e6552802a24b08d00d563431

                  SHA512

                  13d735438d20b0d352719c6e32584ed6abfaad6092ff9124393b3f1c6d6aa4314d0ce27c16cc654583973369572ec823423be9be04e34c50184976c0a35c96cf

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\1016140001\85033985df.exe
                  Filesize

                  943KB

                  MD5

                  7204bb7d150d6d2b21a5ffe9f3a9a017

                  SHA1

                  3af67e498f6204a88e767ec34ced2ce5fb731373

                  SHA256

                  70dd93e3cad56f80a899295aef97bec87d01b2d2aba82d67ae79e0bea93f813e

                  SHA512

                  de172c438010a05116cf23507fc68001fb120b45f715ad46ce16f7c48424d172e149e4e9d400b1446685548c456857169029a4e2f0aa9789d24239295d7bd50f

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\GGFQQXH0L3E2BVXY1MS6XHFG3H2CL0.exe
                  Filesize

                  2.6MB

                  MD5

                  f86c08a75747002a2a7cd3fbc5fe05c8

                  SHA1

                  7b9776338fe3a06350c16bc62e927f5ba6490723

                  SHA256

                  5b4d3426cd705909f38f2a136e2a5a1e593fd66a68c01b0e715f533d20a4218a

                  SHA512

                  2b8ab4cb0d7aba429f5835462a1c16dd4d0bc1a13c40c5ddf27a900295ca3c168dba79b8af97b26f80017755514e43f71120f1c309dece1fabd41d9147e63790

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4p138X.exe
                  Filesize

                  2.7MB

                  MD5

                  ead473718663d9f85a4d487f8343bf82

                  SHA1

                  aa74f6c6b613bd5c7ed244f37dfa5cede287b8ef

                  SHA256

                  d15e8974d60859d550b2a5c20ea3644b4ed82a38644ec509d469bfb86ea95b9c

                  SHA512

                  4fd45893b47a48256af55c1d8fc1966138e97205888b723049b88060b4463a7b49b5694d254c54af525b84266b000db07e9905b0f30c98726e98f439b793cf4a

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\G1R20.exe
                  Filesize

                  5.4MB

                  MD5

                  37eb17e15798a3efb25654198a5390fc

                  SHA1

                  0185779b9f52a068b10435ad91ebe554aa2bab71

                  SHA256

                  0c06e7f548d5d74b53475d30578c17e3942286e4a9552898d195167e62ec21bc

                  SHA512

                  8a8b03459ee06d896b5c6c17f4b4feef8d8c35a69265943e4b90fcc94e93c891ad94446f838f6a8d2501748e986f045066f0c95858f0ad94310eab4b2d982af6

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3C41r.exe
                  Filesize

                  1.7MB

                  MD5

                  e328245a28e6a2cdb14bde4d150a342e

                  SHA1

                  c768975f4fe3deed8d1cc677c8ada7395a394865

                  SHA256

                  03b0ee461554c9ecfcc906404caf95247f39959ad36fff125722870f27efa0b5

                  SHA512

                  4d6ad474e969cb85b29bc6319f6e84151d3267cc2ed28b22fb1b11d7e28597c98a1b2405eace53ca42cb1c5f77723fca3bf03bdaff243861593d00bf57e84ac0

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\V1J61.exe
                  Filesize

                  3.6MB

                  MD5

                  0ec8abf311997a5f2e07d534e4bde4ae

                  SHA1

                  edf408c947486ed688940da01822c2de013b7b55

                  SHA256

                  377a52f7a45f84d4b728842a60bcb44ea6e4dc0d0d7ec83878bc767725419649

                  SHA512

                  a25442d797a610687e2c827e2c15fe94655f1cf8444c228a306a237b26788c173d12829c3eb1063c7486cbb66d388cc9804d0f55537ca163c05d7283d3aaba86

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1n77l6.exe
                  Filesize

                  2.9MB

                  MD5

                  842e251ca1e3a812356248ebe8154f16

                  SHA1

                  efb511d328cf0a7690e62cbb89adeebc07dddb3c

                  SHA256

                  14caca276f869dcc33a065b67a826a79c27cb0ec54407da220ed26cd045d941a

                  SHA512

                  2eaf72c87cda80fcc64463eda29ad62e21818bac52105af0b95c5504c935e7f480cba518575fad8f80d0748e11e41641063cb8b6e61da8584271e1068d7f3b74

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2j0874.exe
                  Filesize

                  1.8MB

                  MD5

                  259eb5422d10fd32691e5d0b5585bc0e

                  SHA1

                  b33a091415aa6e55ad88a901664b56b538100fc1

                  SHA256

                  5010145ced6d55e94ff13d6758e18aa89e387737f3a91c38d0839cd134a54cc5

                  SHA512

                  498614069c409bee2d78f10a4bb489f27f3651dc8a657116c729aa2daa8c480de4e6e1454864dac7f13f407ec6dbb4759d5f6279cccff84006b52de5ab4e8dea

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                  Filesize

                  479KB

                  MD5

                  09372174e83dbbf696ee732fd2e875bb

                  SHA1

                  ba360186ba650a769f9303f48b7200fb5eaccee1

                  SHA256

                  c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                  SHA512

                  b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                  Filesize

                  13.8MB

                  MD5

                  0a8747a2ac9ac08ae9508f36c6d75692

                  SHA1

                  b287a96fd6cc12433adb42193dfe06111c38eaf0

                  SHA256

                  32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                  SHA512

                  59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin
                  Filesize

                  6KB

                  MD5

                  1b7236b170549629b7458c0da67bbd8d

                  SHA1

                  86c2a4e722cc7a966c8cfd77ba3c3f763bf077be

                  SHA256

                  bd7c0b7d8c69fe40cb11085ec670eadf1a01201d2d2e7a8fc0f9ba0d037366c9

                  SHA512

                  1420411a0cd9bab6e6dbacc91539f3e87f8e4cdf996d5b6fb9b1d78f0329cca9b1e84f9c645a4994339a1d3a33ee460d74e6ef71cbac0ddc0a689570ab23c20f

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin
                  Filesize

                  8KB

                  MD5

                  8c2a4ef72245bff35b19fc2317007b5f

                  SHA1

                  124e83e58fbc74f0951c07653a10f6426bb11b7f

                  SHA256

                  705cc8681367cc892d8576bfefcd154228679decc62ad4bde48305da3325d79e

                  SHA512

                  37101af918b726e449804e92f1187d26b0578ed7c6fe3bd4a9509e33c75e6cd390ce0897e5051e52c5f367bcdd35b8c47dfe745eb7a590cdb46371f6923b5512

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.bin
                  Filesize

                  23KB

                  MD5

                  8f8c8c06038ac97a8de2b79eab2640c4

                  SHA1

                  eff76150c252038bb0edf3dc490404196021c58b

                  SHA256

                  05d9a4b4472fa8d6baa28a618bbfa6deffd987488757b3fe58c468ee36ea9194

                  SHA512

                  e70e0baeace30bc14d42a250454cd2c565298ea79306ce15b0f3a18a6c4509c6aaf0c35966bb7b4bc21a0c8efadb1c760f5c4fc6b0fe5c99f71fa5ccdbec7145

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.bin
                  Filesize

                  6KB

                  MD5

                  fbd27ee65f27a076bfbca82fdd20fea5

                  SHA1

                  0eea5b7c1bdb7c43117c13694630f2b98ff226dc

                  SHA256

                  b49f4adbbbf85867fb666f7c4172cb97d23ec2a4289b2254c54aadb3464d2a14

                  SHA512

                  e8e8ba6208062183920f9d6b06e1333af16a5b88c90c6a740da46847c570ed6d8567af881d0c0fc2c489db1b17ec26eb374e26672948baae86651e9999ac5f76

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.bin
                  Filesize

                  15KB

                  MD5

                  1601a89b3ced09506782ccb8fcc34a34

                  SHA1

                  0a4afb664f4b42fa4770ae367b309aeb8f4ab9e3

                  SHA256

                  1289e714f8c5f4c08c6870f2abbed5eeb8f664eefd88a010ca12c43a3cf92a28

                  SHA512

                  d6e4dfd917ca3799876def605b8dcafb39fef13946be11a7a501620b009532dd1a39fb77f6cdfe0c7b03f712982bb60d2c8a26731cacb89d8d4b99f8fb22aa14

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp
                  Filesize

                  5KB

                  MD5

                  7bd1f608c265eb70a6a818675398edd2

                  SHA1

                  1b18c1d7a7664c1e51bfd6548fd527a864dcb696

                  SHA256

                  cb60b619aeb9a6d498f06e9eb993a0cfcac9ac0515bee242a76fd0ec47520976

                  SHA512

                  d351545689c9aa6bf2246520d5c7d5360329d3cc7c694724ccc00c640ab4e7225e91b8aa9df56ac6befc9ca3c0f3a0c01ca9f34a7a4e1b82b417b7e788173f03

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp
                  Filesize

                  6KB

                  MD5

                  46629dcf1cb6cd2d6d58209a2d723d6f

                  SHA1

                  86056b4ec29d2ab93d47a0f2a6d56d56d043e796

                  SHA256

                  9520b1961a7a133dd044da6110077cb35f31438badffe9bd26071f3449fc19b9

                  SHA512

                  3459b984b551fb58db6edde70eb43f72b54cbd2cf63da2174d07e1799d9110fa25fdf53b1f214da8da07481b9eb2ae5acfc163aa867ef7ac9a72a922a13fb894

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp
                  Filesize

                  15KB

                  MD5

                  29d1dc03ff42241eff3d710a83e3cf67

                  SHA1

                  695b00bb9449ef98d9b63fb0e6006484d737331e

                  SHA256

                  61136939e4cb1d1470911a725fbe941cd83ac9e4ca755598037038a6e2c07713

                  SHA512

                  83795773997a7362bd99e3e661a860d46c0dd7dfdf5b15596f2eb11f5d6a31a458fa01522a94b49cbfbd6c211a5b8da62ba96ef3b3989bc9d351134a1923d821

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\89535734-3d08-43f5-b7c7-d5f33347761c
                  Filesize

                  671B

                  MD5

                  4a25942286e0261059a1d54846b4a1e6

                  SHA1

                  df7de3d98b82e8cc5130ea5d55af36682df0ae3b

                  SHA256

                  7902c0ce30991cc7aabd967154be0566e57819800239b89adfaed3e6904ac701

                  SHA512

                  192118508917cdf6f6071126e41be9dc76acee830264cfbbb3ae624021de97d9d750771b4870387ccc1427a73e1a3e87cf7c1d55d79df7b089f8895c758153d7

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\b3e0143c-ebb5-46c7-a55f-db319bef118b
                  Filesize

                  26KB

                  MD5

                  4d790718f52fa244754f0f3ca5ebb3b7

                  SHA1

                  a2fb1adf7b3654488067d265d9426dcc94a04cb3

                  SHA256

                  414696be4207721892d3b150b2274fb433e40ec036e80ec57c6840fd61d71876

                  SHA512

                  83a1a4491f3555a9137dc823f144854a398f2ac2c2f4a47da3676f3405fdffc70e23304d47ba0ed830d8251bf287a1518cc64c7b81e77ec0203a9386352aba72

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\c78ca75d-fb33-4187-9377-964563efac72
                  Filesize

                  982B

                  MD5

                  af816921c628ce9911bf936a07fed261

                  SHA1

                  d1e7dfdaef8861b9d57bcb4786501748ccb994cd

                  SHA256

                  b2d92da66bc801bbce8f1225e74a74a718421522405e99f7e808ca362f250f70

                  SHA512

                  30a2076f6760f59b9864fd7aa53052819b0d4eafd2ab1f79c12d38defeebc4c6a4b2d24554da291b945aa448c4239b469cb6d814ee05c5745f06d240f847c383

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                  Filesize

                  1.1MB

                  MD5

                  842039753bf41fa5e11b3a1383061a87

                  SHA1

                  3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                  SHA256

                  d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                  SHA512

                  d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                  Filesize

                  116B

                  MD5

                  2a461e9eb87fd1955cea740a3444ee7a

                  SHA1

                  b10755914c713f5a4677494dbe8a686ed458c3c5

                  SHA256

                  4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                  SHA512

                  34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                  Filesize

                  372B

                  MD5

                  bf957ad58b55f64219ab3f793e374316

                  SHA1

                  a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                  SHA256

                  bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                  SHA512

                  79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                  Filesize

                  17.8MB

                  MD5

                  daf7ef3acccab478aaa7d6dc1c60f865

                  SHA1

                  f8246162b97ce4a945feced27b6ea114366ff2ad

                  SHA256

                  bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                  SHA512

                  5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs-1.js
                  Filesize

                  12KB

                  MD5

                  c82cf0560fc227756f8b95709515cc3b

                  SHA1

                  a8d7dc7e10ab485b6c37509dbdcc55bebce82028

                  SHA256

                  17942284f13f3de1dca0adc4eef3a544fd3c9f2b45236a5b8c9132a3df734a00

                  SHA512

                  63c3f231de4536456f8fcfb23458ba188ae18ef74d6cca6109d7b591bfe15d158c5d3a7d2f9680abb1d7cbddbffa47222750b093a3c39ad40f9eccc26bf482f2

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs-1.js
                  Filesize

                  15KB

                  MD5

                  d5245cace283f17ee8258a423528456e

                  SHA1

                  b2d1113d28cbc88fb6e285ba20b7396d094813e5

                  SHA256

                  0901bdb3807faba61f05894800e341d20b0539090f2c256538ac7db4c064fbcf

                  SHA512

                  63ddb1a849353f040928913bf3dad04d41fc9edb64213c34bf1e0095cfe80afd9e919b8424862b6e3379299ff7e7837903a9713b561967a438e1ff360adf0b65

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs-1.js
                  Filesize

                  10KB

                  MD5

                  96214eb34e5c599e8ff7ad5503dbd2d7

                  SHA1

                  02f0a817c86631f0b6be3afc1f3b3ffef0a02830

                  SHA256

                  f1d5b72464a4b28f28109f4da646c9451a75668cb2213e91415e9af637bb5eb7

                  SHA512

                  556fd19503d24f76fab4898fc7332172fac063187c3322016e29dd13a00e9b0055a766d6bd31e5e110cac4715cb97cef1a88120effd7ae7503a1a2ccedb38e8b

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs.js
                  Filesize

                  11KB

                  MD5

                  4886c81031c7c2c9966b8e040ef80b18

                  SHA1

                  c8b334d4a59afe733ecf988b0e11b021a629117a

                  SHA256

                  c78bec0f2a66ded2c5aa1aa945e209ccfaa6b3f922680980ff7efda9167f2a34

                  SHA512

                  c8428a2c9602c4c6f1f0d1253502a213e7e731bc76870d4d14fda66a1bb0fc133d6381d1b7147afda69db6eed8beb392968e5252b0b88ce9dc0dd38795fbf0f4

                  Download Submit

                • memory/440-802-0x00000000002C0000-0x0000000000960000-memory.dmp

                  Filesize

                  6.6MB

                  Download

                • memory/440-113-0x00000000002C0000-0x0000000000960000-memory.dmp

                  Filesize

                  6.6MB

                  Download

                • memory/972-131-0x0000000000FE0000-0x0000000001290000-memory.dmp

                  Filesize

                  2.7MB

                  Download

                • memory/972-73-0x0000000000FE0000-0x0000000001290000-memory.dmp

                  Filesize

                  2.7MB

                  Download

                • memory/972-71-0x0000000000FE0000-0x0000000001290000-memory.dmp

                  Filesize

                  2.7MB

                  Download

                • memory/972-786-0x0000000000FE0000-0x0000000001290000-memory.dmp

                  Filesize

                  2.7MB

                  Download

                • memory/972-61-0x0000000000FE0000-0x0000000001290000-memory.dmp

                  Filesize

                  2.7MB

                  Download

                • memory/1440-129-0x0000000000010000-0x00000000006A5000-memory.dmp

                  Filesize

                  6.6MB

                  Download

                • memory/1440-132-0x0000000000010000-0x00000000006A5000-memory.dmp

                  Filesize

                  6.6MB

                  Download

                • memory/2040-55-0x0000000000C60000-0x000000000110C000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/2040-128-0x0000000000C60000-0x000000000110C000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/2040-121-0x0000000000C60000-0x000000000110C000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/3636-82-0x0000000000840000-0x0000000000CE3000-memory.dmp

                  Filesize

                  4.6MB

                  Download

                • memory/3636-99-0x0000000000840000-0x0000000000CE3000-memory.dmp

                  Filesize

                  4.6MB

                  Download

                • memory/3636-39-0x0000000000840000-0x0000000000CE3000-memory.dmp

                  Filesize

                  4.6MB

                  Download

                • memory/3636-78-0x0000000000840000-0x0000000000CE3000-memory.dmp

                  Filesize

                  4.6MB

                  Download

                • memory/4004-118-0x0000000000460000-0x0000000000710000-memory.dmp

                  Filesize

                  2.7MB

                  Download

                • memory/4004-855-0x0000000000460000-0x0000000000710000-memory.dmp

                  Filesize

                  2.7MB

                  Download

                • memory/4004-122-0x0000000000460000-0x0000000000710000-memory.dmp

                  Filesize

                  2.7MB

                  Download

                • memory/4004-123-0x0000000000460000-0x0000000000710000-memory.dmp

                  Filesize

                  2.7MB

                  Download

                • memory/4004-865-0x0000000000460000-0x0000000000710000-memory.dmp

                  Filesize

                  2.7MB

                  Download

                • memory/4056-902-0x00000000009C0000-0x0000000000C82000-memory.dmp

                  Filesize

                  2.8MB

                  Download

                • memory/4056-807-0x00000000009C0000-0x0000000000C82000-memory.dmp

                  Filesize

                  2.8MB

                  Download

                • memory/4056-847-0x00000000009C0000-0x0000000000C82000-memory.dmp

                  Filesize

                  2.8MB

                  Download

                • memory/4056-899-0x00000000009C0000-0x0000000000C82000-memory.dmp

                  Filesize

                  2.8MB

                  Download

                • memory/4056-848-0x00000000009C0000-0x0000000000C82000-memory.dmp

                  Filesize

                  2.8MB

                  Download

                • memory/4104-20-0x0000000000100000-0x000000000041B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/4104-34-0x0000000000100000-0x000000000041B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/4168-84-0x0000000000850000-0x0000000000EE5000-memory.dmp

                  Filesize

                  6.6MB

                  Download

                • memory/4168-80-0x0000000000850000-0x0000000000EE5000-memory.dmp

                  Filesize

                  6.6MB

                  Download

                • memory/4576-120-0x0000000000FB0000-0x0000000001645000-memory.dmp

                  Filesize

                  6.6MB

                  Download

                • memory/4576-97-0x0000000000FB0000-0x0000000001645000-memory.dmp

                  Filesize

                  6.6MB

                  Download

                • memory/4940-3361-0x00000000003F0000-0x000000000070B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/4940-3488-0x00000000003F0000-0x000000000070B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/4940-805-0x00000000003F0000-0x000000000070B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/4940-60-0x00000000003F0000-0x000000000070B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/4940-3502-0x00000000003F0000-0x000000000070B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/4940-1021-0x00000000003F0000-0x000000000070B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/4940-3496-0x00000000003F0000-0x000000000070B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/4940-898-0x00000000003F0000-0x000000000070B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/4940-3495-0x00000000003F0000-0x000000000070B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/4940-35-0x00000000003F0000-0x000000000070B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/4940-3492-0x00000000003F0000-0x000000000070B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/4940-2185-0x00000000003F0000-0x000000000070B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/4940-3491-0x00000000003F0000-0x000000000070B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/4940-3490-0x00000000003F0000-0x000000000070B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/4940-81-0x00000000003F0000-0x000000000070B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/4940-3482-0x00000000003F0000-0x000000000070B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/5372-889-0x0000000000210000-0x00000000004C0000-memory.dmp

                  Filesize

                  2.7MB

                  Download

                • memory/5372-891-0x0000000000210000-0x00000000004C0000-memory.dmp

                  Filesize

                  2.7MB

                  Download

                • memory/5372-890-0x0000000000210000-0x00000000004C0000-memory.dmp

                  Filesize

                  2.7MB

                  Download

                • memory/5372-904-0x0000000000210000-0x00000000004C0000-memory.dmp

                  Filesize

                  2.7MB

                  Download

                • memory/5372-907-0x0000000000210000-0x00000000004C0000-memory.dmp

                  Filesize

                  2.7MB

                  Download

                • memory/5940-2925-0x00000000003F0000-0x000000000070B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/5940-2883-0x00000000003F0000-0x000000000070B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/6592-3494-0x00000000003F0000-0x000000000070B000-memory.dmp

                  Filesize

                  3.1MB

                  Download