Overview

overview

10

Static

static

3

4ec31f4077...22.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-12-2024 14:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4ec31f4077dd5c4c9ffb76cda98e3527df934080c5262dc0c6438ff70c379d22.exe

  • Size

    7.0MB

  • MD5

    03b53b8340e4d290aefbfa57f23357a3

  • SHA1

    3b0fae3655b40e474f97da515fc629e060b8d6d3

  • SHA256

    4ec31f4077dd5c4c9ffb76cda98e3527df934080c5262dc0c6438ff70c379d22

  • SHA512

    390655ce74e5174a7e5c7d1e7b417300d000b15312a6c88ad9652298b74ccc949aa68b551756638c17f3f82fa409fb1bf2b18fdc72e19c6dfe0ff6327f01d778

  • SSDEEP

    196608:suz6aSTHE0Yco0WRtaUeqPTstlWy+G3ZWHrf5H:qpHE0Bo0ktaEYlt3gHrf5

Score
10/10
amadeycryptbotdcratlummastealcxmrig9c9aa5stokdiscoveryevasionexecutioninfostealerminerpersistenceratspywarestealertrojanupx

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://sordid-snaked.cyou/api

https://awake-weaves.cyou/api

https://wrathful-jammy.cyou/api

https://debonairnukk.xyz/api

https://diffuculttan.xyz/api

https://effecterectz.xyz/api

https://deafeninggeh.biz/api

https://immureprech.biz/api

https://tacitglibbr.biz/api

https://shineugler.biz/api

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://drive-connect.cyou/api

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

cryptbot

Extracted

Family

lumma

C2

https://tacitglibbr.biz/api

https://shineugler.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Cryptbot family
    cryptbot
  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 21 IoCs
    evasiontrojan
  • Process spawned unexpected child process 6 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Xmrig family
    xmrig
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 18 IoCs
    evasion
  • XMRig Miner payload 10 IoCs
    miner
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 36 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 41 IoCs
  • Identifies Wine through registry keys 2 TTPs 18 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 5 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 7 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 3 IoCs
  • Runs ping.exe 1 TTPs 4 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 52 IoCs
  • Suspicious use of FindShellTrayWindow 32 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\4ec31f4077dd5c4c9ffb76cda98e3527df934080c5262dc0c6438ff70c379d22.exe
    "C:\Users\Admin\AppData\Local\Temp\4ec31f4077dd5c4c9ffb76cda98e3527df934080c5262dc0c6438ff70c379d22.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4944
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\G1R20.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\G1R20.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4224
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\V1J61.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\V1J61.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2476
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1n77l6.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1n77l6.exe
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4392
          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
            "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3216
            • C:\Users\Admin\AppData\Local\Temp\1016072001\muNJF0r.exe
              "C:\Users\Admin\AppData\Local\Temp\1016072001\muNJF0r.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:2400
              • C:\Windows\SysWOW64\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Bridgecontainerserver\VBxKsR3W5qREBSxxvIt5VpzoFdFFANtbsRk6NDfKSHeOxN7UsJds5Ck.vbe"
                7⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4476
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Bridgecontainerserver\SlMo.bat" "
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3108
                  • C:\Bridgecontainerserver\BrokerhostNet.exe
                    "C:\Bridgecontainerserver/BrokerhostNet.exe"
                    9⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:3292
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\winlogon.exe'
                      10⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2736
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Bridgecontainerserver\BrokerhostNet.exe'
                      10⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious use of AdjustPrivilegeToken
                      PID:312
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\91qc6ZPONm.bat"
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4756
                      • C:\Windows\system32\chcp.com
                        chcp 65001
                        11⤵
                          PID:1528
                        • C:\Windows\system32\PING.EXE
                          ping -n 10 localhost
                          11⤵
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Runs ping.exe
                          PID:2676
                        • C:\Bridgecontainerserver\BrokerhostNet.exe
                          "C:\Bridgecontainerserver\BrokerhostNet.exe"
                          11⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2900
              • C:\Users\Admin\AppData\Local\Temp\1016133001\3c10c6e636.exe
                "C:\Users\Admin\AppData\Local\Temp\1016133001\3c10c6e636.exe"
                6⤵
                • Enumerates VirtualBox registry keys
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:4260
              • C:\Users\Admin\AppData\Local\Temp\1016135001\ba381a2e79.exe
                "C:\Users\Admin\AppData\Local\Temp\1016135001\ba381a2e79.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Checks SCSI registry key(s)
                PID:4640
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 584
                  7⤵
                  • Program crash
                  PID:2108
              • C:\Users\Admin\AppData\Local\Temp\1016136001\cf5faccf43.exe
                "C:\Users\Admin\AppData\Local\Temp\1016136001\cf5faccf43.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:964
              • C:\Users\Admin\AppData\Local\Temp\1016137001\0f3fb50ca5.exe
                "C:\Users\Admin\AppData\Local\Temp\1016137001\0f3fb50ca5.exe"
                6⤵
                • Enumerates VirtualBox registry keys
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:1516
              • C:\Users\Admin\AppData\Local\Temp\1016138001\8fd77af9ff.exe
                "C:\Users\Admin\AppData\Local\Temp\1016138001\8fd77af9ff.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:2580
                • C:\Users\Admin\AppData\Local\Temp\W8TCC3U8IRKDMJK4UAE9T3.exe
                  "C:\Users\Admin\AppData\Local\Temp\W8TCC3U8IRKDMJK4UAE9T3.exe"
                  7⤵
                  • Modifies Windows Defender Real-time Protection settings
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Windows security modification
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1900
                • C:\Users\Admin\AppData\Local\Temp\LHTUFK36HC0M5PGI4BS.exe
                  "C:\Users\Admin\AppData\Local\Temp\LHTUFK36HC0M5PGI4BS.exe"
                  7⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  PID:6904
              • C:\Users\Admin\AppData\Local\Temp\1016139001\9a11f0964d.exe
                "C:\Users\Admin\AppData\Local\Temp\1016139001\9a11f0964d.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                PID:1020
              • C:\Users\Admin\AppData\Local\Temp\1016140001\3fe4d710fe.exe
                "C:\Users\Admin\AppData\Local\Temp\1016140001\3fe4d710fe.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:3912
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM firefox.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:776
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM chrome.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4156
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM msedge.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3672
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM opera.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3108
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM brave.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1548
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                  7⤵
                    PID:4376
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                      8⤵
                      • Checks processor information in registry
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      • Suspicious use of SetWindowsHookEx
                      PID:3320
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2040 -parentBuildID 20240401114208 -prefsHandle 1968 -prefMapHandle 1960 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ae59aab2-8fd1-4e42-a2ab-bde2074b782f} 3320 "\\.\pipe\gecko-crash-server-pipe.3320" gpu
                        9⤵
                          PID:2180
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2476 -parentBuildID 20240401114208 -prefsHandle 2468 -prefMapHandle 2464 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {005b02ee-1a47-409b-b328-636131a7cf3e} 3320 "\\.\pipe\gecko-crash-server-pipe.3320" socket
                          9⤵
                            PID:4904
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1076 -childID 1 -isForBrowser -prefsHandle 2900 -prefMapHandle 1632 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {012ceb1c-c565-4498-aea4-dd893645a0ba} 3320 "\\.\pipe\gecko-crash-server-pipe.3320" tab
                            9⤵
                              PID:4784
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3732 -childID 2 -isForBrowser -prefsHandle 3724 -prefMapHandle 3720 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d66bdeb5-8012-423b-aa6b-288831e78283} 3320 "\\.\pipe\gecko-crash-server-pipe.3320" tab
                              9⤵
                                PID:4064
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4592 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4632 -prefMapHandle 4628 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {29bc0f0e-0506-48cf-b8e9-0495060c1771} 3320 "\\.\pipe\gecko-crash-server-pipe.3320" utility
                                9⤵
                                • Checks processor information in registry
                                PID:6044
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5388 -childID 3 -isForBrowser -prefsHandle 5360 -prefMapHandle 5364 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {86e538ab-511b-4850-8298-b3d32ecb0fa5} 3320 "\\.\pipe\gecko-crash-server-pipe.3320" tab
                                9⤵
                                  PID:4872
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4832 -childID 4 -isForBrowser -prefsHandle 5500 -prefMapHandle 5496 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b485dfa-f0aa-4fb8-9e18-d144f43c0f8d} 3320 "\\.\pipe\gecko-crash-server-pipe.3320" tab
                                  9⤵
                                    PID:396
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5632 -childID 5 -isForBrowser -prefsHandle 5648 -prefMapHandle 5328 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c426d791-749b-4a17-a60f-af1ceb9eb6f9} 3320 "\\.\pipe\gecko-crash-server-pipe.3320" tab
                                    9⤵
                                      PID:5128
                              • C:\Users\Admin\AppData\Local\Temp\1016141001\0efa223f21.exe
                                "C:\Users\Admin\AppData\Local\Temp\1016141001\0efa223f21.exe"
                                6⤵
                                • Modifies Windows Defender Real-time Protection settings
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Windows security modification
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of AdjustPrivilegeToken
                                PID:5652
                              • C:\Users\Admin\AppData\Local\Temp\1016143001\401dc1fd02.exe
                                "C:\Users\Admin\AppData\Local\Temp\1016143001\401dc1fd02.exe"
                                6⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:6556
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
                                  7⤵
                                    PID:6744
                                    • C:\Windows\system32\mode.com
                                      mode 65,10
                                      8⤵
                                        PID:6852
                                      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                        7z.exe e file.zip -p24291711423417250691697322505 -oextracted
                                        8⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1772
                                      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                        7z.exe e extracted/file_7.zip -oextracted
                                        8⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3532
                                      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                        7z.exe e extracted/file_6.zip -oextracted
                                        8⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2028
                                      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                        7z.exe e extracted/file_5.zip -oextracted
                                        8⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3144
                                      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                        7z.exe e extracted/file_4.zip -oextracted
                                        8⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2156
                                      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                        7z.exe e extracted/file_3.zip -oextracted
                                        8⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:6948
                                      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                        7z.exe e extracted/file_2.zip -oextracted
                                        8⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:7024
                                      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                        7z.exe e extracted/file_1.zip -oextracted
                                        8⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:6896
                                      • C:\Windows\system32\attrib.exe
                                        attrib +H "in.exe"
                                        8⤵
                                        • Views/modifies file attributes
                                        PID:6084
                                      • C:\Users\Admin\AppData\Local\Temp\main\in.exe
                                        "in.exe"
                                        8⤵
                                        • Executes dropped EXE
                                        PID:6664
                                        • C:\Windows\SYSTEM32\attrib.exe
                                          attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                          9⤵
                                          • Views/modifies file attributes
                                          PID:2108
                                        • C:\Windows\SYSTEM32\attrib.exe
                                          attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                          9⤵
                                          • Views/modifies file attributes
                                          PID:2400
                                        • C:\Windows\SYSTEM32\schtasks.exe
                                          schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
                                          9⤵
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2592
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          powershell ping 127.0.0.1; del in.exe
                                          9⤵
                                          • System Network Configuration Discovery: Internet Connection Discovery
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4868
                                          • C:\Windows\system32\PING.EXE
                                            "C:\Windows\system32\PING.EXE" 127.0.0.1
                                            10⤵
                                            • System Network Configuration Discovery: Internet Connection Discovery
                                            • Runs ping.exe
                                            PID:5416
                                  • C:\Users\Admin\AppData\Local\Temp\1016144001\3922422579.exe
                                    "C:\Users\Admin\AppData\Local\Temp\1016144001\3922422579.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    • System Location Discovery: System Language Discovery
                                    PID:5172
                                    • C:\Users\Admin\AppData\Local\Temp\1016144001\3922422579.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1016144001\3922422579.exe"
                                      7⤵
                                      • Executes dropped EXE
                                      PID:5296
                                    • C:\Users\Admin\AppData\Local\Temp\1016144001\3922422579.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1016144001\3922422579.exe"
                                      7⤵
                                      • Executes dropped EXE
                                      PID:5280
                                    • C:\Users\Admin\AppData\Local\Temp\1016144001\3922422579.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1016144001\3922422579.exe"
                                      7⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      PID:5304
                              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2j0874.exe
                                C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2j0874.exe
                                4⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:1064
                                • C:\Users\Admin\AppData\Local\Temp\ZFXNZ79PF717GPLC.exe
                                  "C:\Users\Admin\AppData\Local\Temp\ZFXNZ79PF717GPLC.exe"
                                  5⤵
                                  • Modifies Windows Defender Real-time Protection settings
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Windows security modification
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3624
                                • C:\Users\Admin\AppData\Local\Temp\EGIK0UNA19O6OCBJ35QY1CAM9PR.exe
                                  "C:\Users\Admin\AppData\Local\Temp\EGIK0UNA19O6OCBJ35QY1CAM9PR.exe"
                                  5⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:3780
                            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3C41r.exe
                              C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3C41r.exe
                              3⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3168
                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4p138X.exe
                            C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4p138X.exe
                            2⤵
                            • Modifies Windows Defender Real-time Protection settings
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Windows security modification
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3496
                        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          1⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4448
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4640 -ip 4640
                          1⤵
                            PID:4248
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\AppData\Local\Temp\winlogon.exe'" /f
                            1⤵
                            • Process spawned unexpected child process
                            • Scheduled Task/Job: Scheduled Task
                            PID:2688
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\winlogon.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Scheduled Task/Job: Scheduled Task
                            PID:2832
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Local\Temp\winlogon.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Scheduled Task/Job: Scheduled Task
                            PID:4008
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "BrokerhostNetB" /sc MINUTE /mo 8 /tr "'C:\Bridgecontainerserver\BrokerhostNet.exe'" /f
                            1⤵
                            • Process spawned unexpected child process
                            • Scheduled Task/Job: Scheduled Task
                            PID:1964
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "BrokerhostNet" /sc ONLOGON /tr "'C:\Bridgecontainerserver\BrokerhostNet.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Scheduled Task/Job: Scheduled Task
                            PID:2560
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "BrokerhostNetB" /sc MINUTE /mo 8 /tr "'C:\Bridgecontainerserver\BrokerhostNet.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Scheduled Task/Job: Scheduled Task
                            PID:5084
                          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                            C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                            1⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            PID:5572
                          • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                            C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                            1⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            PID:6076
                            • C:\Windows\explorer.exe
                              explorer.exe
                              2⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:6040
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
                              2⤵
                              • System Network Configuration Discovery: Internet Connection Discovery
                              • Suspicious use of AdjustPrivilegeToken
                              PID:6240
                              • C:\Windows\system32\PING.EXE
                                "C:\Windows\system32\PING.EXE" 127.1.10.1
                                3⤵
                                • System Network Configuration Discovery: Internet Connection Discovery
                                • Runs ping.exe
                                PID:1536
                          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                            C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                            1⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            PID:6168
                          • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                            C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                            1⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            PID:6916
                            • C:\Windows\explorer.exe
                              explorer.exe
                              2⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1380
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
                              2⤵
                              • System Network Configuration Discovery: Internet Connection Discovery
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2760
                              • C:\Windows\system32\PING.EXE
                                "C:\Windows\system32\PING.EXE" 127.1.10.1
                                3⤵
                                • System Network Configuration Discovery: Internet Connection Discovery
                                • Runs ping.exe
                                PID:5356

                          Network

                          MITRE ATT&CK Enterprise v15

                          Reconnaissance

                          Resource Development

                          Initial Access

                          Execution

                          Command and Scripting Interpreter

                          1
                          T1059

                          PowerShell

                          1
                          T1059.001

                          Scheduled Task/Job

                          1
                          T1053

                          Scheduled Task

                          1
                          T1053.005

                          Persistence

                          Boot or Logon Autostart Execution

                          1
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Create or Modify System Process

                          1
                          T1543

                          Windows Service

                          1
                          T1543.003

                          Scheduled Task/Job

                          1
                          T1053

                          Scheduled Task

                          1
                          T1053.005

                          Privilege Escalation

                          Boot or Logon Autostart Execution

                          1
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Create or Modify System Process

                          1
                          T1543

                          Windows Service

                          1
                          T1543.003

                          Scheduled Task/Job

                          1
                          T1053

                          Scheduled Task

                          1
                          T1053.005

                          Defense Evasion

                          Hide Artifacts

                          1
                          T1564

                          Hidden Files and Directories

                          1
                          T1564.001

                          Impair Defenses

                          2
                          T1562

                          Disable or Modify Tools

                          2
                          T1562.001

                          Modify Registry

                          3
                          T1112

                          Virtualization/Sandbox Evasion

                          3
                          T1497

                          Credential Access

                          Credentials from Password Stores

                          1
                          T1555

                          Credentials from Web Browsers

                          1
                          T1555.003

                          Unsecured Credentials

                          3
                          T1552

                          Credentials In Files

                          3
                          T1552.001

                          Discovery

                          Browser Information Discovery

                          1
                          T1217

                          Peripheral Device Discovery

                          1
                          T1120

                          Query Registry

                          9
                          T1012

                          Remote System Discovery

                          1
                          T1018

                          System Information Discovery

                          5
                          T1082

                          System Location Discovery

                          1
                          T1614

                          System Language Discovery

                          1
                          T1614.001

                          System Network Configuration Discovery

                          1
                          T1016

                          Internet Connection Discovery

                          1
                          T1016.001

                          Virtualization/Sandbox Evasion

                          3
                          T1497

                          Lateral Movement

                          Collection

                          Data from Local System

                          3
                          T1005

                          Command and Control

                          Exfiltration

                          Impact

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Bridgecontainerserver\BrokerhostNet.exe
                            Filesize

                            1.9MB

                            MD5

                            0f91548ca49c64d6a8cd3846854f484c

                            SHA1

                            033c309b683020221ae189c4236a70c0d3ddd568

                            SHA256

                            a7883947a5f3c0d74f3eac6c2a6da45555298d769f5e3137e10a3ece14e83dfd

                            SHA512

                            e207b5545ceed034ec22f13e1a36f13656721b2c9cab97f6ec7ba8195f32ddc1673e1334902b2d4fc0ce393baf7f806bedf4a03a26a8ffe79ad17a87cf9a90a2

                            Download Submit

                          • C:\Bridgecontainerserver\SlMo.bat
                            Filesize

                            89B

                            MD5

                            20c75fef4553c17d36635750cfb57049

                            SHA1

                            8489a5998acaa63326bc1a665c38eb71c5d1f426

                            SHA256

                            0dcef4794868f563d515bbeee69e35dde750411ee9dcaafdef597806c89cabd0

                            SHA512

                            2819f6585bd3ee7e9f1703c259b97b21dbacde276186a489acfea0c36f377f751845b50ed00a70e029e95f588193cf69f77aeaf2785e67888378b9f2e95ee92a

                            Download Submit

                          • C:\Bridgecontainerserver\VBxKsR3W5qREBSxxvIt5VpzoFdFFANtbsRk6NDfKSHeOxN7UsJds5Ck.vbe
                            Filesize

                            204B

                            MD5

                            e52eec5fe59f0e73555c7d43c0035f62

                            SHA1

                            e6fcc87b7d260c2fcfff89e28e7d45357357520e

                            SHA256

                            b5712ce1aa870e16ed1464f1ecd627aed7020bb48c61252471cf9ec0b2d38d7f

                            SHA512

                            325c467e6519fb72238c62abbb7b89d32016a71416d41f148a38e41853928fc9cc84ed6b096784af9b1ad23c3363316d6b4f3464959127dfee1794cc926d40a7

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\BrokerhostNet.exe.log
                            Filesize

                            1KB

                            MD5

                            af6acd95d59de87c04642509c30e81c1

                            SHA1

                            f9549ae93fdb0a5861a79a08f60aa81c4b32377b

                            SHA256

                            7521ee2d065a78efcab55a194fbd78492f84b70595f139263875f4ea92b194d6

                            SHA512

                            93ab99bcf588fde553de3240e0d2b0cbd4e4bc5ef5e99d53f45a267d7ff30103a80b5a7aa1c52d6eff1e070af0ec82d2c0b8aafb7099742aa16810edc1815c3a

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                            Filesize

                            2KB

                            MD5

                            d85ba6ff808d9e5444a4b369f5bc2730

                            SHA1

                            31aa9d96590fff6981b315e0b391b575e4c0804a

                            SHA256

                            84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                            SHA512

                            8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            Filesize

                            944B

                            MD5

                            6d42b6da621e8df5674e26b799c8e2aa

                            SHA1

                            ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

                            SHA256

                            5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

                            SHA512

                            53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\activity-stream.discovery_stream.json.tmp
                            Filesize

                            19KB

                            MD5

                            7a561f9bc02e514f4c9b6f8098c35984

                            SHA1

                            a00e8b0339b3357e85528c2d60aa56bb7fd9eab2

                            SHA256

                            4a009605e31cef5cada62ab305abe9e6a9510d8d28b8406520d4b25e0719e9e2

                            SHA512

                            111e0ae9f0ab275280d67a0bc9487addb0c7ad66993073bc23cb4f7db2b73d17b7fd0307b6bb5e590c51eb61ec59a4e376a32b6660c01f36701caf683265cdb7

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
                            Filesize

                            13KB

                            MD5

                            9194f71113a0c21efd06518fd5c14ce8

                            SHA1

                            9b7e82af9a4fb6092215c354b65dafe56a786cd1

                            SHA256

                            d07da864840129c59b28d5eeb13f0ec00c83f25ba7a290ce69744cdf90147cf3

                            SHA512

                            2c222562fcecdf2e51232b0bc2b726ef9d70db0e15d356c52eb878c6f017ac7185e9c64ee3eeeb586ddb314b08d709dde5a4fed1250e287a853e130bc89bfc78

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                            Filesize

                            15KB

                            MD5

                            96c542dec016d9ec1ecc4dddfcbaac66

                            SHA1

                            6199f7648bb744efa58acf7b96fee85d938389e4

                            SHA256

                            7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                            SHA512

                            cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1016072001\muNJF0r.exe
                            Filesize

                            2.2MB

                            MD5

                            b5a1474fcb8f7b9809d52546bd304af3

                            SHA1

                            8604fe586fa0d03adaa6608169a62c65c837de7d

                            SHA256

                            dc83dbd12c5a432a6c168982e55d6c7be89dd0bc4b915e3e93e3a97c8af0ab0d

                            SHA512

                            39931300c863c521957dd5d842c0c6e0d66d2b43663136375e21feb26181bd1c9d4494025e0e7a00b80b51405d1e67bfe825787e60c1b99998463b4e3a49a7ee

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1016133001\3c10c6e636.exe
                            Filesize

                            4.2MB

                            MD5

                            fef2f997dcd3ef91d2b2e41b6db77467

                            SHA1

                            c262e269030aa5bebd10843bc17348003e304599

                            SHA256

                            e3dacf687e1075ab0d4604b8ff6d927ca89262bd32d21070513b71a3fc325c20

                            SHA512

                            0fd27bd187cc2c1d6defdcefedabfa2929274354eecb2ecf694d764626d4bc3fe28cc7c567cfa1975f251320b1d31daae8977f9ea75368ed38e56172ad6b5a42

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1016135001\ba381a2e79.exe
                            Filesize

                            418KB

                            MD5

                            78550f31347263e7e577f6996e33bffa

                            SHA1

                            28b31ae0eeb6d6e7386cd01b11a3881614ce23c3

                            SHA256

                            60fbe8cb9c1985f16403d83b1874a7b01a1341b1d835225ec0d66d3ef769e134

                            SHA512

                            1dad1e4df168d05e6ea478f333edac08ad8a7a6d5d386c8c0eefef5b107bb432f3d87801a20ee98ec6849ee680ba0296bf9bb45628c4af989a7d478907a7b471

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1016136001\cf5faccf43.exe
                            Filesize

                            1.7MB

                            MD5

                            6c1d0dabe1ec5e928f27b3223f25c26b

                            SHA1

                            e25ab704a6e9b3e4c30a6c1f7043598a13856ad9

                            SHA256

                            92228a0012605351cf08df9a2ad4b93fa552d7a75991f81fb80f1ae854a0e57d

                            SHA512

                            3a3f7af4f6018fcbd8c6f2871270504731cf269134453c9a146351c3e4a5c89165ecccafb3655d8b39c1ff1ec68f06e1851c0abd66d47602e1f0f8e36d4acfe9

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1016137001\0f3fb50ca5.exe
                            Filesize

                            4.3MB

                            MD5

                            64cfdc9caeaefbc21aeb85e1a82b3153

                            SHA1

                            ed719eaddd2875b2d590d0c14d036b42c8601cbc

                            SHA256

                            095372c51df528243c88389b2d833560eb4621cf213d8c6a0190d39e0ec0f24a

                            SHA512

                            cca4c8857c59ef279695caaf7b6065af95977f624dafdf5a71000cf9dcee3b24b39b417b3ed8faa67b161d88f195f37655222f51926b64e16db7b9f46a71f4bd

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1016138001\8fd77af9ff.exe
                            Filesize

                            1.8MB

                            MD5

                            9b88afc4511d0fe8aca6080d34f2dd66

                            SHA1

                            4d0abcc2f053e2b17d3064f65dffc171f873b043

                            SHA256

                            5d2b5f0d8b9fbfb231b99678bb332bee9cfef9aa6c2ed7e994dbabbb83639004

                            SHA512

                            f4e9c5bbbb27eb07c192226390833714b82b94cfa4a9fb6b0e0a75ece7b51eb009b9c2bdc3b70c2ee77a56b7496c1251c50888471cddf32a2f307eaf134b1490

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1016140001\3fe4d710fe.exe
                            Filesize

                            943KB

                            MD5

                            7204bb7d150d6d2b21a5ffe9f3a9a017

                            SHA1

                            3af67e498f6204a88e767ec34ced2ce5fb731373

                            SHA256

                            70dd93e3cad56f80a899295aef97bec87d01b2d2aba82d67ae79e0bea93f813e

                            SHA512

                            de172c438010a05116cf23507fc68001fb120b45f715ad46ce16f7c48424d172e149e4e9d400b1446685548c456857169029a4e2f0aa9789d24239295d7bd50f

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1016143001\401dc1fd02.exe
                            Filesize

                            4.2MB

                            MD5

                            3a425626cbd40345f5b8dddd6b2b9efa

                            SHA1

                            7b50e108e293e54c15dce816552356f424eea97a

                            SHA256

                            ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

                            SHA512

                            a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1016144001\3922422579.exe
                            Filesize

                            710KB

                            MD5

                            28e568616a7b792cac1726deb77d9039

                            SHA1

                            39890a418fb391b823ed5084533e2e24dff021e1

                            SHA256

                            9597798f7789adc29fbe97707b1bd8ca913c4d5861b0ad4fdd6b913af7c7a8e2

                            SHA512

                            85048799e6d2756f1d6af77f34e6a1f454c48f2f43042927845931b7ecff2e5de45f864627a3d4aa061252401225bbb6c2caa8532320ccbe401e97c9c79ac8e5

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\91qc6ZPONm.bat
                            Filesize

                            170B

                            MD5

                            4f4871202e137a57eed5ebb6ec0d7d7c

                            SHA1

                            b4132fa70c67e9c5d3b4c7d9768ed75f890bf340

                            SHA256

                            86fdaaac194a2579bfffd78dba358a1da0c689dfbd713dd31866ddc59355e4aa

                            SHA512

                            11aced9605756603f3e210373fa671dcdeca139cb3631ed4eb1eeba91b4a3f705cd7c59610f96a89594eb861690637fbebbad5b6c0c212ebbab015201fb648cc

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\EGIK0UNA19O6OCBJ35QY1CAM9PR.exe
                            Filesize

                            1.7MB

                            MD5

                            e33dc32f04e77bc26482baccb87b9795

                            SHA1

                            e4a57ead636bd006cecb7d9ec5e9aa36432e1372

                            SHA256

                            b2ecbacaf99db2c41066c1914b8b3116b5e25683e6552802a24b08d00d563431

                            SHA512

                            13d735438d20b0d352719c6e32584ed6abfaad6092ff9124393b3f1c6d6aa4314d0ce27c16cc654583973369572ec823423be9be04e34c50184976c0a35c96cf

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4p138X.exe
                            Filesize

                            2.7MB

                            MD5

                            ead473718663d9f85a4d487f8343bf82

                            SHA1

                            aa74f6c6b613bd5c7ed244f37dfa5cede287b8ef

                            SHA256

                            d15e8974d60859d550b2a5c20ea3644b4ed82a38644ec509d469bfb86ea95b9c

                            SHA512

                            4fd45893b47a48256af55c1d8fc1966138e97205888b723049b88060b4463a7b49b5694d254c54af525b84266b000db07e9905b0f30c98726e98f439b793cf4a

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\G1R20.exe
                            Filesize

                            5.4MB

                            MD5

                            37eb17e15798a3efb25654198a5390fc

                            SHA1

                            0185779b9f52a068b10435ad91ebe554aa2bab71

                            SHA256

                            0c06e7f548d5d74b53475d30578c17e3942286e4a9552898d195167e62ec21bc

                            SHA512

                            8a8b03459ee06d896b5c6c17f4b4feef8d8c35a69265943e4b90fcc94e93c891ad94446f838f6a8d2501748e986f045066f0c95858f0ad94310eab4b2d982af6

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3C41r.exe
                            Filesize

                            1.7MB

                            MD5

                            e328245a28e6a2cdb14bde4d150a342e

                            SHA1

                            c768975f4fe3deed8d1cc677c8ada7395a394865

                            SHA256

                            03b0ee461554c9ecfcc906404caf95247f39959ad36fff125722870f27efa0b5

                            SHA512

                            4d6ad474e969cb85b29bc6319f6e84151d3267cc2ed28b22fb1b11d7e28597c98a1b2405eace53ca42cb1c5f77723fca3bf03bdaff243861593d00bf57e84ac0

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\V1J61.exe
                            Filesize

                            3.6MB

                            MD5

                            0ec8abf311997a5f2e07d534e4bde4ae

                            SHA1

                            edf408c947486ed688940da01822c2de013b7b55

                            SHA256

                            377a52f7a45f84d4b728842a60bcb44ea6e4dc0d0d7ec83878bc767725419649

                            SHA512

                            a25442d797a610687e2c827e2c15fe94655f1cf8444c228a306a237b26788c173d12829c3eb1063c7486cbb66d388cc9804d0f55537ca163c05d7283d3aaba86

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1n77l6.exe
                            Filesize

                            2.9MB

                            MD5

                            842e251ca1e3a812356248ebe8154f16

                            SHA1

                            efb511d328cf0a7690e62cbb89adeebc07dddb3c

                            SHA256

                            14caca276f869dcc33a065b67a826a79c27cb0ec54407da220ed26cd045d941a

                            SHA512

                            2eaf72c87cda80fcc64463eda29ad62e21818bac52105af0b95c5504c935e7f480cba518575fad8f80d0748e11e41641063cb8b6e61da8584271e1068d7f3b74

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2j0874.exe
                            Filesize

                            1.8MB

                            MD5

                            259eb5422d10fd32691e5d0b5585bc0e

                            SHA1

                            b33a091415aa6e55ad88a901664b56b538100fc1

                            SHA256

                            5010145ced6d55e94ff13d6758e18aa89e387737f3a91c38d0839cd134a54cc5

                            SHA512

                            498614069c409bee2d78f10a4bb489f27f3651dc8a657116c729aa2daa8c480de4e6e1454864dac7f13f407ec6dbb4759d5f6279cccff84006b52de5ab4e8dea

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\ZFXNZ79PF717GPLC.exe
                            Filesize

                            2.6MB

                            MD5

                            f86c08a75747002a2a7cd3fbc5fe05c8

                            SHA1

                            7b9776338fe3a06350c16bc62e927f5ba6490723

                            SHA256

                            5b4d3426cd705909f38f2a136e2a5a1e593fd66a68c01b0e715f533d20a4218a

                            SHA512

                            2b8ab4cb0d7aba429f5835462a1c16dd4d0bc1a13c40c5ddf27a900295ca3c168dba79b8af97b26f80017755514e43f71120f1c309dece1fabd41d9147e63790

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_payjeoiq.ytm.ps1
                            Filesize

                            60B

                            MD5

                            d17fe0a3f47be24a6453e9ef58c94641

                            SHA1

                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                            SHA256

                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                            SHA512

                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\main\7z.dll
                            Filesize

                            1.6MB

                            MD5

                            72491c7b87a7c2dd350b727444f13bb4

                            SHA1

                            1e9338d56db7ded386878eab7bb44b8934ab1bc7

                            SHA256

                            34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                            SHA512

                            583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                            Filesize

                            458KB

                            MD5

                            619f7135621b50fd1900ff24aade1524

                            SHA1

                            6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                            SHA256

                            344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                            SHA512

                            2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_6.zip
                            Filesize

                            1.7MB

                            MD5

                            0dc4014facf82aa027904c1be1d403c1

                            SHA1

                            5e6d6c020bfc2e6f24f3d237946b0103fe9b1831

                            SHA256

                            a29ddd29958c64e0af1a848409e97401307277bb6f11777b1cfb0404a6226de7

                            SHA512

                            cbeead189918657cc81e844ed9673ee8f743aed29ad9948e90afdfbecacc9c764fbdbfb92e8c8ceb5ae47cee52e833e386a304db0572c7130d1a54fd9c2cc028

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_7.zip
                            Filesize

                            3.3MB

                            MD5

                            cea368fc334a9aec1ecff4b15612e5b0

                            SHA1

                            493d23f72731bb570d904014ffdacbba2334ce26

                            SHA256

                            07e38cad68b0cdbea62f55f9bc6ee80545c2e1a39983baa222e8af788f028541

                            SHA512

                            bed35a1cc56f32e0109ea5a02578489682a990b5cefa58d7cf778815254af9849e731031e824adba07c86c8425df58a1967ac84ce004c62e316a2e51a75c8748

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\main\file.bin
                            Filesize

                            3.3MB

                            MD5

                            045b0a3d5be6f10ddf19ae6d92dfdd70

                            SHA1

                            0387715b6681d7097d372cd0005b664f76c933c7

                            SHA256

                            94b392e94fa47d1b9b7ae6a29527727268cc2e3484e818c23608f8835bc1104d

                            SHA512

                            58255a755531791b888ffd9b663cc678c63d5caa932260e9546b1b10a8d54208334725c14529116b067bcf5a5e02da85e015a3bed80092b7698a43dab0168c7b

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\main\main.bat
                            Filesize

                            440B

                            MD5

                            3626532127e3066df98e34c3d56a1869

                            SHA1

                            5fa7102f02615afde4efd4ed091744e842c63f78

                            SHA256

                            2a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca

                            SHA512

                            dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                            Filesize

                            479KB

                            MD5

                            09372174e83dbbf696ee732fd2e875bb

                            SHA1

                            ba360186ba650a769f9303f48b7200fb5eaccee1

                            SHA256

                            c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                            SHA512

                            b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                            Filesize

                            13.8MB

                            MD5

                            0a8747a2ac9ac08ae9508f36c6d75692

                            SHA1

                            b287a96fd6cc12433adb42193dfe06111c38eaf0

                            SHA256

                            32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                            SHA512

                            59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin
                            Filesize

                            6KB

                            MD5

                            ce67b2a565b8fe413703a82cf5d1c829

                            SHA1

                            329470a45d2719cffcd2a8a163ca0bab7878ea90

                            SHA256

                            5209474e6a097ec4072373b061e9151747962a571bd138a4abc0dd7610b0d09f

                            SHA512

                            45d77da53ea1513e7011c957f6ac7f9fba70ccf876e7b9d18c88696614177be9a8a8f92141ca20e33deb63ec658d7f4ef19038d15293e13ce3a8e06c641d55c1

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin
                            Filesize

                            7KB

                            MD5

                            991f83402e60833518b7e646c3bb1170

                            SHA1

                            993b5e1456cd523afde77220958e59a9fdbdda62

                            SHA256

                            b6003748893b625bfb2731982419311643b2ff8116927016f22a4fffc3f10506

                            SHA512

                            5b4cb4310a85746420e81b9b4283134e566a0fa8ad8aeae0da59270074b57a0f9ed07af8f5d15e4e4608a5c56802644e4087aa5082e9e3b78860e50baa2d4f45

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin
                            Filesize

                            8KB

                            MD5

                            34225e81cfb8a7c5e60b246cc52640c4

                            SHA1

                            f16bbb536a898cdabe9d9e61d220acfb4573c096

                            SHA256

                            48ff6fd611b17eecd48541870b4d04180cb3924491ed52e37dc106b15121671b

                            SHA512

                            cdce24cbf629ff7353c298ccf79f3b0305d4831ad64832b1ef14f1870604dcaa6947fc51856d82ed74161505db37a8f4dba0718262663bc64e0d5a435909e09f

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.bin
                            Filesize

                            15KB

                            MD5

                            ef80cd9e475a0954c37e99ff1477d7e1

                            SHA1

                            be7c454e1ba0d9584880356ce4c88eb2d5988c88

                            SHA256

                            589dd6df8495a70747d9b687b93393b8732b2a4b060620769fc8fd3d056759bc

                            SHA512

                            f2c4ecbf284374a2a6017162f018dbb5d39eaabed68b69ef35eb533db7d4627639cb744f4072393ac0b0a1c3fdc00397803f9d826c28f5bb71ab3e73c980fed2

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.bin
                            Filesize

                            23KB

                            MD5

                            46288e276280cad330f5d15485e87616

                            SHA1

                            5dd81dd89d28d5fd016c9ba333e4329a5eddb64d

                            SHA256

                            be18ad4980c85a66f584b461002fbcf4e8998c30d142c7e6297153a1af31d404

                            SHA512

                            1c12dd67de9be68a472263aa801002bf84edab0dde72bb0afd21c63b976700b8cfa2518d60db8e3ed28a445bdc8761a892ae62fe418fa7cb4db2a37cf4813c04

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.bin
                            Filesize

                            5KB

                            MD5

                            4a5ab7e4a38a79f8beed889ccb1b7fca

                            SHA1

                            c1a290a9bfeb2662471e8c94c64f28028882022e

                            SHA256

                            78c8d27097e6a0a558a3edbae60c94de17d979027da08d5fd0ae7ee030ee0a66

                            SHA512

                            d62629edef21098cdf57cd1d68fbf7fc01597317c9b1387d242f0e30181faa9520636315eec0dad01ff38d403a056b1c2203418507e6d2eff0ec8c66821f271e

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.bin
                            Filesize

                            15KB

                            MD5

                            4979ec14a9e130e3d3a29823d046e19e

                            SHA1

                            d7cd06d6d093a7619292d50772eebf21b232d7dc

                            SHA256

                            a75a43d295a72b9505fa1583f6beca26168b2ae177a59c9574893e100c295019

                            SHA512

                            244ac707b3d09ae9d952b83f4b529676d7e5e211a7a1749219fe253c1d29a9c83252a9bc49a6b869a9f561550a724aacedc8a52f003ee638d49aa4f1eefc6fdf

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
                            Filesize

                            5KB

                            MD5

                            0adfd6838f5620089ca4d7ec886c5bdd

                            SHA1

                            23ffa42d7fc8cfdbe3a1015d206fcf5f9be59aef

                            SHA256

                            1ca0a46a202e9a60345d1f4760b0387c7617c72c65444d8239777a1b9979c660

                            SHA512

                            bab203c2a932f95302887fdb2c1396d647d806deaf8ed54e0fe28360731c8757cbfe6a5dbed7a300e82fd14c6fe03e61c0069d04516847757e9014af235f91db

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
                            Filesize

                            15KB

                            MD5

                            02fb17a027f750334f5dce68c2a22e3c

                            SHA1

                            ec04ee51755211fa1b00f1237c7fb27df92a4a83

                            SHA256

                            11078d0beeabfcc1f67471780164d3f2eeaa0f782e02742aa1478641f4113611

                            SHA512

                            bccd759587cd94f01ec5f4bf2fd2e1cf2751467e4176de9b9d7388ed68980a9e1e240eac631fa0df6d4ff6767f70269723cd99ce5cc85d009321560e0e223b30

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
                            Filesize

                            6KB

                            MD5

                            fad71ba052499b7677ad5af3af0d25ff

                            SHA1

                            36fac06c9c9bbc0dc9bbbd7dae0b405f0a66bd48

                            SHA256

                            4b14a47ccfd5dc27a355c9111077ebb3f7f5376bd504400ce18bbca90cea7cea

                            SHA512

                            2bf5957698404c5c74b7173e351d08eb32765218f5bec2c584bc937c887d5eac90961248b9765e02d447f887f601749ab97370e295e78fe16112b8b551afbf90

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
                            Filesize

                            6KB

                            MD5

                            a2f2e8f4a0eba9ce1c3bda948dbbb289

                            SHA1

                            0fbb8a8ef6b32eae4ce3490b0d050b7e798ad3fb

                            SHA256

                            7f5bf1215217ffb1534c5f080218024655fad5e2528b0033869374fb39b0a842

                            SHA512

                            5bb4a2009523b4d46ece7e995360437c9ae78ef8463e60333c173c001da460475349246bd58167227d1579009cfcee07b58ddfb4d6fc2d7344915b5edfec20fe

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
                            Filesize

                            15KB

                            MD5

                            04f1ee9a34472525ee47bb089a2aec68

                            SHA1

                            dfc2c543649e370191a73e9bc0bc1d3442e4d2c6

                            SHA256

                            e26af4013ea8ddaab2986c7adb49d9655418e2adc5d97e76667110fc07e1939e

                            SHA512

                            f66d0ecde2a548243c74fb995b312fbd96c4eed8508d2b8082a937f5f862a05cff929641cb907c8316cfe8a20bf2a0fbfad14f3a18d7cad51a8b5d8f63c91181

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\6a47b002-716d-4f0a-aab6-11d1ff3a2258
                            Filesize

                            671B

                            MD5

                            5711e9e03c5e03c9e86cb777bb7a8469

                            SHA1

                            2f7042ddfaad767fe294810223cf5c7f5876a839

                            SHA256

                            1c6b6c10f35b9e25229dc102991698ed244c48525be24e2b8ee1244f1130d4df

                            SHA512

                            862d3ee956fef5d192ce00bdc654b0f14d7a2ee3f456172e4aaa9d7f551451b0e01b69de6f9645d7e1813543ffd1e76fa0f07922ad879a07b5f65a8bbd5b2919

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\762a2461-d607-4c9a-a0c7-c511e21a1119
                            Filesize

                            982B

                            MD5

                            e5d7ba0740f6d368989f69ca757b1dfb

                            SHA1

                            5bb79b4a669d260038115966e06a483f669ebd83

                            SHA256

                            85476d5fe0ef56ef2e4158faa448000feeb50f9a4d8fdd5a21407d746a63e4fc

                            SHA512

                            778de990627c287d966d0af8a64384e45e3c77612fd3d9c3cb149265c45675f4a8901ef04098820db51ebddcabe6dbc76eaff0f537a4ce566f585ac17a2d9b5a

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\c3d353e6-1a36-4c56-8696-7eece1e28dda
                            Filesize

                            27KB

                            MD5

                            e2bcfabb65fdf2b0b5e25135a98a125d

                            SHA1

                            ebe460f256040d9f4c8d63f7ff6733a0253fd18d

                            SHA256

                            ed1f40bda704352ed303aa785d7b48ca3e616ba017899bb9a1d392981dcac3f5

                            SHA512

                            6c1ffabbff86ed757fafee179f9cc1a0c2691d8a4d30afadc0dd176bfd055a81260279901507b0af5f5fee328ea27065aa7ff688d5cbb0af3d7bd4d4bfa08a5a

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                            Filesize

                            1.1MB

                            MD5

                            842039753bf41fa5e11b3a1383061a87

                            SHA1

                            3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                            SHA256

                            d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                            SHA512

                            d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                            Filesize

                            116B

                            MD5

                            2a461e9eb87fd1955cea740a3444ee7a

                            SHA1

                            b10755914c713f5a4677494dbe8a686ed458c3c5

                            SHA256

                            4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                            SHA512

                            34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                            Filesize

                            372B

                            MD5

                            bf957ad58b55f64219ab3f793e374316

                            SHA1

                            a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                            SHA256

                            bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                            SHA512

                            79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                            Filesize

                            17.8MB

                            MD5

                            daf7ef3acccab478aaa7d6dc1c60f865

                            SHA1

                            f8246162b97ce4a945feced27b6ea114366ff2ad

                            SHA256

                            bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                            SHA512

                            5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js
                            Filesize

                            10KB

                            MD5

                            b42cc94417f7dd73f98dee154a8b0b47

                            SHA1

                            775f329a4943762477aaee3dc21d0ce032f9d538

                            SHA256

                            d166da786fd7f93cc3d076ab1f1fad19850d528ba5023a4f0a5a6438d6846f6e

                            SHA512

                            566571de2249d7cc96955977e30d52bdafec3b8aefa7b7f320d9249573405baf6230bc910526311d5f81a4cc9ae67a51900db77d58d480f9c41b9c89b53e6ec5

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js
                            Filesize

                            12KB

                            MD5

                            0e3db551a27190c149416eb1691fbbe5

                            SHA1

                            8b39b763e2016808846eefc7cf548502580110ef

                            SHA256

                            209e5a9a92e15ce14faf0bd3dc604214259c81ec6590d76b899d0ad7e3ba9bf2

                            SHA512

                            17ee5ff5af62e1ca00de857a2d7b6de007af1dcfb879fe59942674a7d13675b3e2201a4c18279de9222ebd7b3aabda59ff8a668609829e2ca869b8a4829ab3a6

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js
                            Filesize

                            15KB

                            MD5

                            48b59849c0739c3aec7d511020119f71

                            SHA1

                            d8be8075ece7d6fb372bc44d6a32d827397c57bd

                            SHA256

                            bbf13f5e76e4a154da3ec1d1cd62810b5a7593a5cc1e48558477f8c4a7e2215d

                            SHA512

                            04ff0dd5999a625f7301d78cf1135a1c11875d3d936fb51caf3a0cd79059ac00a706b83fad03664356aed060b8a8d74e17f92c5859df23e98a9e0a70ab5eac28

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs.js
                            Filesize

                            10KB

                            MD5

                            579283fb31aa47a02b43eceae55af5fa

                            SHA1

                            16dfe6587962b5ba1625492559a07fcedab967a0

                            SHA256

                            df8a5540d88ceca2b7ad6fc8ed5e41b7a5b8e8a854c5422b765f2c0c660d6609

                            SHA512

                            6071c3a3b22fa8e36899e390ce86192d3819a182d6d28bbd199591b329a81ef1e72be1b84b6c128e8803fc2fbc24d24e92b4c88fe702f86e90a5ead15e23e435

                            Download Submit

                          • memory/312-229-0x000002DE198D0000-0x000002DE198F2000-memory.dmp

                            Filesize

                            136KB

                            Download

                          • memory/964-155-0x00000000000D0000-0x000000000055B000-memory.dmp

                            Filesize

                            4.5MB

                            Download

                          • memory/964-143-0x00000000000D0000-0x000000000055B000-memory.dmp

                            Filesize

                            4.5MB

                            Download

                          • memory/1020-260-0x0000000000190000-0x0000000000825000-memory.dmp

                            Filesize

                            6.6MB

                            Download

                          • memory/1020-262-0x0000000000190000-0x0000000000825000-memory.dmp

                            Filesize

                            6.6MB

                            Download

                          • memory/1064-113-0x00000000002D0000-0x0000000000773000-memory.dmp

                            Filesize

                            4.6MB

                            Download

                          • memory/1064-85-0x00000000002D0000-0x0000000000773000-memory.dmp

                            Filesize

                            4.6MB

                            Download

                          • memory/1064-38-0x00000000002D0000-0x0000000000773000-memory.dmp

                            Filesize

                            4.6MB

                            Download

                          • memory/1064-83-0x00000000002D0000-0x0000000000773000-memory.dmp

                            Filesize

                            4.6MB

                            Download

                          • memory/1516-264-0x00000000007F0000-0x0000000001466000-memory.dmp

                            Filesize

                            12.5MB

                            Download

                          • memory/1516-1356-0x00000000007F0000-0x0000000001466000-memory.dmp

                            Filesize

                            12.5MB

                            Download

                          • memory/1516-1959-0x00000000007F0000-0x0000000001466000-memory.dmp

                            Filesize

                            12.5MB

                            Download

                          • memory/1516-1067-0x00000000007F0000-0x0000000001466000-memory.dmp

                            Filesize

                            12.5MB

                            Download

                          • memory/1516-3457-0x00000000007F0000-0x0000000001466000-memory.dmp

                            Filesize

                            12.5MB

                            Download

                          • memory/1516-263-0x00000000007F0000-0x0000000001466000-memory.dmp

                            Filesize

                            12.5MB

                            Download

                          • memory/1516-1169-0x00000000007F0000-0x0000000001466000-memory.dmp

                            Filesize

                            12.5MB

                            Download

                          • memory/1516-2961-0x00000000007F0000-0x0000000001466000-memory.dmp

                            Filesize

                            12.5MB

                            Download

                          • memory/1516-3456-0x00000000007F0000-0x0000000001466000-memory.dmp

                            Filesize

                            12.5MB

                            Download

                          • memory/1516-173-0x00000000007F0000-0x0000000001466000-memory.dmp

                            Filesize

                            12.5MB

                            Download

                          • memory/1900-291-0x0000000000230000-0x00000000004E0000-memory.dmp

                            Filesize

                            2.7MB

                            Download

                          • memory/1900-290-0x0000000000230000-0x00000000004E0000-memory.dmp

                            Filesize

                            2.7MB

                            Download

                          • memory/1900-1097-0x0000000000230000-0x00000000004E0000-memory.dmp

                            Filesize

                            2.7MB

                            Download

                          • memory/1900-1087-0x0000000000230000-0x00000000004E0000-memory.dmp

                            Filesize

                            2.7MB

                            Download

                          • memory/1900-287-0x0000000000230000-0x00000000004E0000-memory.dmp

                            Filesize

                            2.7MB

                            Download

                          • memory/2580-286-0x0000000000460000-0x000000000090C000-memory.dmp

                            Filesize

                            4.7MB

                            Download

                          • memory/2580-842-0x0000000000460000-0x000000000090C000-memory.dmp

                            Filesize

                            4.7MB

                            Download

                          • memory/2580-194-0x0000000000460000-0x000000000090C000-memory.dmp

                            Filesize

                            4.7MB

                            Download

                          • memory/2580-289-0x0000000000460000-0x000000000090C000-memory.dmp

                            Filesize

                            4.7MB

                            Download

                          • memory/3168-119-0x0000000000560000-0x0000000000C00000-memory.dmp

                            Filesize

                            6.6MB

                            Download

                          • memory/3168-123-0x0000000000560000-0x0000000000C00000-memory.dmp

                            Filesize

                            6.6MB

                            Download

                          • memory/3216-2467-0x00000000008A0000-0x0000000000BBB000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/3216-1203-0x00000000008A0000-0x0000000000BBB000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/3216-292-0x00000000008A0000-0x0000000000BBB000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/3216-81-0x00000000008A0000-0x0000000000BBB000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/3216-3461-0x00000000008A0000-0x0000000000BBB000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/3216-147-0x00000000008A0000-0x0000000000BBB000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/3216-1544-0x00000000008A0000-0x0000000000BBB000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/3216-66-0x00000000008A0000-0x0000000000BBB000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/3216-3466-0x00000000008A0000-0x0000000000BBB000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/3216-200-0x00000000008A0000-0x0000000000BBB000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/3216-35-0x00000000008A0000-0x0000000000BBB000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/3216-3465-0x00000000008A0000-0x0000000000BBB000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/3216-1098-0x00000000008A0000-0x0000000000BBB000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/3216-3451-0x00000000008A0000-0x0000000000BBB000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/3292-199-0x0000000000F00000-0x00000000010E6000-memory.dmp

                            Filesize

                            1.9MB

                            Download

                          • memory/3292-211-0x0000000001B10000-0x0000000001B1C000-memory.dmp

                            Filesize

                            48KB

                            Download

                          • memory/3292-202-0x00000000018B0000-0x00000000018BE000-memory.dmp

                            Filesize

                            56KB

                            Download

                          • memory/3292-204-0x0000000001B30000-0x0000000001B4C000-memory.dmp

                            Filesize

                            112KB

                            Download

                          • memory/3292-205-0x000000001BD00000-0x000000001BD50000-memory.dmp

                            Filesize

                            320KB

                            Download

                          • memory/3292-207-0x0000000001B50000-0x0000000001B68000-memory.dmp

                            Filesize

                            96KB

                            Download

                          • memory/3292-209-0x00000000018D0000-0x00000000018DE000-memory.dmp

                            Filesize

                            56KB

                            Download

                          • memory/3496-144-0x0000000000E00000-0x00000000010C2000-memory.dmp

                            Filesize

                            2.8MB

                            Download

                          • memory/3496-127-0x0000000000E00000-0x00000000010C2000-memory.dmp

                            Filesize

                            2.8MB

                            Download

                          • memory/3496-145-0x0000000000E00000-0x00000000010C2000-memory.dmp

                            Filesize

                            2.8MB

                            Download

                          • memory/3496-174-0x0000000000E00000-0x00000000010C2000-memory.dmp

                            Filesize

                            2.8MB

                            Download

                          • memory/3496-178-0x0000000000E00000-0x00000000010C2000-memory.dmp

                            Filesize

                            2.8MB

                            Download

                          • memory/3624-89-0x0000000000380000-0x0000000000630000-memory.dmp

                            Filesize

                            2.7MB

                            Download

                          • memory/3624-99-0x0000000000380000-0x0000000000630000-memory.dmp

                            Filesize

                            2.7MB

                            Download

                          • memory/3624-100-0x0000000000380000-0x0000000000630000-memory.dmp

                            Filesize

                            2.7MB

                            Download

                          • memory/3624-149-0x0000000000380000-0x0000000000630000-memory.dmp

                            Filesize

                            2.7MB

                            Download

                          • memory/3624-157-0x0000000000380000-0x0000000000630000-memory.dmp

                            Filesize

                            2.7MB

                            Download

                          • memory/3780-114-0x0000000000C80000-0x0000000001315000-memory.dmp

                            Filesize

                            6.6MB

                            Download

                          • memory/3780-121-0x0000000000C80000-0x0000000001315000-memory.dmp

                            Filesize

                            6.6MB

                            Download

                          • memory/4260-148-0x0000000000F30000-0x0000000001B49000-memory.dmp

                            Filesize

                            12.1MB

                            Download

                          • memory/4260-84-0x0000000000F30000-0x0000000001B49000-memory.dmp

                            Filesize

                            12.1MB

                            Download

                          • memory/4260-151-0x0000000000F30000-0x0000000001B49000-memory.dmp

                            Filesize

                            12.1MB

                            Download

                          • memory/4260-146-0x0000000000F30000-0x0000000001B49000-memory.dmp

                            Filesize

                            12.1MB

                            Download

                          • memory/4392-21-0x0000000000F60000-0x000000000127B000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/4392-34-0x0000000000F60000-0x000000000127B000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/4448-41-0x00000000008A0000-0x0000000000BBB000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/4448-42-0x00000000008A0000-0x0000000000BBB000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/4640-116-0x0000000000400000-0x0000000000470000-memory.dmp

                            Filesize

                            448KB

                            Download

                          • memory/5304-1199-0x0000000000400000-0x0000000000457000-memory.dmp

                            Filesize

                            348KB

                            Download

                          • memory/5304-1201-0x0000000000400000-0x0000000000457000-memory.dmp

                            Filesize

                            348KB

                            Download

                          • memory/5304-1198-0x0000000000400000-0x0000000000457000-memory.dmp

                            Filesize

                            348KB

                            Download

                          • memory/5572-1210-0x00000000008A0000-0x0000000000BBB000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/5572-1208-0x00000000008A0000-0x0000000000BBB000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/5652-1016-0x0000000000040000-0x00000000002F0000-memory.dmp

                            Filesize

                            2.7MB

                            Download

                          • memory/5652-1051-0x0000000000040000-0x00000000002F0000-memory.dmp

                            Filesize

                            2.7MB

                            Download

                          • memory/5652-1050-0x0000000000040000-0x00000000002F0000-memory.dmp

                            Filesize

                            2.7MB

                            Download

                          • memory/5652-1130-0x0000000000040000-0x00000000002F0000-memory.dmp

                            Filesize

                            2.7MB

                            Download

                          • memory/5652-1157-0x0000000000040000-0x00000000002F0000-memory.dmp

                            Filesize

                            2.7MB

                            Download

                          • memory/6040-1278-0x0000000140000000-0x0000000140770000-memory.dmp

                            Filesize

                            7.4MB

                            Download

                          • memory/6040-1291-0x0000000140000000-0x0000000140770000-memory.dmp

                            Filesize

                            7.4MB

                            Download

                          • memory/6040-1272-0x0000000140000000-0x0000000140770000-memory.dmp

                            Filesize

                            7.4MB

                            Download

                          • memory/6040-1296-0x0000000140000000-0x0000000140770000-memory.dmp

                            Filesize

                            7.4MB

                            Download

                          • memory/6040-1290-0x0000000000F90000-0x0000000000FB0000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/6040-1271-0x0000000140000000-0x0000000140770000-memory.dmp

                            Filesize

                            7.4MB

                            Download

                          • memory/6040-1289-0x0000000140000000-0x0000000140770000-memory.dmp

                            Filesize

                            7.4MB

                            Download

                          • memory/6040-1275-0x0000000140000000-0x0000000140770000-memory.dmp

                            Filesize

                            7.4MB

                            Download

                          • memory/6040-1276-0x0000000140000000-0x0000000140770000-memory.dmp

                            Filesize

                            7.4MB

                            Download

                          • memory/6040-1277-0x0000000140000000-0x0000000140770000-memory.dmp

                            Filesize

                            7.4MB

                            Download

                          • memory/6040-1283-0x0000000140000000-0x0000000140770000-memory.dmp

                            Filesize

                            7.4MB

                            Download

                          • memory/6040-1281-0x0000000140000000-0x0000000140770000-memory.dmp

                            Filesize

                            7.4MB

                            Download

                          • memory/6076-1270-0x00007FF74A5D0000-0x00007FF74AA60000-memory.dmp

                            Filesize

                            4.6MB

                            Download

                          • memory/6076-1293-0x00007FF74A5D0000-0x00007FF74AA60000-memory.dmp

                            Filesize

                            4.6MB

                            Download

                          • memory/6168-3467-0x00000000008A0000-0x0000000000BBB000-memory.dmp

                            Filesize

                            3.1MB

                            Download

                          • memory/6664-1172-0x00007FF7EAFB0000-0x00007FF7EB440000-memory.dmp

                            Filesize

                            4.6MB

                            Download

                          • memory/6664-1175-0x00007FF7EAFB0000-0x00007FF7EB440000-memory.dmp

                            Filesize

                            4.6MB

                            Download

                          • memory/6904-1049-0x00000000007D0000-0x0000000000E65000-memory.dmp

                            Filesize

                            6.6MB

                            Download

                          • memory/6904-843-0x00000000007D0000-0x0000000000E65000-memory.dmp

                            Filesize

                            6.6MB

                            Download